@dereekb/firebase-server 13.36.0 → 13.38.0

package/index.cjs.js

@@ -13,8 +13,8 @@ var common = require('@nestjs/common');
 var core = require('@nestjs/core');
 var analytics = require('@dereekb/analytics');
 var nestjs$1 = require('@dereekb/analytics/nestjs');
-var v2 = require('firebase-functions/v2');
 var model = require('@dereekb/model');
+var v2 = require('firebase-functions/v2');
 var admin = require('firebase-admin');
 var storage = require('@google-cloud/storage');
 var dateFns = require('date-fns');
@@ -23,7 +23,7 @@ var rxjs$1 = require('@dereekb/rxjs');
 var platformExpress = require('@nestjs/platform-express');
 var express = require('express');
 
-function _define_property$z(obj, key, value) {
+function _define_property$C(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -36,7 +36,7 @@ function _define_property$z(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$l(target) {
+function _object_spread$m(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -46,12 +46,12 @@ function _object_spread$l(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$z(target, key, source[key]);
+            _define_property$C(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$e(object, enumerableOnly) {
+function ownKeys$g(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -59,12 +59,12 @@ function ownKeys$e(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$e(target, source) {
+function _object_spread_props$g(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$e(Object(source)).forEach(function(key) {
+        ownKeys$g(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -103,7 +103,7 @@ function _type_of$7(obj) {
  */ function unauthenticatedError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('unauthenticated', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'unauthenticated', _object_spread_props$e(_object_spread$l({
+    return new https.HttpsError('unauthenticated', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'unauthenticated', _object_spread_props$g(_object_spread$m({
         status: 401,
         code: firebase.UNAUTHENTICATED_ERROR_CODE
     }, serverError), {
@@ -118,7 +118,7 @@ function _type_of$7(obj) {
  */ function forbiddenError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'forbidden', _object_spread_props$e(_object_spread$l({
+    return new https.HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'forbidden', _object_spread_props$g(_object_spread$m({
         status: 403,
         code: firebase.FORBIDDEN_ERROR_CODE
     }, serverError), {
@@ -133,7 +133,7 @@ function _type_of$7(obj) {
  */ function permissionDeniedError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'permission denied', _object_spread_props$e(_object_spread$l({
+    return new https.HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'permission denied', _object_spread_props$g(_object_spread$m({
         status: 403,
         code: firebase.PERMISSION_DENIED_ERROR_CODE
     }, serverError), {
@@ -148,7 +148,7 @@ function _type_of$7(obj) {
  */ function notFoundError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'not found', _object_spread_props$e(_object_spread$l({
+    return new https.HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'not found', _object_spread_props$g(_object_spread$m({
         status: 404,
         code: firebase.NOT_FOUND_ERROR_CODE
     }, serverError), {
@@ -163,7 +163,7 @@ function _type_of$7(obj) {
  */ function modelNotAvailableError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'model was not available', _object_spread_props$e(_object_spread$l({
+    return new https.HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'model was not available', _object_spread_props$g(_object_spread$m({
         status: 404,
         code: firebase.MODEL_NOT_AVAILABLE_ERROR_CODE
     }, serverError), {
@@ -178,7 +178,7 @@ function _type_of$7(obj) {
  */ function badRequestError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('invalid-argument', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'bad request', _object_spread_props$e(_object_spread$l({
+    return new https.HttpsError('invalid-argument', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'bad request', _object_spread_props$g(_object_spread$m({
         status: 400,
         code: firebase.BAD_REQUEST_ERROR_CODE
     }, serverError), {
@@ -193,7 +193,7 @@ function _type_of$7(obj) {
  */ function preconditionConflictError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('failed-precondition', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'conflict', _object_spread_props$e(_object_spread$l({
+    return new https.HttpsError('failed-precondition', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'conflict', _object_spread_props$g(_object_spread$m({
         status: 409,
         code: firebase.CONFLICT_ERROR_CODE
     }, serverError), {
@@ -208,7 +208,7 @@ function _type_of$7(obj) {
  */ function alreadyExistsError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('already-exists', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'already exists', _object_spread_props$e(_object_spread$l({
+    return new https.HttpsError('already-exists', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'already exists', _object_spread_props$g(_object_spread$m({
         status: 409,
         code: firebase.ALREADY_EXISTS_ERROR_CODE
     }, serverError), {
@@ -223,7 +223,7 @@ function _type_of$7(obj) {
  */ function unavailableError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('unavailable', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'service unavailable', _object_spread_props$e(_object_spread$l({
+    return new https.HttpsError('unavailable', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'service unavailable', _object_spread_props$g(_object_spread$m({
         status: 503,
         code: firebase.UNAVAILABLE_ERROR_CODE
     }, serverError), {
@@ -238,7 +238,7 @@ function _type_of$7(obj) {
  */ function unavailableOrDeactivatedFunctionError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('unimplemented', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'the requested function is not available or has been deactivated for use', _object_spread_props$e(_object_spread$l({
+    return new https.HttpsError('unimplemented', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'the requested function is not available or has been deactivated for use', _object_spread_props$g(_object_spread$m({
         status: 501,
         code: firebase.UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE
     }, serverError), {
@@ -253,7 +253,7 @@ function _type_of$7(obj) {
  */ function internalServerError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('internal', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'internal error', _object_spread_props$e(_object_spread$l({
+    return new https.HttpsError('internal', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'internal error', _object_spread_props$g(_object_spread$m({
         status: 500,
         code: firebase.INTERNAL_SERVER_ERROR_CODE
     }, serverError), {
@@ -489,7 +489,7 @@ function toIsoStringFromUnixSeconds(value) {
     return result;
 }
 
