@dereekb/firebase-server 13.11.2 → 13.11.4

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.11.2",
+  "version": "13.11.4",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.2",
-    "@dereekb/date": "13.11.2",
-    "@dereekb/firebase": "13.11.2",
-    "@dereekb/firebase-server": "13.11.2",
-    "@dereekb/model": "13.11.2",
-    "@dereekb/nestjs": "13.11.2",
-    "@dereekb/rxjs": "13.11.2",
-    "@dereekb/util": "13.11.2",
-    "@dereekb/zoho": "13.11.2",
+    "@dereekb/analytics": "13.11.4",
+    "@dereekb/date": "13.11.4",
+    "@dereekb/firebase": "13.11.4",
+    "@dereekb/firebase-server": "13.11.4",
+    "@dereekb/model": "13.11.4",
+    "@dereekb/nestjs": "13.11.4",
+    "@dereekb/rxjs": "13.11.4",
+    "@dereekb/util": "13.11.4",
+    "@dereekb/zoho": "13.11.4",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",

package/oidc/src/lib/controller/oidc.interaction.controller.d.ts

@@ -3,6 +3,7 @@ import { OidcProviderConfigService } from '../service';
 import { type OAuthInteractionConsentRequest, type OAuthInteractionLoginRequest, type OidcInteractionUid } from '@dereekb/firebase';
 import { OidcAccountService } from '../service/oidc.account.service';
 import { OidcInteractionService } from '../service/oidc.interaction.service';
+import { OidcService } from '../service/oidc.service';
 /**
  * Controller for OIDC interaction endpoints (login/consent).
  *
@@ -17,7 +18,8 @@ export declare class OidcInteractionController {
     private readonly oidcInteractionService;
     private readonly oidcProviderConfigService;
     private readonly accountService;
-    constructor(oidcInteractionService: OidcInteractionService, oidcProviderConfigService: OidcProviderConfigService, accountService: OidcAccountService);
+    private readonly oidcService;
+    constructor(oidcInteractionService: OidcInteractionService, oidcProviderConfigService: OidcProviderConfigService, accountService: OidcAccountService, oidcService: OidcService);
     /**
      * GET /interaction/:uid
      *

package/oidc/src/lib/model/oidc/oidcmodel.action.server.d.ts

@@ -1,6 +1,7 @@
-import { type AsyncFirebaseFunctionCreateAction, type AsyncOidcEntryUpdateAction, type AsyncOidcEntryDeleteAction, type CreateOidcClientParams, type CreateOidcClientResult, type UpdateOidcClientParams, type DeleteOidcClientParams, type RotateOidcClientSecretParams, type RotateOidcClientSecretResult, type OidcEntryDocument } from '@dereekb/firebase';
+import { type AsyncFirebaseFunctionCreateAction, type AsyncOidcEntryUpdateAction, type AsyncOidcEntryDeleteAction, type CreateOidcClientParams, type CreateOidcClientResult, type UpdateOidcClientParams, type DeleteOidcClientParams, type DeleteOidcTokenParams, type RotateOidcClientSecretParams, type RotateOidcClientSecretResult, type OidcEntryDocument } from '@dereekb/firebase';
 import { type FirebaseServerActionsContext } from '@dereekb/firebase-server';
 import { type OidcClientService } from '../../service/oidc.client.service';
+import { type OidcService } from '../../service/oidc.service';
 /**
  * Context providing the OIDC client service and server action utilities needed by OIDC model server actions.
  */
@@ -9,6 +10,10 @@ export interface OidcModelServerActionsContext extends FirebaseServerActionsCont
      * Service for managing OIDC client adapter entries.
      */
     readonly oidcClientService: OidcClientService;
+    /**
+     * Core OIDC service used for grant revocation.
+     */
+    readonly oidcService: OidcService;
 }
 /**
  * Abstract service class defining all server-side OIDC client CRUD actions.
@@ -20,6 +25,7 @@ export declare abstract class OidcModelServerActions {
     abstract updateOidcClient(params: UpdateOidcClientParams): AsyncOidcEntryUpdateAction<UpdateOidcClientParams>;
     abstract rotateOidcClientSecret(params: RotateOidcClientSecretParams): AsyncFirebaseFunctionCreateAction<RotateOidcClientSecretParams, RotateOidcClientSecretResult, OidcEntryDocument>;
     abstract deleteOidcClient(params: DeleteOidcClientParams): AsyncOidcEntryDeleteAction<DeleteOidcClientParams>;
+    abstract deleteOidcToken(params: DeleteOidcTokenParams): AsyncOidcEntryDeleteAction<DeleteOidcTokenParams>;
 }
 /**
  * Creates a concrete {@link OidcModelServerActions} implementation wired to the provided context.
@@ -73,3 +79,18 @@ export declare function rotateOidcClientSecretFactory(context: OidcModelServerAc
  * @returns a transform function factory for deleting OIDC clients
  */
 export declare function deleteOidcClientFactory(context: OidcModelServerActionsContext): import("@dereekb/model").TransformAndValidateFunctionResultFunction<import("@dereekb/firebase").TargetModelParams, (document: OidcEntryDocument) => Promise<void>, object, unknown>;
+/**
+ * Factory for the `deleteOidcToken` action.
+ *
+ * Asserts the target {@link OidcEntryDocument} is of type `Grant`, then delegates to
+ * {@link OidcService.revokeGrant} so all grantable token entries (`AccessToken`,
+ * `RefreshToken`, `AuthorizationCode`, `DeviceCode`, `BackchannelAuthenticationRequest`)
+ * sharing the grant id are deleted along with the Grant entry itself.
+ *
+ * Per-user authorization (this user owns this Grant) is enforced upstream via the
+ * model permission service before this action runs.
+ *
+ * @param context - the OIDC model server actions context
+ * @returns a transform function factory for revoking OIDC grants
+ */
+export declare function deleteOidcTokenFactory(context: OidcModelServerActionsContext): import("@dereekb/model").TransformAndValidateFunctionResultFunction<import("@dereekb/firebase").TargetModelParams, (document: OidcEntryDocument) => Promise<void>, object, unknown>;

package/oidc/src/lib/model/oidc/oidcmodel.module.d.ts

@@ -1,17 +1,20 @@
 import { type ModuleMetadata } from '@nestjs/common';
 import { OidcModelServerActions } from './oidcmodel.action.server';
 import { OidcClientService } from '../../service/oidc.client.service';
+import { OidcService } from '../../service/oidc.service';
 /**
- * Factory that creates an {@link OidcModelServerActions} instance from the injected {@link OidcClientService}.
+ * Factory that creates an {@link OidcModelServerActions} instance from the injected services.
  *
- * @param oidcClientService - the OIDC client service to wire into the server actions
+ * @param oidcClientService - the OIDC client service for client CRUD actions
+ * @param oidcService - the core OIDC service for grant revocation
  * @returns the configured OidcModelServerActions instance
  */
-export declare function oidcModelServerActionsFactory(oidcClientService: OidcClientService): OidcModelServerActions;
+export declare function oidcModelServerActionsFactory(oidcClientService: OidcClientService, oidcService: OidcService): OidcModelServerActions;
 export interface ProvideAppOidcModelMetadataConfig {
     /**
      * The OidcModule that exports the required OIDC dependencies:
      * - {@link OidcClientService}
+     * - {@link OidcService}
      */
     readonly oidcModule: Required<ModuleMetadata>['imports']['0'];
 }