-function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -503,22 +503,22 @@ function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$h(fn) {
+function _async_to_generator$j(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$h(thisArg, body) {
+function _ts_generator$j(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -634,9 +634,9 @@ function _ts_generator$h(thisArg, body) {
  * }
  * ```
  */ function getAuthUserOrUndefined(promise) {
-    return _async_to_generator$h(function() {
+    return _async_to_generator$j(function() {
         var result, error;
-        return _ts_generator$h(this, function(_state) {
+        return _ts_generator$j(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -684,12 +684,12 @@ function _call_super$5(_this, derived, args) {
     derived = _get_prototype_of$5(derived);
     return _possible_constructor_return$5(_this, _is_native_reflect_construct$5() ? Reflect.construct(derived, args || [], _get_prototype_of$5(_this).constructor) : derived.apply(_this, args));
 }
-function _class_call_check$r(instance, Constructor) {
+function _class_call_check$u(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _define_property$y(obj, key, value) {
+function _define_property$B(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -763,11 +763,11 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthUserExistsError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthUserExistsError, BaseError);
     function FirebaseServerAuthUserExistsError(code, identifierType, identifierValue) {
-        _class_call_check$r(this, FirebaseServerAuthUserExistsError);
+        _class_call_check$u(this, FirebaseServerAuthUserExistsError);
         var _this;
         _this = _call_super$5(this, FirebaseServerAuthUserExistsError, [
             "A user with the provided ".concat(identifierType, " already exists.")
-        ]), _define_property$y(_this, "code", void 0), _define_property$y(_this, "identifierType", void 0), _define_property$y(_this, "identifierValue", void 0);
+        ]), _define_property$B(_this, "code", void 0), _define_property$B(_this, "identifierType", void 0), _define_property$B(_this, "identifierValue", void 0);
         _this.code = code;
         _this.identifierType = identifierType;
         _this.identifierValue = identifierValue;
@@ -792,11 +792,11 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthUserBadInputError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthUserBadInputError, BaseError);
     function FirebaseServerAuthUserBadInputError(code, inputValue, message) {
-        _class_call_check$r(this, FirebaseServerAuthUserBadInputError);
+        _class_call_check$u(this, FirebaseServerAuthUserBadInputError);
         var _this;
         _this = _call_super$5(this, FirebaseServerAuthUserBadInputError, [
             message !== null && message !== void 0 ? message : "Invalid input for user creation: ".concat(inputValue)
-        ]), _define_property$y(_this, "code", void 0), _define_property$y(_this, "inputValue", void 0);
+        ]), _define_property$B(_this, "code", void 0), _define_property$B(_this, "inputValue", void 0);
         _this.code = code;
         _this.inputValue = inputValue;
         return _this;
@@ -808,7 +808,7 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, BaseError);
     function FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError() {
-        _class_call_check$r(this, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError);
+        _class_call_check$u(this, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError);
         return _call_super$5(this, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, [
             "This user has no setup configuration available."
         ]);
@@ -820,11 +820,11 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthNewUserSendSetupDetailsThrottleError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthNewUserSendSetupDetailsThrottleError, BaseError);
     function FirebaseServerAuthNewUserSendSetupDetailsThrottleError(lastSentAt) {
-        _class_call_check$r(this, FirebaseServerAuthNewUserSendSetupDetailsThrottleError);
+        _class_call_check$u(this, FirebaseServerAuthNewUserSendSetupDetailsThrottleError);
         var _this;
         _this = _call_super$5(this, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, [
             "This user was recently sent details. Try again later."
-        ]), _define_property$y(_this, "lastSentAt", void 0);
+        ]), _define_property$B(_this, "lastSentAt", void 0);
         _this.lastSentAt = lastSentAt;
         return _this;
     }
@@ -836,7 +836,7 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthNewUserSendSetupDetailsSendOnceError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, BaseError);
     function FirebaseServerAuthNewUserSendSetupDetailsSendOnceError() {
-        _class_call_check$r(this, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError);
+        _class_call_check$u(this, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError);
         return _call_super$5(this, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, [
             "The user has been sent details before and the sendSetupDetailsOnce configuration was true."
         ]);
@@ -850,7 +850,7 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthPasswordResetNoResetConfigError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthPasswordResetNoResetConfigError, BaseError);
     function FirebaseServerAuthPasswordResetNoResetConfigError() {
-        _class_call_check$r(this, FirebaseServerAuthPasswordResetNoResetConfigError);
+        _class_call_check$u(this, FirebaseServerAuthPasswordResetNoResetConfigError);
         return _call_super$5(this, FirebaseServerAuthPasswordResetNoResetConfigError, [
             "This user has no active password reset configuration."
         ]);
@@ -863,11 +863,11 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthPasswordResetThrottleError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthPasswordResetThrottleError, BaseError);
     function FirebaseServerAuthPasswordResetThrottleError(lastSentAt) {
-        _class_call_check$r(this, FirebaseServerAuthPasswordResetThrottleError);
+        _class_call_check$u(this, FirebaseServerAuthPasswordResetThrottleError);
         var _this;
         _this = _call_super$5(this, FirebaseServerAuthPasswordResetThrottleError, [
             "This user was recently sent password reset details. Try again later."
-        ]), _define_property$y(_this, "lastSentAt", void 0);
+        ]), _define_property$B(_this, "lastSentAt", void 0);
         _this.lastSentAt = lastSentAt;
         return _this;
     }
@@ -879,7 +879,7 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthPasswordResetSendOnceError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthPasswordResetSendOnceError, BaseError);
     function FirebaseServerAuthPasswordResetSendOnceError() {
-        _class_call_check$r(this, FirebaseServerAuthPasswordResetSendOnceError);
+        _class_call_check$u(this, FirebaseServerAuthPasswordResetSendOnceError);
         return _call_super$5(this, FirebaseServerAuthPasswordResetSendOnceError, [
             "The user has been sent password reset details before and the sendResetDetailsOnce configuration was true."
         ]);
@@ -892,7 +892,7 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthPasswordResetInvalidCodeError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthPasswordResetInvalidCodeError, BaseError);
     function FirebaseServerAuthPasswordResetInvalidCodeError() {
-        _class_call_check$r(this, FirebaseServerAuthPasswordResetInvalidCodeError);
+        _class_call_check$u(this, FirebaseServerAuthPasswordResetInvalidCodeError);
         return _call_super$5(this, FirebaseServerAuthPasswordResetInvalidCodeError, [
             "The provided reset password code is invalid or expired."
         ]);
@@ -901,16 +901,16 @@ function _is_native_reflect_construct$5() {
 } 
 (makeError.BaseError);
 
-function _array_like_to_array$e(arr, len) {
+function _array_like_to_array$h(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$4(arr) {
+function _array_with_holes$5(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$a(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$e(arr);
+function _array_without_holes$c(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$h(arr);
 }
 function _assert_this_initialized$4(self) {
     if (self === void 0) {
@@ -918,7 +918,7 @@ function _assert_this_initialized$4(self) {
     }
     return self;
 }
-function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -932,16 +932,16 @@ function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$g(fn) {
+function _async_to_generator$i(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -951,12 +951,12 @@ function _call_super$4(_this, derived, args) {
     derived = _get_prototype_of$4(derived);
     return _possible_constructor_return$4(_this, _is_native_reflect_construct$4() ? Reflect.construct(derived, args || [], _get_prototype_of$4(_this).constructor) : derived.apply(_this, args));
 }
-function _class_call_check$q(instance, Constructor) {
+function _class_call_check$t(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$g(target, props) {
+function _defineProperties$i(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -965,11 +965,11 @@ function _defineProperties$g(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$g(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$g(Constructor.prototype, protoProps);
+function _create_class$i(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$i(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$x(obj, key, value) {
+function _define_property$A(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -1001,10 +1001,10 @@ function _inherits$4(subClass, superClass) {
     });
     if (superClass) _set_prototype_of$4(subClass, superClass);
 }
-function _iterable_to_array$a(iter) {
+function _iterable_to_array$c(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$4(arr, i) {
+function _iterable_to_array_limit$5(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -1028,13 +1028,13 @@ function _iterable_to_array_limit$4(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$4() {
+function _non_iterable_rest$5() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$a() {
+function _non_iterable_spread$c() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$k(target) {
+function _object_spread$l(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -1044,7 +1044,7 @@ function _object_spread$k(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$x(target, key, source[key]);
+            _define_property$A(target, key, source[key]);
         });
     }
     return target;
@@ -1062,23 +1062,23 @@ function _set_prototype_of$4(o, p) {
     };
     return _set_prototype_of$4(o, p);
 }
-function _sliced_to_array$4(arr, i) {
-    return _array_with_holes$4(arr) || _iterable_to_array_limit$4(arr, i) || _unsupported_iterable_to_array$e(arr, i) || _non_iterable_rest$4();
+function _sliced_to_array$5(arr, i) {
+    return _array_with_holes$5(arr) || _iterable_to_array_limit$5(arr, i) || _unsupported_iterable_to_array$h(arr, i) || _non_iterable_rest$5();
 }
-function _to_consumable_array$a(arr) {
-    return _array_without_holes$a(arr) || _iterable_to_array$a(arr) || _unsupported_iterable_to_array$e(arr) || _non_iterable_spread$a();
+function _to_consumable_array$c(arr) {
+    return _array_without_holes$c(arr) || _iterable_to_array$c(arr) || _unsupported_iterable_to_array$h(arr) || _non_iterable_spread$c();
 }
 function _type_of$5(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$e(o, minLen) {
+function _unsupported_iterable_to_array$h(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$e(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$h(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$e(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$h(o, minLen);
 }
 function _is_native_reflect_construct$4() {
     try {
@@ -1088,7 +1088,7 @@ function _is_native_reflect_construct$4() {
         return !!result;
     })();
 }
-function _ts_generator$g(thisArg, body) {
+function _ts_generator$i(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1220,16 +1220,16 @@ function _ts_generator$g(thisArg, body) {
  */ var AbstractFirebaseServerAuthUserContext = /*#__PURE__*/ function() {
     function AbstractFirebaseServerAuthUserContext(service, uid) {
         var _this = this;
-        _class_call_check$q(this, AbstractFirebaseServerAuthUserContext);
-        _define_property$x(this, "_service", void 0);
-        _define_property$x(this, "_uid", void 0);
-        _define_property$x(this, "_loadRecord", util.cachedGetter(function() {
+        _class_call_check$t(this, AbstractFirebaseServerAuthUserContext);
+        _define_property$A(this, "_service", void 0);
+        _define_property$A(this, "_uid", void 0);
+        _define_property$A(this, "_loadRecord", util.cachedGetter(function() {
             return _this._service.auth.getUser(_this._uid);
         }));
         this._service = service;
         this._uid = uid;
     }
-    _create_class$g(AbstractFirebaseServerAuthUserContext, [
+    _create_class$i(AbstractFirebaseServerAuthUserContext, [
         {
             key: "service",
             get: function get() {
@@ -1245,8 +1245,8 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "exists",
             value: function exists() {
-                return _async_to_generator$g(function() {
-                    return _ts_generator$g(this, function(_state) {
+                return _async_to_generator$i(function() {
+                    return _ts_generator$i(this, function(_state) {
                         return [
                             2,
                             getAuthUserOrUndefined(this._loadRecord()).then(Boolean)
@@ -1283,9 +1283,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "beginResetPassword",
             value: function beginResetPassword(options) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var _ref, password, now, expiresInMs, expiresAt, _obj, passwordClaimsData;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 password = this._generateResetPasswordKey();
@@ -1293,7 +1293,7 @@ function _ts_generator$g(thisArg, body) {
                                 // An explicit per-call lifetime wins over the context default; otherwise fall back to _resetCodeExpiresInMs().
                                 expiresInMs = (_ref = options === null || options === void 0 ? void 0 : options.resetCodeExpiresIn) !== null && _ref !== void 0 ? _ref : this._resetCodeExpiresInMs();
                                 expiresAt = new Date(now.getTime() + expiresInMs);
-                                passwordClaimsData = (_obj = {}, _define_property$x(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, password), _define_property$x(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, date.toISODateString(now)), _define_property$x(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, date.toISODateString(expiresAt)), _obj);
+                                passwordClaimsData = (_obj = {}, _define_property$A(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, password), _define_property$A(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, date.toISODateString(now)), _define_property$A(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, date.toISODateString(expiresAt)), _obj);
                                 // set the claims
                                 return [
                                     4,
@@ -1324,9 +1324,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadResetPasswordClaims",
             value: function loadResetPasswordClaims() {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var claims, result;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1348,9 +1348,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "setPassword",
             value: function setPassword(password) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var record, _obj;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1364,7 +1364,7 @@ function _ts_generator$g(thisArg, body) {
                                 // clear password reset claims
                                 return [
                                     4,
-                                    this.updateClaims((_obj = {}, _define_property$x(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, null), _define_property$x(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, null), _define_property$x(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, null), _obj))
+                                    this.updateClaims((_obj = {}, _define_property$A(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, null), _define_property$A(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, null), _define_property$A(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, null), _obj))
                                 ];
                             case 2:
                                 _state.sent();
@@ -1380,9 +1380,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "updateUser",
             value: function updateUser(template) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var e, firebaseError, errorCode, email, phoneNumber;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 _state.trys.push([
@@ -1425,9 +1425,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadRoles",
             value: function loadRoles() {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var claims;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1448,9 +1448,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "addRoles",
             value: function addRoles(roles) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var claims;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         claims = this._claimsForRolesChange(roles);
                         return [
                             2,
@@ -1463,14 +1463,14 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "removeRoles",
             value: function removeRoles(roles) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var baseClaims, claims;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         baseClaims = this._claimsForRolesChange(roles);
                         claims = {};
                         util.forEachKeyValue(baseClaims, {
                             forEach: function forEach(param) {
-                                var _param = _sliced_to_array$4(param, 1), key = _param[0];
+                                var _param = _sliced_to_array$5(param, 1), key = _param[0];
                                 claims[key] = null; // set null on every key
                             },
                             filter: util.KeyValueTypleValueFilter.NONE // don't skip any key/value
@@ -1501,10 +1501,10 @@ function _ts_generator$g(thisArg, body) {
      * await userCtx.setRoles([AUTH_ADMIN_ROLE], { customFlag: 1 });
      * ```
      */ function setRoles(roles, claimsToRetain) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var claims;
-                    return _ts_generator$g(this, function(_state) {
-                        claims = _object_spread$k({}, claimsToRetain, this._claimsForRolesChange(_to_consumable_array$a(roles)));
+                    return _ts_generator$i(this, function(_state) {
+                        claims = _object_spread$l({}, claimsToRetain, this._claimsForRolesChange(_to_consumable_array$c(roles)));
                         return [
                             2,
                             this.setClaims(claims)
@@ -1537,9 +1537,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "updateClaims",
             value: function updateClaims(claims) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var currentClaims, newClaims;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1548,7 +1548,7 @@ function _ts_generator$g(thisArg, body) {
                                 ];
                             case 1:
                                 currentClaims = _state.sent();
-                                newClaims = _object_spread$k({}, currentClaims, util.filterUndefinedValues(claims, false));
+                                newClaims = _object_spread$l({}, currentClaims, util.filterUndefinedValues(claims, false));
                                 newClaims = util.filterNullAndUndefinedValues(newClaims);
                                 return [
                                     2,
@@ -1588,25 +1588,25 @@ function _ts_generator$g(thisArg, body) {
  */ var AbstractFirebaseServerAuthContext = /*#__PURE__*/ function() {
     function AbstractFirebaseServerAuthContext(service, context) {
         var _this = this;
-        _class_call_check$q(this, AbstractFirebaseServerAuthContext);
-        _define_property$x(this, "_service", void 0);
-        _define_property$x(this, "_context", void 0);
-        _define_property$x(this, "_authRoles", util.cachedGetter(function() {
+        _class_call_check$t(this, AbstractFirebaseServerAuthContext);
+        _define_property$A(this, "_service", void 0);
+        _define_property$A(this, "_context", void 0);
+        _define_property$A(this, "_authRoles", util.cachedGetter(function() {
             return _this.service.readRoles(_this.claims);
         }));
-        _define_property$x(this, "_isAdmin", util.cachedGetter(function() {
+        _define_property$A(this, "_isAdmin", util.cachedGetter(function() {
             return _this.service.isAdminInRoles(_this._authRoles());
         }));
-        _define_property$x(this, "_hasSignedTos", util.cachedGetter(function() {
+        _define_property$A(this, "_hasSignedTos", util.cachedGetter(function() {
             return _this.service.hasSignedTosInRoles(_this._authRoles());
         }));
-        _define_property$x(this, "_userContext", util.cachedGetter(function() {
+        _define_property$A(this, "_userContext", util.cachedGetter(function() {
             return _this.service.userContext(_this.context.auth.uid);
         }));
         this._service = service;
         this._context = context;
     }
-    _create_class$g(AbstractFirebaseServerAuthContext, [
+    _create_class$i(AbstractFirebaseServerAuthContext, [
         {
             key: "service",
             get: function get() {
@@ -1706,15 +1706,15 @@ function _ts_generator$g(thisArg, body) {
  * ```
  */ var AbstractFirebaseServerNewUserService = /*#__PURE__*/ function() {
     function AbstractFirebaseServerNewUserService(authService) {
-        _class_call_check$q(this, AbstractFirebaseServerNewUserService);
-        _define_property$x(this, "_authService", void 0);
+        _class_call_check$t(this, AbstractFirebaseServerNewUserService);
+        _define_property$A(this, "_authService", void 0);
         /**
      * Minimum time between setup content sends. Defaults to {@link DEFAULT_SETUP_COM_THROTTLE_TIME} (1 hour).
      * Override in subclasses to customize the throttle window.
-     */ _define_property$x(this, "setupThrottleTime", DEFAULT_SETUP_COM_THROTTLE_TIME);
+     */ _define_property$A(this, "setupThrottleTime", DEFAULT_SETUP_COM_THROTTLE_TIME);
         this._authService = authService;
     }
-    _create_class$g(AbstractFirebaseServerNewUserService, [
+    _create_class$i(AbstractFirebaseServerNewUserService, [
         {
             key: "authService",
             get: function get() {
@@ -1724,9 +1724,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "initializeNewUser",
             value: function initializeNewUser(input) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var uid, email, phone, sendSetupContent, sendSetupContentIfUserExists, sendSetupDetailsOnce, sendSetupIgnoreThrottle, sendSetupThrowErrors, data, sendDetailsInTestEnvironment, userRecordPromise, userRecord, userRecordId, createdUser, createResult, userContext, sentEmail, userContext1;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 uid = input.uid, email = input.email, phone = input.phone, sendSetupContent = input.sendSetupContent, sendSetupContentIfUserExists = input.sendSetupContentIfUserExists, sendSetupDetailsOnce = input.sendSetupDetailsOnce, sendSetupIgnoreThrottle = input.sendSetupIgnoreThrottle, sendSetupThrowErrors = input.sendSetupThrowErrors, data = input.data, sendDetailsInTestEnvironment = input.sendDetailsInTestEnvironment;
@@ -1821,16 +1821,16 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "addNewUserSetupClaims",
             value: function addNewUserSetupClaims(userContextOrUid, setupPassword) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var password, userContext;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 password = setupPassword !== null && setupPassword !== void 0 ? setupPassword : this.generateRandomSetupPassword();
                                 userContext = userContextFromUid(this.authService, userContextOrUid);
                                 return [
                                     4,
-                                    userContext.updateClaims(_define_property$x({}, firebase.FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, password))
+                                    userContext.updateClaims(_define_property$A({}, firebase.FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, password))
                                 ];
                             case 1:
                                 _state.sent();
@@ -1846,9 +1846,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "sendSetupContent",
             value: function sendSetupContent(userContextOrUid, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var setupDetails, sentContent, setupCommunicationAt, hasSentCommunication, lastSentAt, sendIsThrottled;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1929,9 +1929,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadSetupDetails",
             value: function loadSetupDetails(userContextOrUid, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var userContext, userExists, details;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 userContext = userContextFromUid(this.authService, userContextOrUid);
@@ -1965,9 +1965,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadSetupDetailsForUserContext",
             value: function loadSetupDetailsForUserContext(userContext, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var details, _ref, setupPassword, setupCommunicationAt;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -2003,9 +2003,9 @@ function _ts_generator$g(thisArg, body) {
      *
      * @param details - The user's setup details containing the user context.
      */ function updateSetupContentSentTime(details) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var setupCommunicationAt;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 setupCommunicationAt = date.toISODateString(new Date());
@@ -2028,9 +2028,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "markUserSetupAsComplete",
             value: function markUserSetupAsComplete(uid) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var userContext, userExists;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 userContext = this.authService.userContext(uid);
@@ -2072,9 +2072,9 @@ function _ts_generator$g(thisArg, body) {
      * @returns The created user record and the setup password used.
      * @throws {Error} Throws if the Firebase Admin SDK rejects the user creation.
      */ function createNewUser(input) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var uid, displayName, email, phoneNumber, inputPassword, password, user, e, firebaseError, errorCode;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 uid = input.uid, displayName = input.displayName, email = input.email, phoneNumber = input.phone, inputPassword = input.setupPassword;
@@ -2141,14 +2141,14 @@ function _ts_generator$g(thisArg, body) {
      *
      * @param userContext - The user context to clear setup claims from.
      */ function updateClaimsToClearUser(userContext) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var _obj;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
                                     4,
-                                    userContext.updateClaims((_obj = {}, _define_property$x(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, null), _define_property$x(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, null), _obj))
+                                    userContext.updateClaims((_obj = {}, _define_property$A(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, null), _define_property$A(_obj, firebase.FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, null), _obj))
                                 ];
                             case 1:
                                 _state.sent();
@@ -2170,15 +2170,15 @@ function _ts_generator$g(thisArg, body) {
  */ var NoSetupContentFirebaseServerNewUserService = /*#__PURE__*/ function(AbstractFirebaseServerNewUserService) {
     _inherits$4(NoSetupContentFirebaseServerNewUserService, AbstractFirebaseServerNewUserService);
     function NoSetupContentFirebaseServerNewUserService() {
-        _class_call_check$q(this, NoSetupContentFirebaseServerNewUserService);
+        _class_call_check$t(this, NoSetupContentFirebaseServerNewUserService);
         return _call_super$4(this, NoSetupContentFirebaseServerNewUserService, arguments);
     }
-    _create_class$g(NoSetupContentFirebaseServerNewUserService, [
+    _create_class$i(NoSetupContentFirebaseServerNewUserService, [
         {
             key: "sendSetupContentToUser",
             value: function sendSetupContentToUser(_details) {
-                return _async_to_generator$g(function() {
-                    return _ts_generator$g(this, function(_state) {
+                return _async_to_generator$i(function() {
+                    return _ts_generator$i(this, function(_state) {
                         return [
                             2
                         ];
@@ -2263,15 +2263,15 @@ function _ts_generator$g(thisArg, body) {
  * ```
  */ var AbstractFirebaseServerUserPasswordResetService = /*#__PURE__*/ function() {
     function AbstractFirebaseServerUserPasswordResetService(authService) {
-        _class_call_check$q(this, AbstractFirebaseServerUserPasswordResetService);
-        _define_property$x(this, "_authService", void 0);
+        _class_call_check$t(this, AbstractFirebaseServerUserPasswordResetService);
+        _define_property$A(this, "_authService", void 0);
         /**
      * Minimum time between reset content sends. Defaults to {@link DEFAULT_RESET_COM_THROTTLE_TIME} (1 hour).
      * Override in subclasses to customize the throttle window.
-     */ _define_property$x(this, "resetThrottleTime", DEFAULT_RESET_COM_THROTTLE_TIME);
+     */ _define_property$A(this, "resetThrottleTime", DEFAULT_RESET_COM_THROTTLE_TIME);
         this._authService = authService;
     }
-    _create_class$g(AbstractFirebaseServerUserPasswordResetService, [
+    _create_class$i(AbstractFirebaseServerUserPasswordResetService, [
         {
             key: "authService",
             get: function get() {
@@ -2281,9 +2281,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "beginPasswordReset",
             value: function beginPasswordReset(input) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var uid, email, sendResetContent, sendResetDetailsOnce, sendResetIgnoreThrottle, sendResetThrowErrors, data, sendDetailsInTestEnvironment, resetCodeExpiresIn, resolvedUid, userRecord, userContext, claims, oobCode;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 uid = input.uid, email = input.email, sendResetContent = input.sendResetContent, sendResetDetailsOnce = input.sendResetDetailsOnce, sendResetIgnoreThrottle = input.sendResetIgnoreThrottle, sendResetThrowErrors = input.sendResetThrowErrors, data = input.data, sendDetailsInTestEnvironment = input.sendDetailsInTestEnvironment, resetCodeExpiresIn = input.resetCodeExpiresIn;
@@ -2361,9 +2361,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "sendResetContent",
             value: function sendResetContent(uid, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var resetDetails, sentContent, resetCommunicationAt, hasSentCommunication, lastSentAt, sendIsThrottled;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -2442,9 +2442,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadResetDetails",
             value: function loadResetDetails(uid, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var userContext, userExists, details;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 userContext = this.authService.userContext(uid);
@@ -2478,9 +2478,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadResetDetailsForUserContext",
             value: function loadResetDetailsForUserContext(userContext, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var details, claims;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -2518,15 +2518,15 @@ function _ts_generator$g(thisArg, body) {
      *
      * @param details - The user's reset details containing the user context.
      */ function updateResetContentSentTime(details) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var resetCommunicationAt;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 resetCommunicationAt = date.toISODateString(new Date());
                                 return [
                                     4,
-                                    details.userContext.updateClaims(_define_property$x({}, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, resetCommunicationAt))
+                                    details.userContext.updateClaims(_define_property$A({}, firebase.FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, resetCommunicationAt))
                                 ];
                             case 1:
                                 _state.sent();
@@ -2541,9 +2541,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "completePasswordReset",
             value: function completePasswordReset(input) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var decoded, userContext, claims, storedCode, expiresAt, storedBuf, inputBuf;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 // Decode the composite token. A malformed token is treated identically to every other
@@ -2612,15 +2612,15 @@ function _ts_generator$g(thisArg, body) {
  */ var NoContentFirebaseServerUserPasswordResetService = /*#__PURE__*/ function(AbstractFirebaseServerUserPasswordResetService) {
     _inherits$4(NoContentFirebaseServerUserPasswordResetService, AbstractFirebaseServerUserPasswordResetService);
     function NoContentFirebaseServerUserPasswordResetService() {
-        _class_call_check$q(this, NoContentFirebaseServerUserPasswordResetService);
+        _class_call_check$t(this, NoContentFirebaseServerUserPasswordResetService);
         return _call_super$4(this, NoContentFirebaseServerUserPasswordResetService, arguments);
     }
-    _create_class$g(NoContentFirebaseServerUserPasswordResetService, [
+    _create_class$i(NoContentFirebaseServerUserPasswordResetService, [
         {
             key: "sendPasswordResetContentToUser",
             value: function sendPasswordResetContentToUser(_details) {
-                return _async_to_generator$g(function() {
-                    return _ts_generator$g(this, function(_state) {
+                return _async_to_generator$i(function() {
+                    return _ts_generator$i(this, function(_state) {
                         return [
                             2
                         ];
@@ -2652,7 +2652,7 @@ function _ts_generator$g(thisArg, body) {
  * }
  * ```
  */ var FirebaseServerAuthService = function FirebaseServerAuthService() {
-    _class_call_check$q(this, FirebaseServerAuthService);
+    _class_call_check$t(this, FirebaseServerAuthService);
 };
 /**
  * Base implementation of {@link FirebaseServerAuthService} providing standard admin/ToS checks,
@@ -2683,11 +2683,11 @@ function _ts_generator$g(thisArg, body) {
  * ```
  */ var AbstractFirebaseServerAuthService = /*#__PURE__*/ function() {
     function AbstractFirebaseServerAuthService(auth) {
-        _class_call_check$q(this, AbstractFirebaseServerAuthService);
-        _define_property$x(this, "_auth", void 0);
+        _class_call_check$t(this, AbstractFirebaseServerAuthService);
+        _define_property$A(this, "_auth", void 0);
         this._auth = auth;
     }
-    _create_class$g(AbstractFirebaseServerAuthService, [
+    _create_class$i(AbstractFirebaseServerAuthService, [
         {
             key: "auth",
             get: function get() {
@@ -2785,7 +2785,7 @@ function _ts_generator$g(thisArg, body) {
 } 
 ();
 
-function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2799,22 +2799,22 @@ function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$f(fn) {
+function _async_to_generator$h(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$f(thisArg, body) {
+function _ts_generator$h(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2942,9 +2942,9 @@ function _ts_generator$f(thisArg, body) {
  * const userData = await assertSnapshotData(userDocument);
  * ```
  */ function assertSnapshotData(document, message) {
-    return _async_to_generator$f(function() {
+    return _async_to_generator$h(function() {
         var data;
-        return _ts_generator$f(this, function(_state) {
+        return _ts_generator$h(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -2976,9 +2976,9 @@ function _ts_generator$f(thisArg, body) {
  * @returns The document's snapshot data with `id` and `key` attached.
  * @throws {HttpsError} Throws a {@link modelNotAvailableError} (404) if the document has no data.
  */ function assertSnapshotDataWithKey(document, message) {
-    return _async_to_generator$f(function() {
+    return _async_to_generator$h(function() {
         var data;
-        return _ts_generator$f(this, function(_state) {
+        return _ts_generator$h(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -3002,9 +3002,9 @@ function _ts_generator$f(thisArg, body) {
  * @param message - Optional custom error message.
  * @throws {HttpsError} Throws a {@link modelNotAvailableError} (404) if the document does not exist.
  */ function assertDocumentExists(document, message) {
-    return _async_to_generator$f(function() {
+    return _async_to_generator$h(function() {
         var exists;
-        return _ts_generator$f(this, function(_state) {
+        return _ts_generator$h(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -3070,7 +3070,7 @@ function _ts_generator$f(thisArg, body) {
     });
 }
 
-function asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3084,22 +3084,22 @@ function asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$e(fn) {
+function _async_to_generator$g(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _instanceof$3(left, right) {
+function _instanceof$4(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -3107,7 +3107,7 @@ function _instanceof$3(left, right) {
         return left instanceof right;
     }
 }
-function _ts_generator$e(thisArg, body) {
+function _ts_generator$g(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3233,9 +3233,9 @@ function _ts_generator$e(thisArg, body) {
  *   enumeration-safe opaque response. Pass the caller's admin status here.
  * @returns The result of the function.
  */ function catchAndThrowPasswordResetServerErrors(fn, isAdmin) {
-    return _async_to_generator$e(function() {
+    return _async_to_generator$g(function() {
         var result, error;
-        return _ts_generator$e(this, function(_state) {
+        return _ts_generator$g(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -3256,13 +3256,13 @@ function _ts_generator$e(thisArg, body) {
                     ];
                 case 2:
                     error = _state.sent();
-                    if (_instanceof$3(error, FirebaseServerAuthPasswordResetInvalidCodeError)) {
+                    if (_instanceof$4(error, FirebaseServerAuthPasswordResetInvalidCodeError)) {
                         throw authServicePasswordResetInvalidCodeError();
-                    } else if (_instanceof$3(error, FirebaseServerAuthPasswordResetNoResetConfigError)) {
+                    } else if (_instanceof$4(error, FirebaseServerAuthPasswordResetNoResetConfigError)) {
                         throw isAdmin ? authServicePasswordResetNoConfigError() : authServicePasswordResetInvalidCodeError();
-                    } else if (_instanceof$3(error, FirebaseServerAuthPasswordResetSendOnceError)) {
+                    } else if (_instanceof$4(error, FirebaseServerAuthPasswordResetSendOnceError)) {
                         throw isAdmin ? authServicePasswordResetSendOnceError() : authServicePasswordResetInvalidCodeError();
-                    } else if (_instanceof$3(error, FirebaseServerAuthPasswordResetThrottleError)) {
+                    } else if (_instanceof$4(error, FirebaseServerAuthPasswordResetThrottleError)) {
                         throw authServicePasswordResetThrottleError();
                     }
                     throw error;
@@ -3369,7 +3369,7 @@ function _ts_generator$e(thisArg, body) {
     ];
 }
 
-function _class_call_check$p(instance, Constructor) {
+function _class_call_check$s(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
@@ -3381,7 +3381,7 @@ function _class_call_check$p(instance, Constructor) {
  * Implementations are typically injected via {@link FIREBASE_SERVER_ENV_TOKEN} and
  * backed by a {@link FirebaseServerEnvironmentConfig}.
  */ var FirebaseServerEnvService = function FirebaseServerEnvService() {
-    _class_call_check$p(this, FirebaseServerEnvService);
+    _class_call_check$s(this, FirebaseServerEnvService);
 } 
 ;
 
@@ -3408,15 +3408,15 @@ function _class_call_check$p(instance, Constructor) {
     });
 }
 
-function _array_like_to_array$d(arr, len) {
+function _array_like_to_array$g(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$9(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$d(arr);
+function _array_without_holes$b(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$g(arr);
 }
-function _define_property$w(obj, key, value) {
+function _define_property$z(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3429,13 +3429,13 @@ function _define_property$w(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$9(iter) {
+function _iterable_to_array$b(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$9() {
+function _non_iterable_spread$b() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$j(target) {
+function _object_spread$k(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3445,21 +3445,21 @@ function _object_spread$j(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$w(target, key, source[key]);
+            _define_property$z(target, key, source[key]);
         });
     }
     return target;
 }
-function _to_consumable_array$9(arr) {
-    return _array_without_holes$9(arr) || _iterable_to_array$9(arr) || _unsupported_iterable_to_array$d(arr) || _non_iterable_spread$9();
+function _to_consumable_array$b(arr) {
+    return _array_without_holes$b(arr) || _iterable_to_array$b(arr) || _unsupported_iterable_to_array$g(arr) || _non_iterable_spread$b();
 }
-function _unsupported_iterable_to_array$d(o, minLen) {
+function _unsupported_iterable_to_array$g(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$d(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$g(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$d(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$g(o, minLen);
 }
 /**
  * Converts a {@link FirestoreAccessorArrayUpdate} into Firestore {@link UpdateData} using
@@ -3485,23 +3485,23 @@ function _unsupported_iterable_to_array$d(o, minLen) {
             result = util.mapObjectMap(fieldUpdate, function(arrayUpdate) {
                 var result;
                 if (arrayUpdate) {
-                    result = arrayUpdateFunction.apply(void 0, _to_consumable_array$9(arrayUpdate)); // use spread operator to insert each value as an argument, as "nested arrays" are not allowed in the Firestore
+                    result = arrayUpdateFunction.apply(void 0, _to_consumable_array$b(arrayUpdate)); // use spread operator to insert each value as an argument, as "nested arrays" are not allowed in the Firestore
                 }
                 return result;
             });
         }
         return result;
     }
-    var updateData = _object_spread$j({}, createUpdatesWithArrayFunction(union, firestore.FieldValue.arrayUnion), createUpdatesWithArrayFunction(remove, firestore.FieldValue.arrayRemove));
+    var updateData = _object_spread$k({}, createUpdatesWithArrayFunction(union, firestore.FieldValue.arrayUnion), createUpdatesWithArrayFunction(remove, firestore.FieldValue.arrayRemove));
     return updateData;
 }
 
-function _class_call_check$o(instance, Constructor) {
+function _class_call_check$r(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$f(target, props) {
+function _defineProperties$h(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3510,11 +3510,11 @@ function _defineProperties$f(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$f(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$f(Constructor.prototype, protoProps);
+function _create_class$h(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$h(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$v(obj, key, value) {
+function _define_property$y(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3536,13 +3536,13 @@ function _define_property$v(obj, key, value) {
  * (get, exists) bypass the batch and read directly from Firestore.
  */ var WriteBatchFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
     function WriteBatchFirestoreDocumentDataAccessor(batch, documentRef) {
-        _class_call_check$o(this, WriteBatchFirestoreDocumentDataAccessor);
-        _define_property$v(this, "documentRef", void 0);
-        _define_property$v(this, "_batch", void 0);
+        _class_call_check$r(this, WriteBatchFirestoreDocumentDataAccessor);
+        _define_property$y(this, "documentRef", void 0);
+        _define_property$y(this, "_batch", void 0);
         this.documentRef = documentRef;
         this._batch = batch;
     }
-    _create_class$f(WriteBatchFirestoreDocumentDataAccessor, [
+    _create_class$h(WriteBatchFirestoreDocumentDataAccessor, [
         {
             key: "batch",
             get: function get() {
@@ -3654,14 +3654,14 @@ function _define_property$v(obj, key, value) {
  * All document accessors created from this context queue writes into the same batch.
  */ var WriteBatchFirestoreDocumentContext = /*#__PURE__*/ function() {
     function WriteBatchFirestoreDocumentContext(batch) {
-        _class_call_check$o(this, WriteBatchFirestoreDocumentContext);
-        _define_property$v(this, "_batch", void 0);
-        _define_property$v(this, "contextType", firebase.FirestoreDocumentContextType.BATCH);
-        _define_property$v(this, "accessorFactory", void 0);
+        _class_call_check$r(this, WriteBatchFirestoreDocumentContext);
+        _define_property$y(this, "_batch", void 0);
+        _define_property$y(this, "contextType", firebase.FirestoreDocumentContextType.BATCH);
+        _define_property$y(this, "accessorFactory", void 0);
         this._batch = batch;
         this.accessorFactory = writeBatchAccessorFactory(batch);
     }
-    _create_class$f(WriteBatchFirestoreDocumentContext, [
+    _create_class$h(WriteBatchFirestoreDocumentContext, [
         {
             key: "batch",
             get: function get() {
@@ -3680,12 +3680,12 @@ function _define_property$v(obj, key, value) {
     return new WriteBatchFirestoreDocumentContext(batch);
 }
 
-function _class_call_check$n(instance, Constructor) {
+function _class_call_check$q(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$e(target, props) {
+function _defineProperties$g(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3694,11 +3694,11 @@ function _defineProperties$e(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$e(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$e(Constructor.prototype, protoProps);
+function _create_class$g(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$g(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$u(obj, key, value) {
+function _define_property$x(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3719,11 +3719,11 @@ function _define_property$u(obj, key, value) {
  * batching or transactional context. Supports real-time streaming via `onSnapshot`.
  */ var DefaultFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
     function DefaultFirestoreDocumentDataAccessor(documentRef) {
-        _class_call_check$n(this, DefaultFirestoreDocumentDataAccessor);
-        _define_property$u(this, "_documentRef", void 0);
+        _class_call_check$q(this, DefaultFirestoreDocumentDataAccessor);
+        _define_property$x(this, "_documentRef", void 0);
         this._documentRef = documentRef;
     }
-    _create_class$e(DefaultFirestoreDocumentDataAccessor, [
+    _create_class$g(DefaultFirestoreDocumentDataAccessor, [
         {
             key: "documentRef",
             get: function get() {
@@ -3831,12 +3831,12 @@ function _define_property$u(obj, key, value) {
     };
 }
 
-function _class_call_check$m(instance, Constructor) {
+function _class_call_check$p(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$d(target, props) {
+function _defineProperties$f(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3845,11 +3845,11 @@ function _defineProperties$d(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$d(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$d(Constructor.prototype, protoProps);
+function _create_class$f(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$f(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$t(obj, key, value) {
+function _define_property$w(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3871,13 +3871,13 @@ function _define_property$t(obj, key, value) {
  * consistency. Writes are committed atomically when the transaction completes.
  */ var TransactionFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
     function TransactionFirestoreDocumentDataAccessor(transaction, documentRef) {
-        _class_call_check$m(this, TransactionFirestoreDocumentDataAccessor);
-        _define_property$t(this, "_transaction", void 0);
-        _define_property$t(this, "_documentRef", void 0);
+        _class_call_check$p(this, TransactionFirestoreDocumentDataAccessor);
+        _define_property$w(this, "_transaction", void 0);
+        _define_property$w(this, "_documentRef", void 0);
         this._transaction = transaction;
         this._documentRef = documentRef;
     }
-    _create_class$d(TransactionFirestoreDocumentDataAccessor, [
+    _create_class$f(TransactionFirestoreDocumentDataAccessor, [
         {
             key: "transaction",
             get: function get() {
@@ -3996,14 +3996,14 @@ function _define_property$t(obj, key, value) {
  * All document accessors created from this context operate within the same transaction.
  */ var TransactionFirestoreDocumentContext = /*#__PURE__*/ function() {
     function TransactionFirestoreDocumentContext(transaction) {
-        _class_call_check$m(this, TransactionFirestoreDocumentContext);
-        _define_property$t(this, "_transaction", void 0);
-        _define_property$t(this, "contextType", firebase.FirestoreDocumentContextType.TRANSACTION);
-        _define_property$t(this, "accessorFactory", void 0);
+        _class_call_check$p(this, TransactionFirestoreDocumentContext);
+        _define_property$w(this, "_transaction", void 0);
+        _define_property$w(this, "contextType", firebase.FirestoreDocumentContextType.TRANSACTION);
+        _define_property$w(this, "accessorFactory", void 0);
         this._transaction = transaction;
         this.accessorFactory = transactionAccessorFactory(transaction);
     }
-    _create_class$d(TransactionFirestoreDocumentContext, [
+    _create_class$f(TransactionFirestoreDocumentContext, [
         {
             key: "transaction",
             get: function get() {
@@ -4022,15 +4022,15 @@ function _define_property$t(obj, key, value) {
     return new TransactionFirestoreDocumentContext(transaction);
 }
 
-function _array_like_to_array$c(arr, len) {
+function _array_like_to_array$f(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$3(arr) {
+function _array_with_holes$4(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4044,22 +4044,22 @@ function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$d(fn) {
+function _async_to_generator$f(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _iterable_to_array_limit$3(arr, i) {
+function _iterable_to_array_limit$4(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -4083,21 +4083,21 @@ function _iterable_to_array_limit$3(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$3() {
+function _non_iterable_rest$4() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$3(arr, i) {
-    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$c(arr, i) || _non_iterable_rest$3();
+function _sliced_to_array$4(arr, i) {
+    return _array_with_holes$4(arr) || _iterable_to_array_limit$4(arr, i) || _unsupported_iterable_to_array$f(arr, i) || _non_iterable_rest$4();
 }
-function _unsupported_iterable_to_array$c(o, minLen) {
+function _unsupported_iterable_to_array$f(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$c(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$f(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$c(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$f(o, minLen);
 }
-function _ts_generator$d(thisArg, body) {
+function _ts_generator$f(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4220,7 +4220,7 @@ function _ts_generator$d(thisArg, body) {
         }
         var batches = util.batch(pathSegments, 2); // batch to tuple [string, string]
         batches.forEach(function(x) {
-            var _x = _sliced_to_array$3(x, 2), first = _x[0], second = _x[1];
+            var _x = _sliced_to_array$4(x, 2), first = _x[0], second = _x[1];
             ref = ref.doc(first).collection(second);
         });
     }
@@ -4247,7 +4247,7 @@ function _ts_generator$d(thisArg, body) {
     if (pathSegments === null || pathSegments === void 0 ? void 0 : pathSegments.length) {
         var batches = util.batch(pathSegments, 2); // batch to tuple [string, string]
         batches.forEach(function(x) {
-            var _x = _sliced_to_array$3(x, 2), first = _x[0], second = _x[1];
+            var _x = _sliced_to_array$4(x, 2), first = _x[0], second = _x[1];
             var collection = doc.collection(first);
             doc = second ? collection.doc(second) : collection.doc();
         });
@@ -4294,8 +4294,8 @@ function _ts_generator$d(thisArg, body) {
         },
         transactionFactoryForFirestore: function transactionFactoryForFirestore(firestore) {
             return function(fn) {
-                return _async_to_generator$d(function() {
-                    return _ts_generator$d(this, function(_state) {
+                return _async_to_generator$f(function() {
+                    return _ts_generator$f(this, function(_state) {
                         return [
                             2,
                             firestore.runTransaction(fn)
@@ -4315,15 +4315,15 @@ function _ts_generator$d(thisArg, body) {
     };
 }
 