package/oidc/src/lib/oidc.config.d.ts

@@ -1,5 +1,5 @@
 import type { Configuration } from 'oidc-provider';
-import { type WebsitePath, type SlashPath } from '@dereekb/util';
+import { type WebsitePath, type SlashPath, type Seconds } from '@dereekb/util';
 import { type OidcScope, type OidcTokenEndpointAuthMethod } from '@dereekb/firebase';
 import { type JwksServiceConfig } from './service/oidc.jwks.service';
 import { type JwksKeyConverterConfig } from './model';
@@ -49,27 +49,51 @@ export interface OidcProviderConfig<S extends OidcScope = OidcScope> {
 }
 /**
  * Configures the lifetime (in seconds) for each token type issued by the OIDC provider.
+ *
+ * `session` and `grant` set the *default* TTLs; the effective values may be reduced when a
+ * client passes the `dbx_session_ttl` request param (see {@link OidcModuleConfig.maxRequestedLoginDuration}).
  */
 export interface OidcTokenLifetimes {
     /**
      * Access token lifetime in seconds. Defaults to 900 (15 min).
      */
-    readonly accessToken: number;
+    readonly accessToken: Seconds;
     /**
      * ID token lifetime in seconds. Defaults to 3600 (1 hour).
      */
-    readonly idToken: number;
+    readonly idToken: Seconds;
     /**
      * Refresh token lifetime in seconds (absolute). Defaults to 2592000 (30 days).
      */
-    readonly refreshToken: number;
+    readonly refreshToken: Seconds;
     /**
      * Authorization code lifetime in seconds. Defaults to 60.
      */
-    readonly authorizationCode: number;
+    readonly authorizationCode: Seconds;
+    /**
+     * Session lifetime in seconds. Defaults to 2592000 (30 days).
+     *
+     * Caps how long a user's authenticated session at the IdP lasts before re-authentication is required.
+     */
+    readonly session: Seconds;
+    /**
+     * Grant lifetime in seconds. Defaults to 2592000 (30 days).
+     *
+     * Caps how long a granted authorization (consent) lasts. Once the grant expires, refresh tokens
+     * issued under it stop working and the user must re-consent.
+     */
+    readonly grant: Seconds;
 }
 /**
- * Default token lifetimes: 15 min access tokens, 30-day refresh tokens, 60 s auth codes.
+ * Default global ceiling for a client-requested login duration, in seconds. 90 days.
+ */
+export declare const DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS: number;
+/**
+ * Default global floor for a client-requested login duration, in seconds. 1 hour.
+ */
+export declare const DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS: number;
+/**
+ * Default token lifetimes: 15 min access tokens, 30-day refresh tokens, 30-day sessions/grants, 60 s auth codes.
  */
 export declare const DEFAULT_OIDC_TOKEN_LIFETIMES: OidcTokenLifetimes;
 /**
@@ -108,6 +132,29 @@ export declare abstract class OidcModuleConfig {
      * Token lifetime configuration.
      */
     readonly tokenLifetimes: OidcTokenLifetimes;
+    /**
+     * Maximum login duration (seconds) a client may request via the `dbx_session_ttl` auth-URL param.
+     *
+     * Acts as the global server cap for any per-request duration. A registered client can declare its own
+     * lower ceiling via the `dbx_max_session_ttl` client metadata field; the effective ceiling is
+     * `min(client.dbx_max_session_ttl, this)`.
+     *
+     * Defaults to {@link DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS} (90 days).
+     */
+    readonly maxRequestedLoginDuration?: number;
+    /**
+     * Minimum login duration (seconds) a client may request via the `dbx_session_ttl` auth-URL param.
+     *
+     * Requested values below this floor are clamped up. Prevents pathological 30-second sessions.
+     *
+     * Defaults to {@link DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS} (1 hour).
+     */
+    readonly minRequestedLoginDuration?: number;
+    /**
+     * Default login duration (seconds) used when a client does NOT pass the `dbx_session_ttl`
+     * auth-URL param. When undefined, falls back to {@link OidcTokenLifetimes.refreshToken}.
+     */
+    readonly defaultRequestedLoginDuration?: number;
     /**
      * JWKS service configuration (encryption secret, rotated key max age).
      */
@@ -164,6 +211,35 @@ export declare abstract class OidcModuleConfig {
      * Defaults to `false`.
      */
     readonly registrationEnabled?: boolean;
+    /**
+     * Whether the oidc-provider should trust upstream proxy headers
+     * (`X-Forwarded-Host`, `X-Forwarded-Proto`) when computing the request URL
+     * used to build resume/return URLs and discovery metadata absolute paths.
+     *
+     * Required when running behind a reverse proxy such as Firebase Hosting →
+     * Cloud Run / Cloud Functions, where the request `Host` header is the
+     * underlying Cloud Run host (e.g. `api-xxxxx-uc.a.run.app`) and not the
+     * canonical issuer host. Without this, the interaction `returnTo` URL is
+     * built off the Cloud Run host and the browser is redirected away from the
+     * issuer's domain after login — causing the interaction cookies (scoped to
+     * the canonical host) to be missing on the resume request and producing
+     * "authorization request has expired".
+     *
+     * Maps to `provider.proxy = <value>` on the underlying oidc-provider
+     * (which is the Koa `app.proxy` setting).
+     *
+     * Defaults to `'prod_only'` if the environment is `production`, otherwise `false`.
+     */
+    readonly trustProxy?: boolean;
+    /**
+     * Whether to trust proxy headers in a non-production environment, such as the local environment.
+     *
+     * The dev environment typically does not require proxy headers, and setting
+     * `true` will result in errors.
+     *
+     * Defaults to `false`.
+     */
+    readonly trustProxyInNonProduction?: boolean;
     /**
      * Validates that all required fields are present on the config.
      *

package/oidc/src/lib/oidc.module.d.ts

@@ -89,7 +89,7 @@ export interface ProvideAppOidcModuleMetadataConfig extends Pick<ModuleMetadata,
     /**
      * Optional overrides to merge into the {@link OidcModuleConfig} produced by the factory.
      */
-    readonly config?: Partial<Pick<OidcModuleConfig, 'suppressBodyParserWarning' | 'renderError' | 'protectedPaths' | 'appOAuthInteractionPath' | 'appOAuthLoginUrlPart' | 'appOAuthConsentUrlPart' | 'tokenEndpointAuthMethods' | 'registrationEnabled'>>;
+    readonly config?: Partial<Pick<OidcModuleConfig, 'suppressBodyParserWarning' | 'renderError' | 'protectedPaths' | 'appOAuthInteractionPath' | 'appOAuthLoginUrlPart' | 'appOAuthConsentUrlPart' | 'tokenEndpointAuthMethods' | 'registrationEnabled' | 'trustProxy' | 'trustProxyInNonProduction' | 'tokenLifetimes' | 'maxRequestedLoginDuration' | 'minRequestedLoginDuration' | 'defaultRequestedLoginDuration'>>;
 }
 /**
  * Convenience function used to generate ModuleMetadata for an app's OidcModule.

package/oidc/src/lib/service/oidc.adapter.service.d.ts

@@ -1,6 +1,11 @@
 import type { AdapterConstructor } from 'oidc-provider';
 import { type OidcServerFirestoreCollections } from '../model';
 import { type OidcEncryptionService } from './oidc.encryption.service';
+/**
+ * Model types that support grantId-based revocation.
+ */
+export declare const GRANTABLE_MODEL_NAMES: readonly ["AccessToken", "AuthorizationCode", "RefreshToken", "DeviceCode", "BackchannelAuthenticationRequest"];
+export type GrantableModelName = (typeof GRANTABLE_MODEL_NAMES)[number];
 /**
  * Creates an oidc-provider adapter constructor backed by Firestore via {@link OidcServerFirestoreCollections}.
  *

package/oidc/src/lib/service/oidc.interaction.service.d.ts

@@ -50,10 +50,16 @@ export declare class OidcInteractionService {
     /**
      * Finds an existing grant by ID, or creates a new one.
      *
+     * For new grants, optionally pre-set `expiresIn` so {@link Grant#save} writes the requested TTL
+     * instead of falling through to the configured Grant TTL function (which cannot read the original
+     * `dbx_session_ttl` request param when save is driven from a NestJS controller — see
+     * {@link OidcService#resolveLoginDurationForGrant}).
+     *
      * @param grantId - the existing grant ID to look up, or undefined to create a new grant
      * @param accountId - the account ID for creating a new grant
      * @param clientId - the client ID for creating a new grant
+     * @param expiresInSeconds - optional TTL (seconds) to assign to a newly-created grant
      * @returns the found or newly created grant
      */
-    findOrCreateGrant(grantId: string | undefined, accountId: string, clientId: string): Promise<Grant>;
+    findOrCreateGrant(grantId: string | undefined, accountId: string, clientId: string, expiresInSeconds?: number): Promise<Grant>;
 }