-function _array_like_to_array$b(arr, len) {
+function _array_like_to_array$e(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$8(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$b(arr);
+function _array_without_holes$a(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$e(arr);
 }
-function _define_property$s(obj, key, value) {
+function _define_property$v(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4336,13 +4336,13 @@ function _define_property$s(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$8(iter) {
+function _iterable_to_array$a(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$8() {
+function _non_iterable_spread$a() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$i(target) {
+function _object_spread$j(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4352,12 +4352,12 @@ function _object_spread$i(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$s(target, key, source[key]);
+            _define_property$v(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$d(object, enumerableOnly) {
+function ownKeys$f(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -4365,27 +4365,27 @@ function ownKeys$d(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$d(target, source) {
+function _object_spread_props$f(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$d(Object(source)).forEach(function(key) {
+        ownKeys$f(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _to_consumable_array$8(arr) {
-    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$b(arr) || _non_iterable_spread$8();
+function _to_consumable_array$a(arr) {
+    return _array_without_holes$a(arr) || _iterable_to_array$a(arr) || _unsupported_iterable_to_array$e(arr) || _non_iterable_spread$a();
 }
-function _unsupported_iterable_to_array$b(o, minLen) {
+function _unsupported_iterable_to_array$e(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$b(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$e(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$b(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$e(o, minLen);
 }
 var _builder, _builder1;
 var _obj;
@@ -4393,31 +4393,31 @@ var _obj;
  * Maps each abstract query constraint type to its Google Cloud Firestore implementation.
  *
  * Used by {@link firestoreClientQueryConstraintFunctionsDriver} to build the server-side query driver.
- */ var FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING = (_obj = {}, _define_property$s(_obj, firebase.FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+ */ var FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING = (_obj = {}, _define_property$v(_obj, firebase.FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.limit(data.limit);
-}), _define_property$s(_obj, firebase.FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, firebase.FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.limitToLast(data.limit);
-}), _define_property$s(_obj, firebase.FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, firebase.FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.orderBy(data.fieldPath, data.directionStr);
-}), _define_property$s(_obj, firebase.FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, firebase.FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.orderBy(firestore.FieldPath.documentId(), data.directionStr);
-}), _define_property$s(_obj, firebase.FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, firebase.FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.where(data.fieldPath, data.opStr, data.value);
-}), _define_property$s(_obj, firebase.FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, firebase.FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.where(firestore.FieldPath.documentId(), data.opStr, data.value);
-}), _define_property$s(_obj, firebase.FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, firebase.FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.offset(data.offset);
-}), _define_property$s(_obj, firebase.FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, firebase.FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.startAt(data.snapshot);
-}), _define_property$s(_obj, firebase.FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return (_builder = builder).startAt.apply(_builder, _to_consumable_array$8(data.fieldValues));
-}), _define_property$s(_obj, firebase.FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, firebase.FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return (_builder = builder).startAt.apply(_builder, _to_consumable_array$a(data.fieldValues));
+}), _define_property$v(_obj, firebase.FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.startAfter(data.snapshot);
-}), _define_property$s(_obj, firebase.FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, firebase.FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.endAt(data.snapshot);
-}), _define_property$s(_obj, firebase.FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return (_builder1 = builder).endAt.apply(_builder1, _to_consumable_array$8(data.fieldValues));
-}), _define_property$s(_obj, firebase.FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, firebase.FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return (_builder1 = builder).endAt.apply(_builder1, _to_consumable_array$a(data.fieldValues));
+}), _define_property$v(_obj, firebase.FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.endBefore(data.snapshot);
 }), _obj);
 /**
@@ -4455,7 +4455,7 @@ var _obj;
  * const queryDriver = googleCloudFirestoreQueryDriver();
  * ```
  */ function googleCloudFirestoreQueryDriver() {
-    return _object_spread_props$d(_object_spread$i({}, firestoreClientQueryConstraintFunctionsDriver()), {
+    return _object_spread_props$f(_object_spread$j({}, firestoreClientQueryConstraintFunctionsDriver()), {
         countDocs: function countDocs(query) {
             return query.count().get().then(function(x) {
                 return x.data().count;
@@ -4621,7 +4621,7 @@ typeof SuppressedError === "function" ? SuppressedError : function(error, suppre
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 };
 
-function _class_call_check$l(instance, Constructor) {
+function _class_call_check$o(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
@@ -4632,7 +4632,7 @@ function _class_call_check$l(instance, Constructor) {
  * Analogous to {@link DbxAnalyticsService} on the frontend.
  * Apps extend this class and provide it via {@link ON_CALL_MODEL_ANALYTICS_SERVICE}.
  */ var OnCallModelAnalyticsService = function OnCallModelAnalyticsService() {
-    _class_call_check$l(this, OnCallModelAnalyticsService);
+    _class_call_check$o(this, OnCallModelAnalyticsService);
 };
 /**
  * Default injection token for the analytics service.
@@ -4657,7 +4657,7 @@ function _class_call_check$l(instance, Constructor) {
  * @deprecated Use {@link ON_CALL_MODEL_ANALYTICS_SERVICE} instead.
  */ var ON_CALL_MODEL_ANALYTICS_HANDLER = ON_CALL_MODEL_ANALYTICS_SERVICE;
 
-function _class_call_check$k(instance, Constructor) {
+function _class_call_check$n(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
@@ -4667,7 +4667,7 @@ function _class_call_check$k(instance, Constructor) {
  * Events are forwarded from FirebaseServerAnalyticsService to this listener
  * for processing by an analytics provider (e.g., Segment).
  */ var FirebaseServerAnalyticsServiceListener = function FirebaseServerAnalyticsServiceListener() {
-    _class_call_check$k(this, FirebaseServerAnalyticsServiceListener);
+    _class_call_check$n(this, FirebaseServerAnalyticsServiceListener);
 };
 /**
  * Creates a default no-op {@link FirebaseServerAnalyticsServiceListener}.
@@ -4697,12 +4697,12 @@ function _call_super$3(_this, derived, args) {
     derived = _get_prototype_of$3(derived);
     return _possible_constructor_return$3(_this, _is_native_reflect_construct$3() ? Reflect.construct(derived, [], _get_prototype_of$3(_this).constructor) : derived.apply(_this, args));
 }
-function _class_call_check$j(instance, Constructor) {
+function _class_call_check$m(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$c(target, props) {
+function _defineProperties$e(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -4711,11 +4711,11 @@ function _defineProperties$c(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$c(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
+function _create_class$e(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$e(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$r(obj, key, value) {
+function _define_property$u(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4795,9 +4795,9 @@ function _is_native_reflect_construct$3() {
  */ exports.FirebaseServerAnalyticsService = /*#__PURE__*/ function(OnCallModelAnalyticsService) {
     _inherits$3(FirebaseServerAnalyticsService, OnCallModelAnalyticsService);
     function FirebaseServerAnalyticsService(listener) {
-        _class_call_check$j(this, FirebaseServerAnalyticsService);
+        _class_call_check$m(this, FirebaseServerAnalyticsService);
         var _this;
-        _this = _call_super$3(this, FirebaseServerAnalyticsService), _define_property$r(_this, "_listener", void 0);
+        _this = _call_super$3(this, FirebaseServerAnalyticsService), _define_property$u(_this, "_listener", void 0);
         if (listener) {
             _this._listener = listener;
         } else {
@@ -4806,7 +4806,7 @@ function _is_native_reflect_construct$3() {
         }
         return _this;
     }
-    _create_class$c(FirebaseServerAnalyticsService, [
+    _create_class$e(FirebaseServerAnalyticsService, [
         {
             key: "handleOnCallAnalyticsEvent",
             value: function handleOnCallAnalyticsEvent(event) {
@@ -4846,7 +4846,7 @@ exports.FirebaseServerAnalyticsService = __decorate([
     __param(0, common.Inject(FirebaseServerAnalyticsServiceListener))
 ], exports.FirebaseServerAnalyticsService);
 
-function asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4860,22 +4860,22 @@ function asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$c(fn) {
+function _async_to_generator$e(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$c(thisArg, body) {
+function _ts_generator$e(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5039,7 +5039,7 @@ function _ts_generator$c(thisArg, body) {
  * });
  * ```
  */ function callWithAnalytics(config) {
-    return _async_to_generator$c(function() {
+    return _async_to_generator$e(function() {
         var service, details, context, execute, result, emitter, error;
         function _safeCall(fn) {
             try {
@@ -5049,7 +5049,7 @@ function _ts_generator$c(thisArg, body) {
                 console.error("callWithAnalytics: Failed to emit analytics event:", error);
             }
         }
-        return _ts_generator$c(this, function(_state) {
+        return _ts_generator$e(this, function(_state) {
             switch(_state.label){
                 case 0:
                     service = config.service, details = config.details, context = config.context, execute = config.execute;
@@ -5108,15 +5108,15 @@ function _ts_generator$c(thisArg, body) {
     })();
 }
 
-function _array_like_to_array$a(arr, len) {
+function _array_like_to_array$d(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$2(arr) {
+function _array_with_holes$3(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _iterable_to_array_limit$2(arr, i) {
+function _iterable_to_array_limit$3(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -5140,7 +5140,7 @@ function _iterable_to_array_limit$2(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$2() {
+function _non_iterable_rest$3() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _object_without_properties(source, excluded) {
@@ -5179,16 +5179,16 @@ function _object_without_properties_loose(source, excluded) {
     }
     return target;
 }
-function _sliced_to_array$2(arr, i) {
-    return _array_with_holes$2(arr) || _iterable_to_array_limit$2(arr, i) || _unsupported_iterable_to_array$a(arr, i) || _non_iterable_rest$2();
+function _sliced_to_array$3(arr, i) {
+    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$d(arr, i) || _non_iterable_rest$3();
 }
-function _unsupported_iterable_to_array$a(o, minLen) {
+function _unsupported_iterable_to_array$d(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$a(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$d(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$a(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$d(o, minLen);
 }
 // MARK: Type Guards
 /**
@@ -5290,7 +5290,7 @@ function _unsupported_iterable_to_array$a(o, minLen) {
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
         for(var _iterator = Object.entries(config)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array$2(_step.value, 2), key = _step_value[0], handler = _step_value[1];
+            var _step_value = _sliced_to_array$3(_step.value, 2), key = _step_value[0], handler = _step_value[1];
             var details = readApiDetails(handler);
             if (details != null) {
                 // At the specifier level, details should be handler-level (OnCallModelFunctionApiDetails)
@@ -5330,7 +5330,7 @@ function _unsupported_iterable_to_array$a(o, minLen) {
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
         for(var _iterator = Object.entries(map)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array$2(_step.value, 2), key = _step_value[0], handler = _step_value[1];
+            var _step_value = _sliced_to_array$3(_step.value, 2), key = _step_value[0], handler = _step_value[1];
             var details = readApiDetails(handler);
             if (details != null) {
                 if (isOnCallModelTypeApiDetails(details)) {
@@ -5379,7 +5379,7 @@ function _unsupported_iterable_to_array$a(o, minLen) {
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
         for(var _iterator = Object.entries(map)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array$2(_step.value, 2), call = _step_value[0], handler = _step_value[1];
+            var _step_value = _sliced_to_array$3(_step.value, 2), call = _step_value[0], handler = _step_value[1];
             var details = readApiDetails(handler);
             if (details != null) {
                 result[call] = details;
@@ -5427,14 +5427,14 @@ function _unsupported_iterable_to_array$a(o, minLen) {
         try {
             // Pivot: iterate CRUD types, then model types within each
             for(var _iterator = Object.entries(topDetails)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                var _step_value = _sliced_to_array$2(_step.value, 2), callType = _step_value[0], crudDetails = _step_value[1];
+                var _step_value = _sliced_to_array$3(_step.value, 2), callType = _step_value[0], crudDetails = _step_value[1];
                 if (crudDetails == null) {
                     continue;
                 }
                 var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                 try {
                     for(var _iterator1 = Object.entries(crudDetails.modelTypes)[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                        var _step_value1 = _sliced_to_array$2(_step1.value, 2), modelType = _step_value1[0], modelDetails = _step_value1[1];
+                        var _step_value1 = _sliced_to_array$3(_step1.value, 2), modelType = _step_value1[0], modelDetails = _step_value1[1];
                         if (modelDetails == null) {
                             continue;
                         }
@@ -5704,7 +5704,7 @@ function resolveRequiredScopeFromApiDetails(apiDetails, call, modelType, specifi
     }));
 }
 
-function _define_property$q(obj, key, value) {
+function _define_property$t(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -5717,7 +5717,7 @@ function _define_property$q(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$h(target) {
+function _object_spread$i(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -5727,12 +5727,12 @@ function _object_spread$h(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$q(target, key, source[key]);
+            _define_property$t(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$c(object, enumerableOnly) {
+function ownKeys$e(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -5740,12 +5740,12 @@ function ownKeys$c(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$c(target, source) {
+function _object_spread_props$e(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$c(Object(source)).forEach(function(key) {
+        ownKeys$e(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -5824,7 +5824,7 @@ function _object_spread_props$c(target, source) {
         // Resolve the leaf handler's per-function requiredScope (if any) so the preAssert can enforce
         // it additively with the per-verb OIDC scope. Same call -> modelType -> specifier walk as analytics.
         var requiredScope = resolveRequiredScopeFromApiDetails(modelApiDetails, call, modelType, specifier);
-        preAssert(_object_spread_props$c(_object_spread$h({}, context), {
+        preAssert(_object_spread_props$e(_object_spread$i({}, context), {
             requiredScope: requiredScope
         }));
         var result;
@@ -5902,7 +5902,7 @@ function _object_spread_props$c(target, source) {
                 modelType: modelType,
                 specifier: specifier
             });
-            return crudFn(_object_spread_props$c(_object_spread$h({}, request), {
+            return crudFn(_object_spread_props$e(_object_spread$i({}, request), {
                 specifier: specifier,
                 data: request.data.data
             }));
@@ -6089,15 +6089,15 @@ function _object_spread_props$c(target, source) {
     }));
 }
 
-function _array_like_to_array$9(arr, len) {
+function _array_like_to_array$c(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$7(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$9(arr);
+function _array_without_holes$9(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$c(arr);
 }
-function asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -6111,39 +6111,39 @@ function asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$b(fn) {
+function _async_to_generator$d(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _iterable_to_array$7(iter) {
+function _iterable_to_array$9(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$7() {
+function _non_iterable_spread$9() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$7(arr) {
-    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$9(arr) || _non_iterable_spread$7();
+function _to_consumable_array$9(arr) {
+    return _array_without_holes$9(arr) || _iterable_to_array$9(arr) || _unsupported_iterable_to_array$c(arr) || _non_iterable_spread$9();
 }
-function _unsupported_iterable_to_array$9(o, minLen) {
+function _unsupported_iterable_to_array$c(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$9(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$c(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$9(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$c(o, minLen);
 }
-function _ts_generator$b(thisArg, body) {
+function _ts_generator$d(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -6346,9 +6346,9 @@ function _ts_generator$b(thisArg, body) {
  * };
  * ```
  */ function executeOnCallQuery(config) {
-    return _async_to_generator$b(function() {
+    return _async_to_generator$d(function() {
         var _collection, _params_limit, _resultDocs_at, params, collection, loadCursorDocument, buildConstraints, _config_maxLimit, maxLimit, mapResult, requestedLimit, effectiveLimit, constraints, cursorSnapshot, e, errorInfo, executableQuery, querySnapshot, docs, hasMore, resultDocs, results, keys, cursorDocumentKey;
-        return _ts_generator$b(this, function(_state) {
+        return _ts_generator$d(this, function(_state) {
             switch(_state.label){
                 case 0:
                     params = config.params, collection = config.collection, loadCursorDocument = config.loadCursorDocument, buildConstraints = config.buildConstraints, _config_maxLimit = config.maxLimit, maxLimit = _config_maxLimit === void 0 ? firebase.MAX_ON_CALL_QUERY_MODEL_LIMIT : _config_maxLimit, mapResult = config.mapResult;
@@ -6400,7 +6400,7 @@ function _ts_generator$b(thisArg, body) {
                     // Fetch one extra to detect hasMore
                     constraints.push(firebase.limit(effectiveLimit + 1));
                     // Execute via the collection's query factory
-                    executableQuery = (_collection = collection).query.apply(_collection, _to_consumable_array$7(constraints));
+                    executableQuery = (_collection = collection).query.apply(_collection, _to_consumable_array$9(constraints));
                     return [
                         4,
                         executableQuery.getDocs()
@@ -6477,30 +6477,30 @@ function _ts_generator$b(thisArg, body) {
     }));
 }
 
-function _array_like_to_array$8(arr, len) {
+function _array_like_to_array$b(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$6(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$8(arr);
+function _array_without_holes$8(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$b(arr);
 }
-function _iterable_to_array$6(iter) {
+function _iterable_to_array$8(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$6() {
+function _non_iterable_spread$8() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$6(arr) {
-    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$8(arr) || _non_iterable_spread$6();
+function _to_consumable_array$8(arr) {
+    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$b(arr) || _non_iterable_spread$8();
 }
-function _unsupported_iterable_to_array$8(o, minLen) {
+function _unsupported_iterable_to_array$b(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$8(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$b(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$8(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$b(o, minLen);
 }
 /**
  * Generates NestJS {@link ModuleMetadata} for an app's analytics module.
@@ -6525,18 +6525,18 @@ function _unsupported_iterable_to_array$8(o, minLen) {
         dependencyModule
     ] : [];
     return {
-        imports: _to_consumable_array$6(dependencyModuleImport).concat(_to_consumable_array$6(imports !== null && imports !== void 0 ? imports : [])),
+        imports: _to_consumable_array$8(dependencyModuleImport).concat(_to_consumable_array$8(imports !== null && imports !== void 0 ? imports : [])),
         exports: [
             exports.FirebaseServerAnalyticsService,
             ON_CALL_MODEL_ANALYTICS_SERVICE
-        ].concat(_to_consumable_array$6(exports$1 !== null && exports$1 !== void 0 ? exports$1 : [])),
+        ].concat(_to_consumable_array$8(exports$1 !== null && exports$1 !== void 0 ? exports$1 : [])),
         providers: [
             exports.FirebaseServerAnalyticsService,
             {
                 provide: ON_CALL_MODEL_ANALYTICS_SERVICE,
                 useExisting: exports.FirebaseServerAnalyticsService
             }
-        ].concat(_to_consumable_array$6(providers !== null && providers !== void 0 ? providers : []))
+        ].concat(_to_consumable_array$8(providers !== null && providers !== void 0 ? providers : []))
     };
 }
 
@@ -6550,12 +6550,12 @@ function _call_super$2(_this, derived, args) {
     derived = _get_prototype_of$2(derived);
     return _possible_constructor_return$2(_this, _is_native_reflect_construct$2() ? Reflect.construct(derived, [], _get_prototype_of$2(_this).constructor) : derived.apply(_this, args));
 }
-function _class_call_check$i(instance, Constructor) {
+function _class_call_check$l(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$b(target, props) {
+function _defineProperties$d(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -6564,11 +6564,11 @@ function _defineProperties$b(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$b(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
+function _create_class$d(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$d(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$p(obj, key, value) {
+function _define_property$s(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -6600,7 +6600,7 @@ function _inherits$2(subClass, superClass) {
     });
     if (superClass) _set_prototype_of$2(subClass, superClass);
 }
-function _object_spread$g(target) {
+function _object_spread$h(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -6610,12 +6610,12 @@ function _object_spread$g(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$p(target, key, source[key]);
+            _define_property$s(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$b(object, enumerableOnly) {
+function ownKeys$d(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -6623,12 +6623,12 @@ function ownKeys$b(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$b(target, source) {
+function _object_spread_props$d(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$b(Object(source)).forEach(function(key) {
+        ownKeys$d(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -6671,17 +6671,17 @@ function _is_native_reflect_construct$2() {
  */ exports.FirebaseServerAnalyticsSegmentListenerService = /*#__PURE__*/ function(FirebaseServerAnalyticsServiceListener) {
     _inherits$2(FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsServiceListener);
     function FirebaseServerAnalyticsSegmentListenerService(_segmentService) {
-        _class_call_check$i(this, FirebaseServerAnalyticsSegmentListenerService);
+        _class_call_check$l(this, FirebaseServerAnalyticsSegmentListenerService);
         var _this;
-        _this = _call_super$2(this, FirebaseServerAnalyticsSegmentListenerService), _define_property$p(_this, "_segmentService", void 0);
+        _this = _call_super$2(this, FirebaseServerAnalyticsSegmentListenerService), _define_property$s(_this, "_segmentService", void 0);
         _this._segmentService = _segmentService;
         return _this;
     }
-    _create_class$b(FirebaseServerAnalyticsSegmentListenerService, [
+    _create_class$d(FirebaseServerAnalyticsSegmentListenerService, [
         {
             key: "handleOnCallAnalyticsEvent",
             value: function handleOnCallAnalyticsEvent(event) {
-                var properties = _object_spread$g(_object_spread_props$b(_object_spread$g({}, analytics.asAnalyticsEventData(event.properties)), {
+                var properties = _object_spread$h(_object_spread_props$d(_object_spread$h({}, analytics.asAnalyticsEventData(event.properties)), {
                     call: event.call,
                     modelType: event.modelType,
                     lifecycle: event.lifecycle
@@ -6738,7 +6738,7 @@ exports.FirebaseServerAnalyticsSegmentListenerService = __decorate([
     __param(0, common.Inject(nestjs$1.SegmentService))
 ], exports.FirebaseServerAnalyticsSegmentListenerService);
 
-function _class_call_check$h(instance, Constructor) {
+function _class_call_check$k(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
@@ -6748,7 +6748,7 @@ function _class_call_check$h(instance, Constructor) {
  *
  * This module provides the {@link FirebaseServerAnalyticsSegmentListenerService} as the {@link FirebaseServerAnalyticsServiceListener} implementation and exports {@link SegmentServiceModule} for use in the app.
  */ exports.FirebaseServerAnalyticsSegmentModule = function FirebaseServerAnalyticsSegmentModule() {
-    _class_call_check$h(this, FirebaseServerAnalyticsSegmentModule);
+    _class_call_check$k(this, FirebaseServerAnalyticsSegmentModule);
 };
 exports.FirebaseServerAnalyticsSegmentModule = __decorate([
     common.Module({
@@ -6793,12 +6793,12 @@ exports.FirebaseServerAnalyticsSegmentModule = __decorate([
     };
 }
 
-function _class_call_check$g(instance, Constructor) {
+function _class_call_check$j(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _define_property$o(obj, key, value) {
+function _define_property$r(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -6811,7 +6811,7 @@ function _define_property$o(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$f(target) {
+function _object_spread$g(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -6821,12 +6821,12 @@ function _object_spread$f(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$o(target, key, source[key]);
+            _define_property$r(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$a(object, enumerableOnly) {
+function ownKeys$c(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -6834,12 +6834,12 @@ function ownKeys$a(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$a(target, source) {
+function _object_spread_props$c(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$a(Object(source)).forEach(function(key) {
+        ownKeys$c(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -6852,7 +6852,7 @@ function _object_spread_props$a(target, source) {
 /**
  * Nest provider module for Firebase that provides a firestore, etc. from the firestore token.
  */ exports.FirebaseServerAuthModule = function FirebaseServerAuthModule() {
-    _class_call_check$g(this, FirebaseServerAuthModule);
+    _class_call_check$j(this, FirebaseServerAuthModule);
 };
 exports.FirebaseServerAuthModule = __decorate([
     common.Module({
@@ -6892,7 +6892,7 @@ exports.FirebaseServerAuthModule = __decorate([
  */ function provideFirebaseServerAuthService(provider) {
     var _provider_inject;
     return [
-        _object_spread_props$a(_object_spread$f({}, provider), {
+        _object_spread_props$c(_object_spread$g({}, provider), {
             inject: (_provider_inject = provider.inject) !== null && _provider_inject !== void 0 ? _provider_inject : [
                 FIREBASE_AUTH_TOKEN
             ]
@@ -7081,27 +7081,86 @@ exports.FirebaseServerAuthModule = __decorate([
     return claims[firebase.FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY] != null;
 }
 
-// MARK: Scope Reading
 /**
- * Reads the set of OIDC scopes carried by a model-api request's auth, or `undefined` for a non-OIDC
+ * Error code thrown by {@link assertEndpointOidcScope} when an OIDC caller is missing the scope a
+ * non-model endpoint requires.
+ *
+ * Distinct from the callModel-layer code so a client can tell "you cannot call this endpoint" apart
+ * from "you cannot make this model call".
+ */ var MISSING_ENDPOINT_OIDC_SCOPE_ERROR_CODE = 'MISSING_ENDPOINT_OIDC_SCOPE_ERROR';
+/**
+ * Reads the set of OIDC scopes carried by an authenticated request, or `undefined` for a non-OIDC
  * (regular Firebase ID-token) caller.
  *
  * The OIDC bearer-token middleware attaches the validated access-token claims at
  * `auth.oidcValidatedToken` (with the space-delimited `scope` string); a non-OIDC caller has neither
- * that field nor a `scope` on `auth.token`. Reading is defensive (the auth shape is only typed as
- * {@link FirebaseServerAuthData} here — the OIDC-specific `oidcValidatedToken` lives in the
- * `@dereekb/firebase-server/oidc` sub-package this core layer cannot import), delegating the actual
- * parse to the shared {@link oidcScopesFromScopeClaim} so there is no drift with `getOidcScopesFromRequest`.
+ * that field nor a `scope` on `auth.token`. Reading is defensive — the auth shape is only typed as
+ * {@link FirebaseServerAuthData} here, since the OIDC-specific `oidcValidatedToken` lives in the
+ * `@dereekb/firebase-server/oidc` sub-package this core layer cannot import — and the actual parse is
+ * delegated to the shared {@link oidcScopesFromScopeClaim} so there is no drift with
+ * `getOidcScopesFromRequest`.
  *
  * @param auth - The request auth data, or undefined for unauthenticated requests.
  * @returns The granted scope set, or `undefined` when the request carries no OIDC `scope` claim.
- */ function oidcScopesFromModelApiAuth(auth) {
+ */ function oidcScopesFromRequestAuth(auth) {
     var _auth_oidcValidatedToken, _auth_token;
     var oidcScope = auth === null || auth === void 0 ? void 0 : (_auth_oidcValidatedToken = auth.oidcValidatedToken) === null || _auth_oidcValidatedToken === void 0 ? void 0 : _auth_oidcValidatedToken.scope;
     var tokenScope = auth === null || auth === void 0 ? void 0 : (_auth_token = auth.token) === null || _auth_token === void 0 ? void 0 : _auth_token.scope;
     var scope = oidcScope !== null && oidcScope !== void 0 ? oidcScope : tokenScope;
     return firebase.oidcScopesFromScopeClaim(scope);
 }
+/**
+ * Enforces a single OIDC scope requirement for a plain (non-callModel) endpoint, throwing a `403`
+ * when an OIDC caller does not hold it.
+ *
+ * The non-model counterpart to `assertModelApiOidcScope`, which is unusable outside the model API
+ * because it requires a `{ call, modelType }` pair. Evaluation reuses the same shipped
+ * {@link oidcScopeTermSatisfied} primitive so a term means the same thing on both surfaces.
+ *
+ * Bypasses (no-op) when `grantedScopes` is `undefined` — i.e. a non-OIDC caller carrying a plain
+ * Firebase ID token, which has no `scope` claim to enforce against. **This is why scope-gating alone
+ * is never a sufficient gate**: an endpoint that must reject non-admins needs its own admin check,
+ * with the scope acting as defence in depth.
+ *
+ * @param input - The required term, the caller's granted scopes, and the endpoint name for the message.
+ * @throws A `403` forbidden error (code {@link MISSING_ENDPOINT_OIDC_SCOPE_ERROR_CODE}) when an OIDC
+ *   caller does not satisfy the requirement.
+ */ function assertEndpointOidcScope(input) {
+    var requiredScope = input.requiredScope, grantedScopes = input.grantedScopes, endpoint = input.endpoint;
+    if (requiredScope != null && grantedScopes != null && !firebase.oidcScopeTermSatisfied(requiredScope, grantedScopes)) {
+        var required = Array.isArray(requiredScope) ? requiredScope : [
+            requiredScope
+        ];
+        throw forbiddenError({
+            status: 403,
+            code: MISSING_ENDPOINT_OIDC_SCOPE_ERROR_CODE,
+            message: "Missing required OIDC scope for ".concat(endpoint, ": ").concat(required.join(' | ')),
+            data: {
+                requiredScopes: required,
+                endpoint: endpoint
+            }
+        });
+    }
+}
+
+// MARK: Scope Reading
+/**
+ * Reads the set of OIDC scopes carried by a model-api request's auth, or `undefined` for a non-OIDC
+ * (regular Firebase ID-token) caller.
+ *
+ * The OIDC bearer-token middleware attaches the validated access-token claims at
+ * `auth.oidcValidatedToken` (with the space-delimited `scope` string); a non-OIDC caller has neither
+ * that field nor a `scope` on `auth.token`. Reading is defensive (the auth shape is only typed as
+ * {@link FirebaseServerAuthData} here — the OIDC-specific `oidcValidatedToken` lives in the
+ * `@dereekb/firebase-server/oidc` sub-package this core layer cannot import), delegating entirely to the
+ * shared {@link oidcScopesFromRequestAuth} so there is no drift with `getOidcScopesFromRequest` or with
+ * the non-model endpoints that read scopes the same way.
+ *
+ * @param auth - The request auth data, or undefined for unauthenticated requests.
+ * @returns The granted scope set, or `undefined` when the request carries no OIDC `scope` claim.
+ */ function oidcScopesFromModelApiAuth(auth) {
+    return oidcScopesFromRequestAuth(auth);
+}
 /**
  * Enforces the OIDC scope requirement for a single model-api op, throwing a `403`
  * {@link CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE} error when the caller does not satisfy it.
@@ -7153,7 +7212,7 @@ exports.FirebaseServerAuthModule = __decorate([
     return typeof term === 'string' ? term : term.join('|');
 }
 
-function _define_property$n(obj, key, value) {
+function _define_property$q(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -7166,7 +7225,7 @@ function _define_property$n(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$e(target) {
+function _object_spread$f(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -7176,12 +7235,12 @@ function _object_spread$e(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$n(target, key, source[key]);
+            _define_property$q(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$9(object, enumerableOnly) {
+function ownKeys$b(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -7189,12 +7248,12 @@ function ownKeys$9(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$9(target, source) {
+function _object_spread_props$b(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$9(Object(source)).forEach(function(key) {
+        ownKeys$b(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -7211,7 +7270,7 @@ function _object_spread_props$9(target, source) {
  * @param request - The base request to augment (must include the nestApplication reference).
  * @returns A new object combining the request properties with the nest context.
  */ function injectNestIntoRequest(nest, request) {
-    return _object_spread_props$9(_object_spread$e({}, request), {
+    return _object_spread_props$b(_object_spread$f({}, request), {
         nest: nest
     });
 }
@@ -7225,12 +7284,12 @@ function _object_spread_props$9(target, source) {
  * @param request - The base request to augment.
  * @returns A new object combining the request properties with the application context.
  */ function injectNestApplicationContextIntoRequest(nestContext, request) {
-    return _object_spread_props$9(_object_spread$e({}, request), {
+    return _object_spread_props$b(_object_spread$f({}, request), {
         nestApplication: nestContext
     });
 }
 
-function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7244,27 +7303,27 @@ function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$a(fn) {
+function _async_to_generator$c(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$f(instance, Constructor) {
+function _class_call_check$i(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$a(target, props) {
+function _defineProperties$c(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -7273,11 +7332,11 @@ function _defineProperties$a(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$a(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
+function _create_class$c(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$m(obj, key, value) {
+function _define_property$p(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -7290,7 +7349,7 @@ function _define_property$m(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$d(target) {
+function _object_spread$e(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -7300,12 +7359,12 @@ function _object_spread$d(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$m(target, key, source[key]);
+            _define_property$p(target, key, source[key]);
         });
     }
     return target;
 }
-function _ts_generator$a(thisArg, body) {
+function _ts_generator$c(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7422,22 +7481,22 @@ function _ts_generator$a(thisArg, body) {
  * }
  * ```
  */ var ModelApiDispatchConfig = function ModelApiDispatchConfig() {
-    _class_call_check$f(this, ModelApiDispatchConfig);
+    _class_call_check$i(this, ModelApiDispatchConfig);
     /**
      * The onCallModel() return value with _apiDetails attached.
-     */ _define_property$m(this, "callModelFn", void 0);
+     */ _define_property$p(this, "callModelFn", void 0);
     /**
      * Factory to create typed nest context from INestApplicationContext.
-     */ _define_property$m(this, "makeNestContext", void 0);
+     */ _define_property$p(this, "makeNestContext", void 0);
     /**
      * Optional model-api-layer OIDC group-scope default. See {@link ModelApiOidcScopeConfig.defaultRequiredScope}.
      * This is the home for the callModel group-scope default; providing it here enforces it across
      * dispatch AND the `/get` reads.
-     */ _define_property$m(this, "defaultRequiredScope", void 0);
+     */ _define_property$p(this, "defaultRequiredScope", void 0);
     /**
      * Optional per-model OIDC group-scope overrides. See {@link ModelApiOidcScopeConfig.modelRequiredScopes}.
      * The only place a plain `/get` read (no per-function handler) can be scope-gated beyond `model.read`.
-     */ _define_property$m(this, "modelRequiredScopes", void 0);
+     */ _define_property$p(this, "modelRequiredScopes", void 0);
 };
 /**
  * Injection token for providing the NestJS application context to the dispatch service.
@@ -7454,13 +7513,13 @@ function _ts_generator$a(thisArg, body) {
  * the callModel function.
  */ exports.ModelApiCallModelDispatchService = /*#__PURE__*/ function() {
     function ModelApiCallModelDispatchService(config, nestApplication) {
-        _class_call_check$f(this, ModelApiCallModelDispatchService);
-        _define_property$m(this, "config", void 0);
-        _define_property$m(this, "nestApplication", void 0);
+        _class_call_check$i(this, ModelApiCallModelDispatchService);
+        _define_property$p(this, "config", void 0);
+        _define_property$p(this, "nestApplication", void 0);
         this.config = config;
         this.nestApplication = nestApplication;
     }
-    _create_class$a(ModelApiCallModelDispatchService, [
+    _create_class$c(ModelApiCallModelDispatchService, [
         {
             key: "dispatch",
             value: /**
@@ -7471,9 +7530,9 @@ function _ts_generator$a(thisArg, body) {
      * @param rawRequest - The raw Express request.
      * @returns The handler's return value.
      */ function dispatch(params, auth, rawRequest) {
-                return _async_to_generator$a(function() {
+                return _async_to_generator$c(function() {
                     var call, modelType, specifier, apiDetails, requiredScope, callableRequest, appRequest, contextRequest;
-                    return _ts_generator$a(this, function(_state) {
+                    return _ts_generator$c(this, function(_state) {
                         // Enforce OIDC scope BEFORE dispatching — the relocated home of the callModel scope check.
                         // AND-of-ORs across the per-verb `model.<call>` scope and the effective group term (per-function
                         // `requiredScope` > per-model requirement > module default), bypassing non-OIDC callers. A nullish
@@ -7499,7 +7558,7 @@ function _ts_generator$a(thisArg, body) {
                             data: params,
                             auth: auth ? {
                                 uid: auth.uid,
-                                token: _object_spread$d({}, auth.token, auth.oidcValidatedToken)
+                                token: _object_spread$e({}, auth.token, auth.oidcValidatedToken)
                             } : undefined,
                             rawRequest: rawRequest,
                             acceptsStreaming: false
@@ -7535,7 +7594,15 @@ exports.ModelApiCallModelDispatchService = __decorate([
     __param(1, common.Inject(MODEL_API_NEST_APPLICATION_CONTEXT))
 ], exports.ModelApiCallModelDispatchService);
 