package/oidc/src/lib/service/oidc.service.d.ts

@@ -1,4 +1,4 @@
-import type { default as Provider, Configuration } from 'oidc-provider';
+import { type default as Provider, type Configuration } from 'oidc-provider';
 import { OidcModuleConfig } from '../oidc.config';
 import { JwksService } from './oidc.jwks.service';
 import { OidcAccountService } from './oidc.account.service';
@@ -27,6 +27,22 @@ export declare class OidcService {
      * @returns the lazily-initialized oidc-provider instance
      */
     getProvider(): Promise<Provider>;
+    /**
+     * Resolves the login-duration TTL (seconds) for a Grant being created from a fresh consent submission.
+     *
+     * The Grant TTL configured on the oidc-provider only fires when oidc-provider's koa middleware drives
+     * `grant.save()` (so `AsyncLocalStorage` carries the request context). Our consent flow saves grants
+     * from a NestJS controller, so we resolve the TTL up-front and pre-set `grant.expiresIn` before saving.
+     *
+     * Mirrors the resolution used by the `Grant`/`Session` TTL functions in {@link buildProviderConfiguration}.
+     *
+     * @param requestedRawTtl - The raw `dbx_session_ttl` value from `interaction.params`, if any.
+     * @param clientPayload - The persisted client metadata, used to read the per-client `dbx_max_session_ttl` cap.
+     * @returns The resolved Grant TTL in seconds.
+     */
+    resolveLoginDurationForGrant(requestedRawTtl: unknown, clientPayload: {
+        dbx_max_session_ttl?: number;
+    } | undefined): number;
     /**
      * Verifies an opaque access token and returns the {@link OidcAuthData}.
      *
@@ -37,6 +53,20 @@ export declare class OidcService {
      * @returns The auth context, or `undefined` if the token is invalid or expired.
      */
     verifyAccessToken(rawToken: string): Promise<OidcAuthData | undefined>;
+    /**
+     * Revokes a Grant entry and every grantable token entry that references it.
+     *
+     * Iterates through every grantable model (`AccessToken`, `AuthorizationCode`,
+     * `RefreshToken`, `DeviceCode`, `BackchannelAuthenticationRequest`) and calls
+     * the adapter's `revokeByGrantId` to delete all matching entries, then
+     * deletes the Grant adapter entry itself. After this resolves, any token
+     * referencing the grant is gone — `verifyAccessToken` returns `undefined`
+     * and a `grant_type=refresh_token` exchange fails with `invalid_grant`.
+     *
+     * @param grantId - the grant id (and Grant adapter entry id) to revoke
+     * @throws when the Grant entry does not exist
+     */
+    revokeGrant(grantId: string): Promise<void>;
     /**
      * Finds a client payload by ID directly from the adapter store.
      *

package/oidc/src/lib/service/oidc.session-ttl.d.ts

@@ -0,0 +1,85 @@
+import type { KoaContextWithOIDC } from 'oidc-provider';
+/**
+ * Custom OIDC auth-URL parameter clients use to request a non-default login duration.
+ *
+ * Value is integer seconds. Subject to per-client and global server caps via {@link resolveLoginDurationSeconds}.
+ */
+export declare const DBX_FIREBASE_SERVER_OIDC_SESSION_TTL_PARAM = "dbx_session_ttl";
+/**
+ * Custom oidc-provider client metadata field for a client's maximum requestable login duration (seconds).
+ */
+export declare const DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA = "dbx_max_session_ttl";
+/**
+ * Inputs to {@link resolveLoginDurationSeconds}.
+ */
+export interface ResolveLoginDurationInput {
+    /**
+     * Seconds requested by the client via {@link DBX_FIREBASE_SERVER_OIDC_SESSION_TTL_PARAM}, or undefined when not provided.
+     */
+    readonly requestedSeconds: number | undefined;
+    /**
+     * Per-client ceiling from the client's {@link DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA} metadata, or undefined.
+     */
+    readonly clientMaxSeconds: number | undefined;
+    /**
+     * Global server ceiling (seconds).
+     */
+    readonly serverMaxSeconds: number;
+    /**
+     * Global server floor (seconds).
+     */
+    readonly serverMinSeconds: number;
+    /**
+     * Default duration (seconds) used when `requestedSeconds` is undefined.
+     */
+    readonly defaultSeconds: number;
+}
+/**
+ * Clamps a requested login duration into the allowed range.
+ *
+ * Resolution order:
+ * 1. Pick the requested value, falling back to the configured default when omitted.
+ * 2. Compute the effective ceiling as `min(serverMax, clientMax-or-Infinity)`.
+ * 3. Clamp the value to `[serverMin, ceiling]`.
+ *
+ * @param input - The clamp inputs (requested value, client cap, server bounds, default).
+ * @returns The clamped duration in seconds.
+ *
+ * @example
+ * ```typescript
+ * resolveLoginDurationSeconds({
+ *   requestedSeconds: 60 * 24 * 60 * 60, // 60 days
+ *   clientMaxSeconds: 30 * 24 * 60 * 60, // 30 days client cap
+ *   serverMaxSeconds: 90 * 24 * 60 * 60, // 90 days global cap
+ *   serverMinSeconds: 60 * 60,           // 1 hour floor
+ *   defaultSeconds: 30 * 24 * 60 * 60
+ * }); // → 30 * 24 * 60 * 60 (clamped to client max)
+ * ```
+ */
+export declare function resolveLoginDurationSeconds(input: ResolveLoginDurationInput): number;
+/**
+ * Parses a raw `dbx_session_ttl` value (string or number, from URL query / form / persisted interaction params)
+ * into a positive integer number of seconds. Returns `undefined` when missing or invalid so the caller falls
+ * back to a default.
+ *
+ * @param raw - The raw value to parse.
+ * @returns The parsed positive integer seconds, or `undefined` when absent/invalid.
+ */
+export declare function parseRequestedSessionTtlSeconds(raw: unknown): number | undefined;
+/**
+ * Reads {@link DBX_FIREBASE_SERVER_OIDC_SESSION_TTL_PARAM} from a KoaContextWithOIDC and parses it to a positive integer
+ * number of seconds. Returns `undefined` when missing or invalid (so the caller falls back to a default).
+ *
+ * @param ctx - The OIDC Koa context, or undefined.
+ * @returns The parsed positive integer seconds, or `undefined` when absent/invalid.
+ */
+export declare function readRequestedSessionTtlSeconds(ctx: KoaContextWithOIDC | undefined): number | undefined;
+/**
+ * Inspects oidc-provider entities on the context to find the resolved Grant expiry.
+ *
+ * Returns the remaining seconds until the Grant expires, or `undefined` when no Grant is bound to the context.
+ *
+ * @param ctx - The OIDC Koa context, or undefined.
+ * @returns The remaining seconds until grant expiry, or `undefined` when no grant is bound or it has expired.
+ */
+export declare function readRemainingGrantSeconds(ctx: KoaContextWithOIDC | undefined): number | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.11.2",
+  "version": "13.11.4",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -44,15 +44,15 @@
   "main": "./index.cjs.js",
   "types": "./src/index.d.ts",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.2",
-    "@dereekb/date": "13.11.2",
-    "@dereekb/dbx-core": "13.11.2",
-    "@dereekb/firebase": "13.11.2",
-    "@dereekb/model": "13.11.2",
-    "@dereekb/nestjs": "13.11.2",
-    "@dereekb/rxjs": "13.11.2",
-    "@dereekb/util": "13.11.2",
-    "@dereekb/zoho": "13.11.2",
+    "@dereekb/analytics": "13.11.4",
+    "@dereekb/date": "13.11.4",
+    "@dereekb/dbx-core": "13.11.4",
+    "@dereekb/firebase": "13.11.4",
+    "@dereekb/model": "13.11.4",
+    "@dereekb/nestjs": "13.11.4",
+    "@dereekb/rxjs": "13.11.4",
+    "@dereekb/util": "13.11.4",
+    "@dereekb/zoho": "13.11.4",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",

package/src/lib/firestore/array.d.ts

@@ -13,5 +13,6 @@ import { type UpdateData, type FirestoreAccessorArrayUpdate } from '@dereekb/fir
  *   remove: { tags: ['old-tag'] }
  * });
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firestoreServerArrayUpdateToUpdateData<T extends object>(input: FirestoreAccessorArrayUpdate<T>): UpdateData<T>;

package/src/lib/firestore/driver.accessor.batch.d.ts

@@ -41,6 +41,7 @@ export declare class WriteBatchFirestoreDocumentDataAccessor<T> implements Fires
  * await accessor.set({ name: 'Alice' });
  * await batch.commit();
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function writeBatchAccessorFactory<T>(writeBatch: GoogleCloudWriteBatch): FirestoreDocumentDataAccessorFactory<T>;
 /**

package/src/lib/firestore/driver.accessor.default.d.ts

@@ -32,6 +32,7 @@ export declare class DefaultFirestoreDocumentDataAccessor<T> implements Firestor
  * const factory = defaultFirestoreAccessorFactory<User>();
  * const accessor = factory.accessorFor(userDocRef);
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function defaultFirestoreAccessorFactory<T>(): FirestoreDocumentDataAccessorFactory<T>;
 /**