-function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
+function _array_like_to_array$a(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes$2(arr) {
+    if (Array.isArray(arr)) return arr;
+}
+function asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7549,27 +7616,27 @@ function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$9(fn) {
+function _async_to_generator$b(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$e(instance, Constructor) {
+function _class_call_check$h(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$9(target, props) {
+function _defineProperties$b(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -7578,11 +7645,11 @@ function _defineProperties$9(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$9(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
+function _create_class$b(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$l(obj, key, value) {
+function _define_property$o(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -7595,7 +7662,7 @@ function _define_property$l(obj, key, value) {
     }
     return obj;
 }
-function _instanceof$2(left, right) {
+function _instanceof$3(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -7603,7 +7670,34 @@ function _instanceof$2(left, right) {
         return left instanceof right;
     }
 }
-function _object_spread$c(target) {
+function _iterable_to_array_limit$2(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest$2() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread$d(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -7613,12 +7707,42 @@ function _object_spread$c(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$l(target, key, source[key]);
+            _define_property$o(target, key, source[key]);
         });
     }
     return target;
 }
-function _ts_generator$9(thisArg, body) {
+function ownKeys$a(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$a(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$a(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _sliced_to_array$2(arr, i) {
+    return _array_with_holes$2(arr) || _iterable_to_array_limit$2(arr, i) || _unsupported_iterable_to_array$a(arr, i) || _non_iterable_rest$2();
+}
+function _unsupported_iterable_to_array$a(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$a(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$a(o, minLen);
+}
+function _ts_generator$b(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7721,6 +7845,49 @@ function _ts_generator$9(thisArg, body) {
 /**
  * Maximum number of keys allowed in a multi-read request.
  */ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
+/**
+ * Error code returned when a read targets a model the app declared SERVER-ONLY.
+ *
+ * Deliberately distinct from a permission error: nothing the caller can be granted will make this
+ * read succeed, so the message needs to say WHY rather than implying a missing role.
+ */ var MODEL_IS_SERVER_ONLY_ERROR_CODE = 'MODEL_IS_SERVER_ONLY';
+/**
+ * Role-map keys that are structural markers rather than granted role names, so they are never
+ * reported as roles.
+ *
+ * {@link FULL_ACCESS_ROLE_KEY} is surfaced through `fullAccess` instead. {@link NO_ACCESS_ROLE_KEY}
+ * is what `noAccessRoleMap()` sets and means "no roles at all" — both a missing document and an
+ * explicit no-access grant carry it, so leaking it would report `__EMPTY__` as a granted role and
+ * make the no-access case indistinguishable from a real one-role grant.
+ */ var MODEL_ACCESS_ROLE_MAP_MARKER_KEYS = new Set([
+    model.FULL_ACCESS_ROLE_KEY,
+    model.NO_ACCESS_ROLE_KEY
+]);
+/**
+ * Maps a resolved `ContextGrantedModelRoles` into the flat {@link ModelAccessRoleMapResult} wire
+ * shape — collapsing the full-access marker into a boolean, dropping the structural marker keys, and
+ * sorting the enumerated role keys so output is stable across calls.
+ *
+ * @param input - The key and its resolved granted-roles result.
+ * @returns The flattened per-key permission state.
+ */ function modelAccessRoleMapResultFromGrantedRoles(input) {
+    var _granted_data;
+    var key = input.key, granted = input.granted;
+    var fullAccess = model.isFullAccessRoleMap(granted.roleMap);
+    var roles = fullAccess ? [] : Object.entries(granted.roleMap).filter(function(param) {
+        var _param = _sliced_to_array$2(param, 2), roleKey = _param[0], value = _param[1];
+        return value === true && !MODEL_ACCESS_ROLE_MAP_MARKER_KEYS.has(roleKey);
+    }).map(function(param) {
+        var _param = _sliced_to_array$2(param, 1), roleKey = _param[0];
+        return roleKey;
+    }).sort();
+    return {
+        key: key,
+        exists: ((_granted_data = granted.data) === null || _granted_data === void 0 ? void 0 : _granted_data.exists) === true,
+        fullAccess: fullAccess,
+        roles: roles
+    };
+}
 /**
  * Maps a single `useMultipleModels` failure entry into the public {@link ModelAccessReadError}
  * shape. Unwraps the typical Firebase error shapes via {@link firebaseServerErrorInfo} so
@@ -7740,7 +7907,7 @@ function _ts_generator$9(thisArg, body) {
     var info = firebaseServerErrorInfo(entry.error);
     var serverMessage = (_info_httpsErrorDetailsServerError = info.httpsErrorDetailsServerError) === null || _info_httpsErrorDetailsServerError === void 0 ? void 0 : _info_httpsErrorDetailsServerError.message;
     var httpsMessage = (_info_httpsError = info.httpsError) === null || _info_httpsError === void 0 ? void 0 : _info_httpsError.message;
-    var plainMessage = _instanceof$2(entry.error, Error) ? entry.error.message : undefined;
+    var plainMessage = _instanceof$3(entry.error, Error) ? entry.error.message : undefined;
     var code = (_info_serverErrorCode = info.serverErrorCode) !== null && _info_serverErrorCode !== void 0 ? _info_serverErrorCode : info.firebaseErrorCode;
     return {
         key: entry.key,
@@ -7780,16 +7947,16 @@ function _ts_generator$9(thisArg, body) {
  * enforcing `'read'` role permissions per document.
  */ exports.ModelApiGetService = /*#__PURE__*/ function() {
     function ModelApiGetService(config, nestApplication) {
-        _class_call_check$e(this, ModelApiGetService);
-        _define_property$l(this, "_nestContext", void 0);
-        _define_property$l(this, "_defaultRequiredScope", void 0);
-        _define_property$l(this, "_modelRequiredScopes", void 0);
-        _define_property$l(this, "_identityByModelType", void 0);
+        _class_call_check$h(this, ModelApiGetService);
+        _define_property$o(this, "_nestContext", void 0);
+        _define_property$o(this, "_defaultRequiredScope", void 0);
+        _define_property$o(this, "_modelRequiredScopes", void 0);
+        _define_property$o(this, "_identityByModelType", void 0);
         this._nestContext = config.makeNestContext(nestApplication);
         this._defaultRequiredScope = config.defaultRequiredScope;
         this._modelRequiredScopes = config.modelRequiredScopes;
     }
-    _create_class$9(ModelApiGetService, [
+    _create_class$b(ModelApiGetService, [
         {
             /**
      * Enforces the OIDC read-scope requirement for a direct document read before it hits Firestore.
@@ -7814,6 +7981,57 @@ function _ts_generator$9(thisArg, body) {
         },
         {
             /**
+     * Refuses a read of a model the app declared SERVER-ONLY, BEFORE `useModel` runs.
+     *
+     * The model API authorizes through `roleMapForModel` under the Admin SDK, which bypasses
+     * `firestore.rules` entirely. For a model the rules file deliberately leaves unmatched (or denies
+     * outright), those two systems disagree and the model API is the one handing out the document.
+     * Gating here — ahead of the role map, and on the ONE service both `/model/<type>/get` and the
+     * `model-get` MCP tool share — is what makes the two read paths agree.
+     *
+     * @param modelType - The Firestore model type being read.
+     * @param auth - The request's auth data; used to build the context the service lookup needs.
+     * @throws {HttpsError} `MODEL_IS_SERVER_ONLY` when the model opted in via `serverOnly`.
+     */ key: "_assertNotServerOnly",
+            value: function _assertNotServerOnly(modelType, auth) {
+                if (this._isServerOnlyModel(modelType, auth)) {
+                    throw forbiddenError({
+                        status: 403,
+                        code: MODEL_IS_SERVER_ONLY_ERROR_CODE,
+                        message: 'Model "'.concat(modelType, '" is server-only and cannot be read through the model API. It has no client read grant in firestore.rules either — reach it through a callable that owns its access policy.'),
+                        data: {
+                            modelType: modelType
+                        }
+                    });
+                }
+            }
+        },
+        {
+            /**
+     * Reads the `serverOnly` flag off the registered model service, tolerating a type whose service
+     * cannot be constructed (which `readDocument` then reports as an unknown model).
+     *
+     * @param modelType - The Firestore model type to inspect.
+     * @param auth - The request's auth data.
+     * @returns `true` when the model declared itself server-only.
+     */ key: "_isServerOnlyModel",
+            value: function _isServerOnlyModel(modelType, auth) {
+                var authRef = this._makeAuthRef(auth);
+                var result = false;
+                try {
+                    var inContextService = this._nestContext.model(authRef);
+                    var modelService = inContextService(modelType);
+                    result = (modelService === null || modelService === void 0 ? void 0 : modelService.serverOnly) === true;
+                } catch (unused) {
+                    // an unregistered / unconstructable type is not our error to raise here — the subsequent
+                    // useModel call reports it as an unknown model
+                    result = false;
+                }
+                return result;
+            }
+        },
+        {
+            /**
      * Returns the registered {@link FirestoreModelIdentity} for the given `modelType` string, or
      * `undefined` when no model of that type is registered.
      *
@@ -7880,12 +8098,13 @@ function _ts_generator$9(thisArg, body) {
      * @returns The document key and data.
      * @throws {Error} Permission or not-found errors from useModel.
      */ function readDocument(modelType, key, auth) {
-                return _async_to_generator$9(function() {
+                return _async_to_generator$b(function() {
                     var authRef, doc, snapshot;
-                    return _ts_generator$9(this, function(_state) {
+                    return _ts_generator$b(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 this._assertReadScope(modelType, auth);
+                                this._assertNotServerOnly(modelType, auth);
                                 authRef = this._makeAuthRef(auth);
                                 return [
                                     4,
@@ -7931,10 +8150,11 @@ function _ts_generator$9(thisArg, body) {
      * @param auth - The authenticated user's auth data from the request.
      * @returns Results and errors for each requested key.
      */ function readDocuments(modelType, keys, auth) {
-                return _async_to_generator$9(function() {
+                return _async_to_generator$b(function() {
                     var authRef;
-                    return _ts_generator$9(this, function(_state) {
+                    return _ts_generator$b(this, function(_state) {
                         this._assertReadScope(modelType, auth);
+                        this._assertNotServerOnly(modelType, auth);
                         authRef = this._makeAuthRef(auth);
                         return [
                             2,
@@ -7944,17 +8164,17 @@ function _ts_generator$9(thisArg, body) {
                                 roles: 'read',
                                 throwOnFirstError: false,
                                 use: function use(successful, failure) {
-                                    return _async_to_generator$9(function() {
+                                    return _async_to_generator$b(function() {
                                         var results, errors;
-                                        return _ts_generator$9(this, function(_state) {
+                                        return _ts_generator$b(this, function(_state) {
                                             switch(_state.label){
                                                 case 0:
                                                     return [
                                                         4,
                                                         Promise.all(successful.map(function(reader) {
-                                                            return _async_to_generator$9(function() {
+                                                            return _async_to_generator$b(function() {
                                                                 var snapshot;
-                                                                return _ts_generator$9(this, function(_state) {
+                                                                return _ts_generator$b(this, function(_state) {
                                                                     switch(_state.label){
                                                                         case 0:
                                                                             return [
@@ -7996,27 +8216,207 @@ function _ts_generator$9(thisArg, body) {
             }
         },
         {
-            /**
-     * Builds an {@link AuthDataRef} compatible with `useModel()` from the HTTP request auth.
+            key: "readRoleMaps",
+            value: /**
+     * Resolves the granted role map for one or more keys of the same model type — i.e. "what is this
+     * user actually allowed to do with this document?".
      *
-     * Uses the same synthetic auth pattern as {@link ModelApiDispatchService.dispatch}.
-     * The OIDC-validated claim subset is layered over the base token so the synthetic
-     * `auth.token` keeps standard JWT claims (`iat`, `auth_time`, `email`, …) that
-     * downstream consumers like `authContextInfo` rely on.
+     * This is the same computation the permission-checked read path runs (`roleMapForModel()` on the
+     * model's registered service factory), but the resolved roles are returned instead of being
+     * consumed to allow/deny an operation. Because it runs the model's real delegate, derived and
+     * cascading roles are included exactly as the API would grant them.
      *
-     * @param auth - The Firebase server auth data from the HTTP request, or undefined for unauthenticated requests.
-     * @returns An object containing a synthetic {@link AuthData} for use with `useModel()`, or undefined auth.
-     */ key: "_makeAuthRef",
-            value: function _makeAuthRef(auth) {
-                var synthetic;
-                if (auth) {
-                    var _auth_token, _auth_oidcValidatedToken;
-                    var baseToken = (_auth_token = auth.token) !== null && _auth_token !== void 0 ? _auth_token : {};
-                    var oidcToken = (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : {};
-                    synthetic = {
-                        uid: auth.uid,
-                        token: _object_spread$c({}, baseToken, oidcToken)
-                    };
+     * Per-key failures are captured in `errors` rather than thrown, matching {@link readDocuments}.
+     * A key that resolves to a missing document is NOT an error — it comes back with
+     * `exists: false, roles: []`, which is what distinguishes "not there" from "no access".
+     *
+     * @param params - Model type, keys, calling auth, and an optional target uid.
+     * @returns The per-key permission state plus the uid the roles were resolved for.
+     */ function readRoleMaps(params) {
+                return _async_to_generator$b(function() {
+                    var _authRef_auth, modelType, keys, auth, targetUid, targeted, authRef, _tmp, context, service, settled, results, errors, uid;
+                    return _ts_generator$b(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                modelType = params.modelType, keys = params.keys, auth = params.auth, targetUid = params.targetUid;
+                                this._assertReadScope(modelType, auth);
+                                targeted = targetUid != null && targetUid !== (auth === null || auth === void 0 ? void 0 : auth.uid);
+                                if (!targeted) return [
+                                    3,
+                                    2
+                                ];
+                                return [
+                                    4,
+                                    this._makeAuthRefForUid(targetUid)
+                                ];
+                            case 1:
+                                _tmp = _state.sent();
+                                return [
+                                    3,
+                                    3
+                                ];
+                            case 2:
+                                _tmp = this._makeAuthRef(auth);
+                                _state.label = 3;
+                            case 3:
+                                authRef = _tmp;
+                                context = this._nestContext.makeModelContext(authRef);
+                                service = this._nestContext.firebaseModelsService(modelType, context);
+                                return [
+                                    4,
+                                    Promise.all(keys.map(function(key) {
+                                        return _async_to_generator$b(function() {
+                                            var entry, granted, error;
+                                            return _ts_generator$b(this, function(_state) {
+                                                switch(_state.label){
+                                                    case 0:
+                                                        _state.trys.push([
+                                                            0,
+                                                            2,
+                                                            ,
+                                                            3
+                                                        ]);
+                                                        return [
+                                                            4,
+                                                            service.roleMapForKey(key)
+                                                        ];
+                                                    case 1:
+                                                        granted = _state.sent();
+                                                        entry = {
+                                                            result: modelAccessRoleMapResultFromGrantedRoles({
+                                                                key: key,
+                                                                granted: granted
+                                                            })
+                                                        };
+                                                        return [
+                                                            3,
+                                                            3
+                                                        ];
+                                                    case 2:
+                                                        error = _state.sent();
+                                                        entry = {
+                                                            error: modelAccessReadErrorFromUseMultipleModelsFailure({
+                                                                key: key,
+                                                                error: error
+                                                            })
+                                                        };
+                                                        return [
+                                                            3,
+                                                            3
+                                                        ];
+                                                    case 3:
+                                                        return [
+                                                            2,
+                                                            entry
+                                                        ];
+                                                }
+                                            });
+                                        })();
+                                    }))
+                                ];
+                            case 4:
+                                settled = _state.sent();
+                                results = [];
+                                errors = [];
+                                settled.forEach(function(entry) {
+                                    if (entry.result != null) {
+                                        results.push(entry.result);
+                                    } else if (entry.error != null) {
+                                        errors.push(entry.error);
+                                    }
+                                });
+                                uid = (_authRef_auth = authRef.auth) === null || _authRef_auth === void 0 ? void 0 : _authRef_auth.uid;
+                                return [
+                                    2,
+                                    _object_spread_props$a(_object_spread$d({}, uid == null ? {} : {
+                                        uid: uid
+                                    }), {
+                                        targeted: targeted,
+                                        results: results,
+                                        errors: errors
+                                    })
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "_makeAuthRefForUid",
+            value: /**
+     * Builds a synthetic {@link AuthData} for an arbitrary uid so role resolution can run *as* that
+     * user rather than as the caller.
+     *
+     * The target's custom claims are read from their Firebase Auth record and spread into the
+     * synthetic token, mirroring how Firebase merges custom claims into a real decoded ID token —
+     * so claim-reading permission delegates behave identically to a live request from that user.
+     *
+     * @param uid - The uid to resolve as.
+     * @returns An auth ref carrying the target user's claims.
+     * @throws {Error} If no Firebase Auth user exists for the uid.
+     */ function _makeAuthRefForUid(uid) {
+                return _async_to_generator$b(function() {
+                    var userContext, exists, record;
+                    return _ts_generator$b(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                userContext = this._nestContext.authService.userContext(uid);
+                                return [
+                                    4,
+                                    userContext.exists()
+                                ];
+                            case 1:
+                                exists = _state.sent();
+                                if (!exists) {
+                                    throw new Error('No user exists with uid "'.concat(uid, '".'));
+                                }
+                                return [
+                                    4,
+                                    userContext.loadRecord()
+                                ];
+                            case 2:
+                                record = _state.sent();
+                                return [
+                                    2,
+                                    {
+                                        auth: {
+                                            uid: uid,
+                                            token: _object_spread_props$a(_object_spread$d({}, record.customClaims), {
+                                                uid: uid,
+                                                sub: uid,
+                                                email: record.email,
+                                                email_verified: record.emailVerified
+                                            })
+                                        }
+                                    }
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            /**
+     * Builds an {@link AuthDataRef} compatible with `useModel()` from the HTTP request auth.
+     *
+     * Uses the same synthetic auth pattern as {@link ModelApiDispatchService.dispatch}.
+     * The OIDC-validated claim subset is layered over the base token so the synthetic
+     * `auth.token` keeps standard JWT claims (`iat`, `auth_time`, `email`, …) that
+     * downstream consumers like `authContextInfo` rely on.
+     *
+     * @param auth - The Firebase server auth data from the HTTP request, or undefined for unauthenticated requests.
+     * @returns An object containing a synthetic {@link AuthData} for use with `useModel()`, or undefined auth.
+     */ key: "_makeAuthRef",
+            value: function _makeAuthRef(auth) {
+                var synthetic;
+                if (auth) {
+                    var _auth_token, _auth_oidcValidatedToken;
+                    var baseToken = (_auth_token = auth.token) !== null && _auth_token !== void 0 ? _auth_token : {};
+                    var oidcToken = (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : {};
+                    synthetic = {
+                        uid: auth.uid,
+                        token: _object_spread$d({}, baseToken, oidcToken)
+                    };
                 }
                 return {
                     auth: synthetic
@@ -8032,7 +8432,7 @@ exports.ModelApiGetService = __decorate([
     __param(1, common.Inject(MODEL_API_NEST_APPLICATION_CONTEXT))
 ], exports.ModelApiGetService);
 