package/src/lib/firestore/driver.accessor.transaction.d.ts

@@ -43,6 +43,7 @@ export declare class TransactionFirestoreDocumentDataAccessor<T> implements Fire
  *   await accessor.update({ name: 'Updated' });
  * });
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function transactionAccessorFactory<T>(transaction: GoogleCloudTransaction): FirestoreDocumentDataAccessorFactory<T>;
 /**

package/src/lib/firestore/driver.query.d.ts

@@ -16,6 +16,7 @@ export declare const FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING: FullFire
  * Translates abstract query constraints into Google Cloud Firestore query builder calls.
  *
  * @returns A {@link FirestoreQueryConstraintFunctionsDriver} for the server SDK.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firestoreClientQueryConstraintFunctionsDriver(): FirestoreQueryConstraintFunctionsDriver;
 /**

package/src/lib/firestore/increment.d.ts

@@ -15,5 +15,6 @@ import { type UpdateData, type FirestoreAccessorIncrementUpdate } from '@dereekb
  *   likeCount: -1
  * });
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firestoreServerIncrementUpdateToUpdateData<T extends object>(input: FirestoreAccessorIncrementUpdate<T>): UpdateData<T>;

package/src/lib/firestore/snapshot/snapshot.field.encrypt.d.ts

@@ -44,6 +44,7 @@ export interface OptionalFirestoreEncryptedFieldConfig<T> {
  * @template T - The JSON-serializable value type.
  * @param config - Encryption field configuration.
  * @returns A field mapping configuration for encrypted values.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firestoreEncryptedField<T>(config: FirestoreEncryptedFieldConfig<T>): FirestoreModelFieldMapFunctionsConfig<T, string>;
 /**
@@ -62,5 +63,6 @@ export declare function firestoreEncryptedField<T>(config: FirestoreEncryptedFie
  * @template T - The JSON-serializable value type.
  * @param config - Encryption field configuration.
  * @returns A field mapping configuration for optional encrypted values.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function optionalFirestoreEncryptedField<T>(config: OptionalFirestoreEncryptedFieldConfig<T>): FirestoreModelFieldMapFunctionsConfig<Maybe<T>, Maybe<string>>;

package/src/lib/nest/app.module.d.ts

@@ -121,5 +121,6 @@ export interface NestServerRootModuleResult {
  *
  * @param config - Shared configuration
  * @returns The root module and resolved prefix config
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function buildNestServerRootModule(config: NestServerRootModuleConfig): NestServerRootModuleResult;

package/src/lib/nest/auth/auth.module.d.ts

@@ -38,6 +38,7 @@ export type ProvideFirebaseServerAuthService<T extends FirebaseServerAuthService
  *   useFactory: (auth) => new MyAuthService(auth)
  * });
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function provideFirebaseServerAuthService<T extends FirebaseServerAuthService>(provider: ProvideFirebaseServerAuthService<T>): [ProvideFirebaseServerAuthService<T>, Provider<T>];
 export interface FirebaseServerAuthModuleMetadataConfig<T extends FirebaseServerAuthService> extends AdditionalModuleMetadata {

package/src/lib/nest/development/development.app.function.d.ts

@@ -78,5 +78,6 @@ export interface FirebaseServerDevFunctions {
  *
  * export const { dev } = devFunctions;
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firebaseServerDevFunctions<N extends AbstractFirebaseNestContext<any, any>, S extends NestApplicationScheduleConfiguredFunctionMap>(config: FirebaseServerDevFunctionsConfig<N, S>): FirebaseServerDevFunctions;

package/src/lib/nest/development/development.function.d.ts

@@ -53,6 +53,7 @@ export interface OnCallDevelopmentConfig<N> {
  *   resetData: resetDataFunction
  * });
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function onCallDevelopmentFunction<N>(map: OnCallDevelopmentFunctionMap<N>, config?: OnCallDevelopmentConfig<N>): OnCallWithNestContext<N, OnCallDevelopmentParams>;
 /**

package/src/lib/nest/development/development.schedule.function.d.ts

@@ -34,5 +34,6 @@ export interface MakeScheduledFunctionDevelopmentFunctionConfig {
  *   [SCHEDULED_FUNCTION_DEV_FUNCTION_SPECIFIER]: scheduleDev
  * };
  * ```
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function makeScheduledFunctionDevelopmentFunction(config: MakeScheduledFunctionDevelopmentFunctionConfig): OnCallDevelopmentFunction<unknown, ScheduledFunctionDevelopmentFirebaseFunctionParams, ScheduledFunctionDevelopmentFirebaseFunctionResult>;

package/src/lib/nest/development/development.schedule.function.error.d.ts

@@ -7,6 +7,7 @@ export declare const NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FU
  * without specifying which scheduled function to execute.
  *
  * @returns A bad-request error indicating the missing run name.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function noRunNameSpecifiedForScheduledFunctionDevelopmentFunction(): import("firebase-functions/https").HttpsError;
 /**

package/src/lib/nest/function/call.d.ts

@@ -98,6 +98,7 @@ export interface OnCallWithAuthAwareNestRequireAuthRef {
  *
  * @param fn
  * @param request
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function assertRequestRequiresAuthForFunction(fn: OnCallWithAuthAwareNestRequireAuthRef, request: OnCallWithNestContextRequest<any, any>): void;
 /**

package/src/lib/nest/function/context.d.ts

@@ -124,5 +124,6 @@ export interface FirebaseServerActionsTransformFactoryOptions {
  *
  * @param options - Optional configuration for error logging behavior.
  * @returns A factory that creates type-safe transform functions from ArkType schemas.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function firebaseServerActionsTransformFactory(options?: FirebaseServerActionsTransformFactoryOptions): TransformAndValidateObjectFactory;

package/src/lib/nest/function/v2/blocking.d.ts

@@ -74,6 +74,7 @@ export interface BlockingFunctionBuilder<E extends object, O> {
  * @param handler - The handler logic to execute on each event.
  * @param opts - Optional {@link BlockingOptions} passed to the builder.
  * @returns A {@link BlockingFunctionWithHandler} with the handler accessible via `__handler`.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function makeBlockingFunctionWithHandler<E extends object, O>(blockingFunctionBuilder: BlockingFunctionBuilder<E, O>, handler: BlockingFunctionHandler<E, O>, opts?: Maybe<BlockingOptions>): BlockingFunctionWithHandler<E, O>;
 /**
@@ -128,5 +129,6 @@ export type BlockingFunctionHandlerWithNestContextFactory<N> = <E extends object
  *
  * @param makeNestContext - Factory that creates the typed context from the NestJS application context.
  * @returns A factory for creating nest-context-aware blocking function handlers.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function blockingFunctionHandlerWithNestContextFactory<N>(makeNestContext: MakeNestContext<N>): BlockingFunctionHandlerWithNestContextFactory<N>;

package/src/lib/nest/function/v2/call.d.ts

@@ -31,6 +31,7 @@ export type OnCallHandlerWithNestApplicationFactory = <I = unknown, O = unknown>
  *
  * @param defaultOpts - Default {@link https.CallableOptions} applied to all functions created by this factory.
  * @returns A factory that creates nest-application-aware callable functions.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function onCallHandlerWithNestApplicationFactory(defaultOpts?: https.CallableOptions): OnCallHandlerWithNestApplicationFactory;
 /**
@@ -57,5 +58,6 @@ export type OnCallHandlerWithNestContextFactory<C> = <I = unknown, O = unknown>(
  * @param appFactory - The base application-level callable factory.
  * @param makeNestContext - Factory that creates the typed context from the application context.
  * @returns A factory that creates typed-context-aware callable functions.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function onCallHandlerWithNestContextFactory<C>(appFactory: OnCallHandlerWithNestApplicationFactory, makeNestContext: MakeNestContext<C>): OnCallHandlerWithNestContextFactory<C>;

package/src/lib/nest/function/v2/event.d.ts

@@ -89,5 +89,6 @@ export type CloudEventHandlerWithNestContextFactory<N> = <E extends CloudEvent<a
  *
  * @param makeNestContext - Factory that creates the typed context from the NestJS application context.
  * @returns A factory for creating nest-context-aware event function handlers.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function cloudEventHandlerWithNestContextFactory<N>(makeNestContext: MakeNestContext<N>): CloudEventHandlerWithNestContextFactory<N>;