-function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -8046,27 +8446,27 @@ function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$8(fn) {
+function _async_to_generator$a(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$d(instance, Constructor) {
+function _class_call_check$g(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$8(target, props) {
+function _defineProperties$a(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -8075,11 +8475,11 @@ function _defineProperties$8(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$8(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
+function _create_class$a(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$k(obj, key, value) {
+function _define_property$n(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -8092,7 +8492,7 @@ function _define_property$k(obj, key, value) {
     }
     return obj;
 }
-function _instanceof$1(left, right) {
+function _instanceof$2(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -8100,7 +8500,7 @@ function _instanceof$1(left, right) {
         return left instanceof right;
     }
 }
-function _ts_generator$8(thisArg, body) {
+function _ts_generator$a(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -8225,13 +8625,13 @@ function _ts_generator$8(thisArg, body) {
  * Auth is provided by the OIDC bearer token middleware on the `req.auth` field.
  */ exports.ModelApiController = /*#__PURE__*/ function() {
     function ModelApiController(dispatchService, accessService) {
-        _class_call_check$d(this, ModelApiController);
-        _define_property$k(this, "dispatchService", void 0);
-        _define_property$k(this, "accessService", void 0);
+        _class_call_check$g(this, ModelApiController);
+        _define_property$n(this, "dispatchService", void 0);
+        _define_property$n(this, "accessService", void 0);
         this.dispatchService = dispatchService;
         this.accessService = accessService;
     }
-    _create_class$8(ModelApiController, [
+    _create_class$a(ModelApiController, [
         {
             key: "directDispatch",
             value: // MARK: Direct Dispatch
@@ -8245,8 +8645,8 @@ function _ts_generator$8(thisArg, body) {
      * @param req - The Express request containing auth credentials on `req.auth`.
      * @returns The result of the dispatched model call.
      */ function directDispatch(body, req) {
-                return _async_to_generator$8(function() {
-                    return _ts_generator$8(this, function(_state) {
+                return _async_to_generator$a(function() {
+                    return _ts_generator$a(this, function(_state) {
                         return [
                             2,
                             this._dispatch(body, req)
@@ -8270,9 +8670,9 @@ function _ts_generator$8(thisArg, body) {
      * @param req - The Express request containing auth credentials on `req.auth`.
      * @returns The document data for the requested model key.
      */ function getOne(modelType, key, req) {
-                return _async_to_generator$8(function() {
+                return _async_to_generator$a(function() {
                     var auth, error;
-                    return _ts_generator$8(this, function(_state) {
+                    return _ts_generator$a(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 if (!key) {
@@ -8326,9 +8726,9 @@ function _ts_generator$8(thisArg, body) {
      * @param req - The Express request containing auth credentials on `req.auth`.
      * @returns An object with `results` (document data array) and `errors` (per-key failures).
      */ function getMany(modelType, body, req) {
-                return _async_to_generator$8(function() {
+                return _async_to_generator$a(function() {
                     var keys, auth, error;
-                    return _ts_generator$8(this, function(_state) {
+                    return _ts_generator$a(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 keys = body.keys;
@@ -8391,9 +8791,9 @@ function _ts_generator$8(thisArg, body) {
      * @param req - The Express request whose path segments encode modelType, call, and optional specifier.
      * @returns The result of the dispatched model call.
      */ function handleDispatchRequest(req) {
-                return _async_to_generator$8(function() {
+                return _async_to_generator$a(function() {
                     var _this__parsePath, modelType, call, specifier, params;
-                    return _ts_generator$8(this, function(_state) {
+                    return _ts_generator$a(this, function(_state) {
                         if (!ALLOWED_DISPATCH_METHODS.has(req.method)) {
                             throw new common.HttpException({
                                 statusCode: 405,
@@ -8466,9 +8866,9 @@ function _ts_generator$8(thisArg, body) {
         {
             key: "_dispatch",
             value: function _dispatch(params, req) {
-                return _async_to_generator$8(function() {
+                return _async_to_generator$a(function() {
                     var auth, error;
-                    return _ts_generator$8(this, function(_state) {
+                    return _ts_generator$a(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 auth = req.auth;
@@ -8505,7 +8905,7 @@ function _ts_generator$8(thisArg, body) {
             key: "_toHttpException",
             value: function _toHttpException(error) {
                 var result;
-                if (_instanceof$1(error, common.HttpException)) {
+                if (_instanceof$2(error, common.HttpException)) {
                     result = error;
                 } else {
                     var _ref, _ref1, _ref2;
@@ -8551,15 +8951,15 @@ exports.ModelApiController = __decorate([
     __param(1, common.Inject(exports.ModelApiGetService))
 ], exports.ModelApiController);
 
-function _array_like_to_array$7(arr, len) {
+function _array_like_to_array$9(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$5(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
+function _array_without_holes$7(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$9(arr);
 }
-function _define_property$j(obj, key, value) {
+function _define_property$m(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -8572,13 +8972,13 @@ function _define_property$j(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$5(iter) {
+function _iterable_to_array$7(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$5() {
+function _non_iterable_spread$7() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$b(target) {
+function _object_spread$c(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -8588,21 +8988,21 @@ function _object_spread$b(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$j(target, key, source[key]);
+            _define_property$m(target, key, source[key]);
         });
     }
     return target;
 }
-function _to_consumable_array$5(arr) {
-    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$5();
+function _to_consumable_array$7(arr) {
+    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$9(arr) || _non_iterable_spread$7();
 }
-function _unsupported_iterable_to_array$7(o, minLen) {
+function _unsupported_iterable_to_array$9(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$9(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$9(o, minLen);
 }
 // MARK: Module Metadata
 /**
@@ -8627,14 +9027,14 @@ function _unsupported_iterable_to_array$7(o, minLen) {
     return {
         imports: [
             dependencyModule
-        ].concat(_to_consumable_array$5(imports !== null && imports !== void 0 ? imports : [])),
+        ].concat(_to_consumable_array$7(imports !== null && imports !== void 0 ? imports : [])),
         controllers: [
             exports.ModelApiController
         ],
         exports: [
             exports.ModelApiGetService,
             exports.ModelApiCallModelDispatchService
-        ].concat(_to_consumable_array$5(exports$1 !== null && exports$1 !== void 0 ? exports$1 : [])),
+        ].concat(_to_consumable_array$7(exports$1 !== null && exports$1 !== void 0 ? exports$1 : [])),
         providers: [
             exports.ModelApiGetService,
             exports.ModelApiCallModelDispatchService,
@@ -8646,7 +9046,7 @@ function _unsupported_iterable_to_array$7(o, minLen) {
                     // a full app-level context where all providers (e.g., server actions) are resolvable.
                     return {
                         get: function get(typeOrToken, options) {
-                            return moduleRef.get(typeOrToken, _object_spread$b({
+                            return moduleRef.get(typeOrToken, _object_spread$c({
                                 strict: false
                             }, options));
                         }
@@ -8656,6 +9056,810 @@ function _unsupported_iterable_to_array$7(o, minLen) {
                     core.ModuleRef
                 ]
             }
+        ].concat(_to_consumable_array$7(providers !== null && providers !== void 0 ? providers : []))
+    };
+}
+
+function _class_call_check$f(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _define_property$l(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+// MARK: Paths
+/**
+ * Route prefix the session API controller is mounted at. Under the `/api` global route prefix the
+ * routes become `/api/session/*`.
+ */ var SESSION_API_ROUTE_PREFIX = 'session';
+/**
+ * Path (relative to the API base URL) of the direct-Firestore session endpoint.
+ *
+ * The `@dereekb/dbx-cli` client posts to `<apiBaseUrl>${FIRESTORE_SESSION_API_PATH}`.
+ */ var FIRESTORE_SESSION_API_PATH = '/session/firestore';
+/**
+ * Path prefix apps must add to their OIDC `protectedPaths` so the bearer-token middleware
+ * authenticates the session endpoint (today typically `['/api/model', '/mcp']`).
+ *
+ * Without this the endpoint is reachable unauthenticated — `req.auth` would be `undefined` and the
+ * request rejected as unauthenticated, but the gate belongs at the middleware, not the handler.
+ */ var FIREBASE_SERVER_SESSION_API_PROTECTED_PATH = '/api/session';
+// MARK: TTL
+/**
+ * Default lifetime requested for the minted App Check token. Matches the Admin SDK's own default.
+ */ var DEFAULT_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS = 60 * 60 * 1000;
+/**
+ * Minimum lifetime the Admin SDK accepts for an App Check token (30 minutes).
+ */ var MIN_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS = 30 * 60 * 1000;
+/**
+ * Maximum lifetime the Admin SDK accepts for an App Check token (7 days).
+ *
+ * Deliberately NOT the default: this endpoint mints a valid web-app App Check attestation for
+ * whoever calls it, so the shortest workable lifetime is the right one.
+ */ var MAX_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * Window a Firebase Auth custom token may be exchanged for an ID token within (1 hour, fixed by
+ * Firebase). The exchanged ID token then lives its own hour from sign-in.
+ */ var FIREBASE_CUSTOM_TOKEN_EXCHANGE_WINDOW_MILLIS = 60 * 60 * 1000;
+/**
+ * NestJS injection token for the {@link FirestoreSessionAdminPredicate} provider.
+ */ var FIRESTORE_SESSION_ADMIN_PREDICATE = 'FIRESTORE_SESSION_ADMIN_PREDICATE';
+// MARK: Config
+/**
+ * Optional configuration for the session API module, supplied by the app via its dependency module.
+ *
+ * Everything here is optional — with no config provided the endpoint still mints custom tokens, just
+ * without an App Check attestation (correct for a project that does not enforce App Check, and for
+ * emulator-backed local development).
+ */ var SessionApiModuleConfig = function SessionApiModuleConfig() {
+    _class_call_check$f(this, SessionApiModuleConfig);
+    /**
+     * The Firebase `appId` of the registered **web** app to mint App Check tokens for. This is the same
+     * `appId` the browser client initializes with — the attestation must match an app the project's
+     * App Check enforcement recognizes.
+     *
+     * When unset, no App Check token is minted and the response's `appCheckToken` is omitted.
+     */ _define_property$l(this, "appCheckAppId", void 0);
+    /**
+     * Lifetime to request for the minted App Check token. Clamped to
+     * [{@link MIN_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS}, {@link MAX_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS}].
+     *
+     * Defaults to {@link DEFAULT_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS}.
+     */ _define_property$l(this, "appCheckTokenTtlMillis", void 0);
+    /**
+     * OIDC scope term an OIDC caller must hold to open a session. Defaults to
+     * {@link FIRESTORE_SESSION_OIDC_SCOPE}. Pass `null` to disable scope enforcement entirely (the admin
+     * predicate remains the real gate either way).
+     */ _define_property$l(this, "requiredScope", void 0);
+};
+/**
+ * Resolves the effective App Check TTL from the module config, clamped to the Admin SDK's accepted range.
+ *
+ * @param ttlMillis - The configured TTL, or `undefined` to use the default.
+ * @returns The TTL to request, in milliseconds.
+ * @__NO_SIDE_EFFECTS__
+ */ function firestoreSessionAppCheckTtlMillis(ttlMillis) {
+    var requested = ttlMillis !== null && ttlMillis !== void 0 ? ttlMillis : DEFAULT_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS;
+    return Math.min(Math.max(requested, MIN_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS), MAX_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS);
+}
+/**
+ * The default {@link SessionApiModuleConfig.requiredScope}, re-exported for apps that want to widen it
+ * into an OR-group rather than replace it.
+ */ var DEFAULT_FIRESTORE_SESSION_REQUIRED_OIDC_SCOPE = firebase.FIRESTORE_SESSION_OIDC_SCOPE;
+
+function _array_like_to_array$8(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$6(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$8(arr);
+}
+function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$9(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check$e(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties$9(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class$9(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$k(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _iterable_to_array$6(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$6() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread$b(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$k(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$9(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$9(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$9(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _to_consumable_array$6(arr) {
+    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$8(arr) || _non_iterable_spread$6();
+}
+function _unsupported_iterable_to_array$8(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$8(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$8(o, minLen);
+}
+function _ts_generator$9(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+var FirestoreSessionApiService_1;
+/**
+ * Error code thrown when the caller is not authorized to open a direct-Firestore session.
+ */ var FIRESTORE_SESSION_FORBIDDEN_ERROR_CODE = 'FIRESTORE_SESSION_FORBIDDEN_ERROR';
+/**
+ * Mints the direct-Firestore session credential bundle returned by `SessionApiController`.
+ *
+ * ## Security
+ *
+ * This service hands out a valid web-app App Check token and a custom token for the caller's own uid.
+ * Two gates apply, in order:
+ *
+ * 1. The app-supplied {@link FirestoreSessionAdminPredicate} — the load-bearing check. **Fails closed**
+ *    when the app provides no predicate.
+ * 2. The OIDC scope requirement (default {@link FIRESTORE_SESSION_OIDC_SCOPE}) — defence in depth only.
+ *    It cannot stand alone: a non-OIDC caller carries no `scope` claim and every enforcement site in
+ *    this codebase treats that as "skip".
+ *
+ * The custom token is ALWAYS minted for `auth.uid`; there is no way to ask for someone else's session,
+ * so a granted session is exactly as privileged as the caller already is under Firestore rules.
+ */ exports.FirestoreSessionApiService = FirestoreSessionApiService_1 = /*#__PURE__*/ function() {
+    function FirestoreSessionApiService(app, config, adminPredicate) {
+        _class_call_check$e(this, FirestoreSessionApiService);
+        _define_property$k(this, "_logger", new common.Logger(FirestoreSessionApiService_1.name));
+        _define_property$k(this, "_app", void 0);
+        _define_property$k(this, "_config", void 0);
+        _define_property$k(this, "_adminPredicate", void 0);
+        this._app = app;
+        this._config = config;
+        this._adminPredicate = adminPredicate;
+        if (!adminPredicate) {
+            this._logger.warn("No ".concat(FIRESTORE_SESSION_ADMIN_PREDICATE, " provided — ").concat(FIRESTORE_SESSION_API_PATH, " will reject every caller. Provide one from the session module's dependency module."));
+        }
+        if (!(config === null || config === void 0 ? void 0 : config.appCheckAppId)) {
+            this._logger.warn("No SessionApiModuleConfig.appCheckAppId configured — ".concat(FIRESTORE_SESSION_API_PATH, " will issue sessions without an App Check attestation. Direct Firestore access will be rejected wherever App Check is enforced."));
+        }
+    }
+    _create_class$9(FirestoreSessionApiService, [
+        {
+            key: "createFirestoreSession",
+            value: /**
+     * Mints a direct-Firestore session for the calling user after enforcing the admin predicate and the
+     * OIDC scope requirement.
+     *
+     * @param auth - The authenticated request's auth data (`req.auth`).
+     * @returns The credential bundle the client needs to connect to Firestore as this user.
+     * @throws {HttpsError} A `401` when the request carries no uid, or a `403` when either gate rejects the caller.
+     */ function createFirestoreSession(auth) {
+                return _async_to_generator$9(function() {
+                    var _Math, _this__config, _this__config1, uid, isAllowed, _tmp, configuredScope, now, customToken, appCheckToken, appCheckTtlMillis, appCheckAppId, _created_ttlMillis, _this__config2, ttlMillis, created, expiresAtMillis;
+                    return _ts_generator$9(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                uid = auth === null || auth === void 0 ? void 0 : auth.uid;
+                                if (!uid) {
+                                    throw unauthenticatedError({
+                                        message: 'A direct-Firestore session requires an authenticated caller.'
+                                    });
+                                }
+                                if (!this._adminPredicate) return [
+                                    3,
+                                    2
+                                ];
+                                return [
+                                    4,
+                                    this._adminPredicate(auth)
+                                ];
+                            case 1:
+                                _tmp = _state.sent();
+                                return [
+                                    3,
+                                    3
+                                ];
+                            case 2:
+                                _tmp = false;
+                                _state.label = 3;
+                            case 3:
+                                isAllowed = _tmp;
+                                if (!isAllowed) {
+                                    throw forbiddenError({
+                                        status: 403,
+                                        code: FIRESTORE_SESSION_FORBIDDEN_ERROR_CODE,
+                                        message: 'Not authorized to open a direct-Firestore session.'
+                                    });
+                                }
+                                // an explicit `null` disables scope enforcement; only an ABSENT value falls back to the default
+                                configuredScope = (_this__config = this._config) === null || _this__config === void 0 ? void 0 : _this__config.requiredScope;
+                                assertEndpointOidcScope({
+                                    requiredScope: configuredScope === undefined ? DEFAULT_FIRESTORE_SESSION_REQUIRED_OIDC_SCOPE : configuredScope,
+                                    grantedScopes: oidcScopesFromRequestAuth(auth),
+                                    endpoint: FIRESTORE_SESSION_API_PATH
+                                });
+                                now = Date.now();
+                                return [
+                                    4,
+                                    this._app.auth().createCustomToken(uid)
+                                ];
+                            case 4:
+                                customToken = _state.sent();
+                                appCheckAppId = (_this__config1 = this._config) === null || _this__config1 === void 0 ? void 0 : _this__config1.appCheckAppId;
+                                if (!appCheckAppId) return [
+                                    3,
+                                    6
+                                ];
+                                ttlMillis = firestoreSessionAppCheckTtlMillis((_this__config2 = this._config) === null || _this__config2 === void 0 ? void 0 : _this__config2.appCheckTokenTtlMillis);
+                                return [
+                                    4,
+                                    this._app.appCheck().createToken(appCheckAppId, {
+                                        ttlMillis: ttlMillis
+                                    })
+                                ];
+                            case 5:
+                                created = _state.sent();
+                                appCheckToken = created.token;
+                                appCheckTtlMillis = (_created_ttlMillis = created.ttlMillis) !== null && _created_ttlMillis !== void 0 ? _created_ttlMillis : ttlMillis;
+                                _state.label = 6;
+                            case 6:
+                                // the session lives only as long as its shortest-lived credential
+                                expiresAtMillis = (_Math = Math).min.apply(_Math, [
+                                    now + FIREBASE_CUSTOM_TOKEN_EXCHANGE_WINDOW_MILLIS
+                                ].concat(_to_consumable_array$6(appCheckTtlMillis == null ? [] : [
+                                    now + appCheckTtlMillis
+                                ])));
+                                return [
+                                    2,
+                                    _object_spread_props$9(_object_spread$b({
+                                        uid: uid,
+                                        customToken: customToken
+                                    }, appCheckToken ? {
+                                        appCheckToken: appCheckToken
+                                    } : undefined), {
+                                        expiresAt: new Date(expiresAtMillis).toISOString()
+                                    })
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return FirestoreSessionApiService;
+}();
+exports.FirestoreSessionApiService = FirestoreSessionApiService_1 = __decorate([
+    common.Injectable(),
+    __param(0, common.Inject(FIREBASE_APP_TOKEN)),
+    __param(1, common.Optional()),
+    __param(1, common.Inject(SessionApiModuleConfig)),
+    __param(2, common.Optional()),
+    __param(2, common.Inject(FIRESTORE_SESSION_ADMIN_PREDICATE))
+], exports.FirestoreSessionApiService);
+
+function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$8(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check$d(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties$8(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class$8(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$j(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof$1(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _ts_generator$8(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * REST controller that hands an authenticated admin caller the credentials needed to talk to
+ * Firestore directly, rather than only through the model HTTP API.
+ *
+ * Mounted at `session` — under the `/api` global prefix the route becomes `GET /api/session/firestore`.
+ *
+ * Auth comes from the global OIDC bearer middleware, so `'/api/session'` MUST be listed in the OIDC
+ * module's `protectedPaths` (see `FIREBASE_SERVER_SESSION_API_PROTECTED_PATH`). Follows `McpController`:
+ * there are no NestJS guards in this codebase — protection is path-prefix middleware plus the
+ * per-endpoint checks in {@link FirestoreSessionApiService}.
+ */ exports.SessionApiController = /*#__PURE__*/ function() {
+    function SessionApiController(sessionService) {
+        _class_call_check$d(this, SessionApiController);
+        _define_property$j(this, "sessionService", void 0);
+        this.sessionService = sessionService;
+    }
+    _create_class$8(SessionApiController, [
+        {
+            key: "getFirestoreSession",
+            value: /**
+     * Mints a short-lived Firebase Auth custom token (+ App Check attestation, when configured) for the
+     * calling user.
+     *
+     * @param req - The Express request carrying auth credentials on `req.auth`.
+     * @returns The {@link FirestoreSessionResult} credential bundle.
+     */ function getFirestoreSession(req) {
+                return _async_to_generator$8(function() {
+                    var auth, error;
+                    return _ts_generator$8(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                auth = req.auth;
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
+                                return [
+                                    4,
+                                    this.sessionService.createFirestoreSession(auth)
+                                ];
+                            case 2:
+                                return [
+                                    2,
+                                    _state.sent()
+                                ];
+                            case 3:
+                                error = _state.sent();
+                                throw this._toHttpException(error);
+                            case 4:
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "_toHttpException",
+            value: function _toHttpException(error) {
+                var result;
+                if (_instanceof$1(error, common.HttpException)) {
+                    result = error;
+                } else {
+                    var _ref, _ref1, _ref2, _ref3;
+                    var _error_httpErrorCode, _error_details;
+                    var status = (_ref = (_ref1 = error === null || error === void 0 ? void 0 : error.status) !== null && _ref1 !== void 0 ? _ref1 : error === null || error === void 0 ? void 0 : (_error_httpErrorCode = error.httpErrorCode) === null || _error_httpErrorCode === void 0 ? void 0 : _error_httpErrorCode.status) !== null && _ref !== void 0 ? _ref : common.HttpStatus.INTERNAL_SERVER_ERROR;
+                    var message = (_ref2 = error === null || error === void 0 ? void 0 : error.message) !== null && _ref2 !== void 0 ? _ref2 : 'Internal server error';
+                    // `forbiddenError`/`unauthenticatedError` build an HttpsError whose top-level `code` is the
+                    // coarse functions code ('permission-denied'), with the specific one under `details`. Prefer
+                    // the specific code so a client can tell FIRESTORE_SESSION_FORBIDDEN_ERROR (not an admin) apart
+                    // from MISSING_ENDPOINT_OIDC_SCOPE_ERROR (admin, but the token lacks `session.firestore`).
+                    var code = (_ref3 = error === null || error === void 0 ? void 0 : (_error_details = error.details) === null || _error_details === void 0 ? void 0 : _error_details.code) !== null && _ref3 !== void 0 ? _ref3 : error === null || error === void 0 ? void 0 : error.code;
+                    result = new common.HttpException({
+                        statusCode: status,
+                        message: message,
+                        code: code
+                    }, status);
+                }
+                return result;
+            }
+        }
+    ]);
+    return SessionApiController;
+}();
+__decorate([
+    common.Get('firestore'),
+    __param(0, common.Req())
+], exports.SessionApiController.prototype, "getFirestoreSession", null);
+exports.SessionApiController = __decorate([
+    common.Controller(SESSION_API_ROUTE_PREFIX),
+    __param(0, common.Inject(exports.FirestoreSessionApiService))
+], exports.SessionApiController);
+
+function _array_like_to_array$7(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
+}
+function _iterable_to_array$5(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$5() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$5();
+}
+function _unsupported_iterable_to_array$7(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
+}
+// MARK: Module Metadata
+/**
+ * Generates NestJS module metadata for the direct-Firestore session API.
+ *
+ * Mirrors the convention used by `modelApiModuleMetadata` and `mcpModuleMetadata`: the consumer
+ * provides a dependency module exposing the required tokens, and this factory wires the controller +
+ * service.
+ *
+ * Remember to add `FIREBASE_SERVER_SESSION_API_PROTECTED_PATH` (`'/api/session'`) to the OIDC module's
+ * `protectedPaths` — the controller relies on the bearer middleware having populated `req.auth`.
+ *
+ * @param metadataConfig - Configuration including the dependency module.
+ * @returns NestJS module metadata exposing the session controller + service.
+ *
+ * @example
+ * ```typescript
+ * @Module({
+ *   imports: [DemoApiAuthModule],
+ *   providers: [
+ *     { provide: SessionApiModuleConfig, useValue: { appCheckAppId: environment.firebase.appId } },
+ *     { provide: FIRESTORE_SESSION_ADMIN_PREDICATE, useValue: (auth) => DEMO_AUTH_CLAIMS_SERVICE.toRoles(auth?.token ?? {}).has('admin') }
+ *   ],
+ *   exports: [SessionApiModuleConfig, FIRESTORE_SESSION_ADMIN_PREDICATE]
+ * })
+ * export class DemoSessionApiDependencyModule {}
+ *
+ * @Module(sessionApiModuleMetadata({ dependencyModule: DemoSessionApiDependencyModule }))
+ * export class DemoSessionApiModule {}
+ * ```
+ */ function sessionApiModuleMetadata(metadataConfig) {
+    var dependencyModule = metadataConfig.dependencyModule, imports = metadataConfig.imports, exports$1 = metadataConfig.exports, providers = metadataConfig.providers;
+    return {
+        imports: [
+            dependencyModule
+        ].concat(_to_consumable_array$5(imports !== null && imports !== void 0 ? imports : [])),
+        controllers: [
+            exports.SessionApiController
+        ],
+        exports: [
+            exports.FirestoreSessionApiService
+        ].concat(_to_consumable_array$5(exports$1 !== null && exports$1 !== void 0 ? exports$1 : [])),
+        providers: [
+            exports.FirestoreSessionApiService
         ].concat(_to_consumable_array$5(providers !== null && providers !== void 0 ? providers : []))
     };
 }
@@ -11565,7 +12769,7 @@ function _ts_generator$2(thisArg, body) {
                             return x[0];
                         }).catch(function(e) {
                             var publicUrlBackup;
-                            if (_instanceof(e, Error) && e.name === 'SigningError' && (nestjs.isTestNodeEnv() || process.env.FIREBASE_STORAGE_EMULATOR_HOST)) {
+                            if (_instanceof(e, Error) && e.name === 'SigningError' && (nestjs.isTestNodeEnv() || process.env['FIREBASE_STORAGE_EMULATOR_HOST'])) {
                                 // NOTE: Signing does not behave properly in the emulator as it is not supported.
                                 // https://github.com/firebase/firebase-tools/issues/3400
                                 // we can return the public url instead.
@@ -13287,20 +14491,27 @@ exports.AbstractFirebaseServerUserPasswordResetService = AbstractFirebaseServerU
 exports.AbstractNestContext = AbstractNestContext;
 exports.AbstractServerFirebaseNestContext = AbstractServerFirebaseNestContext;
 exports.DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR = DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR;
+exports.DEFAULT_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS = DEFAULT_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS;
+exports.DEFAULT_FIRESTORE_SESSION_REQUIRED_OIDC_SCOPE = DEFAULT_FIRESTORE_SESSION_REQUIRED_OIDC_SCOPE;
 exports.DEFAULT_RESET_CODE_EXPIRES_IN = DEFAULT_RESET_CODE_EXPIRES_IN;
 exports.DEFAULT_RESET_COM_THROTTLE_TIME = DEFAULT_RESET_COM_THROTTLE_TIME;
 exports.DEFAULT_SERVER_ASSETS_BASE_PATH = DEFAULT_SERVER_ASSETS_BASE_PATH;
 exports.DEFAULT_SETUP_COM_THROTTLE_TIME = DEFAULT_SETUP_COM_THROTTLE_TIME;
 exports.FIREBASE_APP_TOKEN = FIREBASE_APP_TOKEN;
 exports.FIREBASE_AUTH_TOKEN = FIREBASE_AUTH_TOKEN;
+exports.FIREBASE_CUSTOM_TOKEN_EXCHANGE_WINDOW_MILLIS = FIREBASE_CUSTOM_TOKEN_EXCHANGE_WINDOW_MILLIS;
 exports.FIREBASE_FIRESTORE_CONTEXT_TOKEN = FIREBASE_FIRESTORE_CONTEXT_TOKEN;
 exports.FIREBASE_FIRESTORE_TOKEN = FIREBASE_FIRESTORE_TOKEN;
 exports.FIREBASE_SERVER_ENV_TOKEN = FIREBASE_SERVER_ENV_TOKEN;
+exports.FIREBASE_SERVER_SESSION_API_PROTECTED_PATH = FIREBASE_SERVER_SESSION_API_PROTECTED_PATH;
 exports.FIREBASE_SERVER_VALIDATION_ERROR_CODE = FIREBASE_SERVER_VALIDATION_ERROR_CODE;
 exports.FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN = FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN;
 exports.FIREBASE_STORAGE_CONTEXT_TOKEN = FIREBASE_STORAGE_CONTEXT_TOKEN;
 exports.FIREBASE_STORAGE_TOKEN = FIREBASE_STORAGE_TOKEN;
 exports.FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING = FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING;
+exports.FIRESTORE_SESSION_ADMIN_PREDICATE = FIRESTORE_SESSION_ADMIN_PREDICATE;
+exports.FIRESTORE_SESSION_API_PATH = FIRESTORE_SESSION_API_PATH;
+exports.FIRESTORE_SESSION_FORBIDDEN_ERROR_CODE = FIRESTORE_SESSION_FORBIDDEN_ERROR_CODE;
 exports.FirebaseAppCheckMiddlewareConfig = FirebaseAppCheckMiddlewareConfig;
 exports.FirebaseNestServerRootModule = FirebaseNestServerRootModule;
 exports.FirebaseServerAnalyticsServiceListener = FirebaseServerAnalyticsServiceListener;
@@ -13317,8 +14528,12 @@ exports.FirebaseServerAuthUserExistsError = FirebaseServerAuthUserExistsError;
 exports.FirebaseServerEnvService = FirebaseServerEnvService;
 exports.FirebaseServerStorageService = FirebaseServerStorageService;
 exports.GlobalRoutePrefixConfig = GlobalRoutePrefixConfig;
+exports.MAX_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS = MAX_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS;
 exports.MAX_MODEL_ACCESS_MULTI_READ_KEYS = MAX_MODEL_ACCESS_MULTI_READ_KEYS;
+exports.MIN_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS = MIN_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS;
+exports.MISSING_ENDPOINT_OIDC_SCOPE_ERROR_CODE = MISSING_ENDPOINT_OIDC_SCOPE_ERROR_CODE;
 exports.MODEL_API_NEST_APPLICATION_CONTEXT = MODEL_API_NEST_APPLICATION_CONTEXT;
+exports.MODEL_IS_SERVER_ONLY_ERROR_CODE = MODEL_IS_SERVER_ONLY_ERROR_CODE;
 exports.ModelApiDispatchConfig = ModelApiDispatchConfig;
 exports.NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE = NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE;
 exports.NoContentFirebaseServerUserPasswordResetService = NoContentFirebaseServerUserPasswordResetService;
@@ -13327,6 +14542,8 @@ exports.ON_CALL_MODEL_ANALYTICS_HANDLER = ON_CALL_MODEL_ANALYTICS_HANDLER;
 exports.ON_CALL_MODEL_ANALYTICS_SERVICE = ON_CALL_MODEL_ANALYTICS_SERVICE;
 exports.OnCallModelAnalyticsService = OnCallModelAnalyticsService;
 exports.PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE = PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE;
+exports.SESSION_API_ROUTE_PREFIX = SESSION_API_ROUTE_PREFIX;
+exports.SessionApiModuleConfig = SessionApiModuleConfig;
 exports.SkipAppCheck = SkipAppCheck;
 exports.UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE = UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE;
 exports.UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE = UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE;
@@ -13339,6 +14556,7 @@ exports.appAnalyticsModuleMetadata = appAnalyticsModuleMetadata;
 exports.appFirestoreModuleMetadata = appFirestoreModuleMetadata;
 exports.assertContextHasAuth = assertContextHasAuth;
 exports.assertDocumentExists = assertDocumentExists;
+exports.assertEndpointOidcScope = assertEndpointOidcScope;
 exports.assertHasRolesInRequest = assertHasRolesInRequest;
 exports.assertHasSignedTosInRequest = assertHasSignedTosInRequest;
 exports.assertIsAdminInRequest = assertIsAdminInRequest;
@@ -13390,6 +14608,7 @@ exports.firebaseServerValidationServerError = firebaseServerValidationServerErro
 exports.firestoreClientQueryConstraintFunctionsDriver = firestoreClientQueryConstraintFunctionsDriver;
 exports.firestoreEncryptedField = firestoreEncryptedField;
 exports.firestoreServerIncrementUpdateToUpdateData = firestoreServerIncrementUpdateToUpdateData;
+exports.firestoreSessionAppCheckTtlMillis = firestoreSessionAppCheckTtlMillis;
 exports.forbiddenError = forbiddenError;
 exports.getAuthUserOrUndefined = getAuthUserOrUndefined;
 exports.getModelApiDetails = getModelApiDetails;
@@ -13431,6 +14650,7 @@ exports.makeBlockingFunctionWithHandler = makeBlockingFunctionWithHandler;
 exports.makeOnScheduleHandlerWithNestApplicationRequest = makeOnScheduleHandlerWithNestApplicationRequest;
 exports.makeScheduledFunctionDevelopmentFunction = makeScheduledFunctionDevelopmentFunction;
 exports.modelAccessReadErrorFromUseMultipleModelsFailure = modelAccessReadErrorFromUseMultipleModelsFailure;
+exports.modelAccessRoleMapResultFromGrantedRoles = modelAccessRoleMapResultFromGrantedRoles;
 exports.modelApiModuleMetadata = modelApiModuleMetadata;
 exports.modelNotAvailableError = modelNotAvailableError;
 exports.nestAppHasDevelopmentSchedulerEnabled = nestAppHasDevelopmentSchedulerEnabled;
@@ -13443,6 +14663,7 @@ exports.noopFirebaseServerAnalyticsServiceListener = noopFirebaseServerAnalytics
 exports.noopOnCallModelAnalyticsService = noopOnCallModelAnalyticsService;
 exports.notFoundError = notFoundError;
 exports.oidcScopesFromModelApiAuth = oidcScopesFromModelApiAuth;
+exports.oidcScopesFromRequestAuth = oidcScopesFromRequestAuth;
 exports.onCallAnalyticsEmitterInstance = onCallAnalyticsEmitterInstance;
 exports.onCallCreateModel = onCallCreateModel;
 exports.onCallDeleteModel = onCallDeleteModel;
@@ -13474,6 +14695,7 @@ exports.readModelUnknownModelTypeError = readModelUnknownModelTypeError;
 exports.resolveAdminOnlyValue = resolveAdminOnlyValue;
 exports.resolveAnalyticsFromApiDetails = resolveAnalyticsFromApiDetails;
 exports.resolveRequiredScopeFromApiDetails = resolveRequiredScopeFromApiDetails;
+exports.sessionApiModuleMetadata = sessionApiModuleMetadata;
 exports.setNestContextOnRequest = setNestContextOnRequest;
 exports.setNestContextOnScheduleRequest = setNestContextOnScheduleRequest;
 exports.taskQueueFunctionHandlerWithNestContextFactory = taskQueueFunctionHandlerWithNestContextFactory;