@dereekb/firebase-server 13.36.0 → 13.38.0

package/index.esm.js

@@ -1,5 +1,5 @@
 import { timingSafeEqual } from 'node:crypto';
-import { DBX_FIREBASE_SERVER_NO_AUTH_ERROR_CODE, UNAUTHENTICATED_ERROR_CODE, FORBIDDEN_ERROR_CODE, PERMISSION_DENIED_ERROR_CODE, NOT_FOUND_ERROR_CODE, MODEL_NOT_AVAILABLE_ERROR_CODE, BAD_REQUEST_ERROR_CODE, CONFLICT_ERROR_CODE, ALREADY_EXISTS_ERROR_CODE, UNAVAILABLE_ERROR_CODE, UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE, INTERNAL_SERVER_ERROR_CODE, FIREBASE_AUTH_USER_NOT_FOUND_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_EMAIL_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_INVALID_PHONE_NUMBER_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, setIdAndKeyFromKeyIdRefOnDocumentData, DBX_FIREBASE_SERVER_PASSWORD_RESET_INVALID_CODE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_NO_CONFIG_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_SEND_ONCE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_THROTTLE_ERROR_CODE, FirestoreDocumentContextType, streamFromOnSnapshot, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, makeFirestoreQueryConstraintFunctionsDriver, firestoreContextFactory, firestoreField, optionalFirestoreField, DEFAULT_MODEL_FUNCTION_FIREBASE_CRUD_FUNCTION_SPECIFIER, UNKNOWN_MODEL_TYPE_ERROR_CODE, BAD_DOCUMENT_QUERY_CURSOR_ERROR_CODE, limit, startAfter, DEFAULT_ON_CALL_QUERY_MODEL_LIMIT, MAX_ON_CALL_QUERY_MODEL_LIMIT, resolveEffectiveOidcScopeTerms, callModelOidcScopeForCallType, oidcScopeTermsSatisfied, oidcScopeTermSatisfied, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, oidcScopesFromScopeClaim, ScheduledFunctionDevelopmentFunctionTypeEnum, SCHEDULED_FUNCTION_DEV_FUNCTION_SPECIFIER, storageListFilesResultFactory, assertStorageUploadOptionsStringFormat, firebaseStorageContextFactory, inContextFirebaseModelsServiceFactory, useFirebaseModelsService } from '@dereekb/firebase';
+import { DBX_FIREBASE_SERVER_NO_AUTH_ERROR_CODE, UNAUTHENTICATED_ERROR_CODE, FORBIDDEN_ERROR_CODE, PERMISSION_DENIED_ERROR_CODE, NOT_FOUND_ERROR_CODE, MODEL_NOT_AVAILABLE_ERROR_CODE, BAD_REQUEST_ERROR_CODE, CONFLICT_ERROR_CODE, ALREADY_EXISTS_ERROR_CODE, UNAVAILABLE_ERROR_CODE, UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE, INTERNAL_SERVER_ERROR_CODE, FIREBASE_AUTH_USER_NOT_FOUND_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_EMAIL_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_INVALID_PHONE_NUMBER_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, setIdAndKeyFromKeyIdRefOnDocumentData, DBX_FIREBASE_SERVER_PASSWORD_RESET_INVALID_CODE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_NO_CONFIG_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_SEND_ONCE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_THROTTLE_ERROR_CODE, FirestoreDocumentContextType, streamFromOnSnapshot, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, makeFirestoreQueryConstraintFunctionsDriver, firestoreContextFactory, firestoreField, optionalFirestoreField, DEFAULT_MODEL_FUNCTION_FIREBASE_CRUD_FUNCTION_SPECIFIER, UNKNOWN_MODEL_TYPE_ERROR_CODE, BAD_DOCUMENT_QUERY_CURSOR_ERROR_CODE, limit, startAfter, DEFAULT_ON_CALL_QUERY_MODEL_LIMIT, MAX_ON_CALL_QUERY_MODEL_LIMIT, oidcScopeTermSatisfied, oidcScopesFromScopeClaim, resolveEffectiveOidcScopeTerms, callModelOidcScopeForCallType, oidcScopeTermsSatisfied, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, FIRESTORE_SESSION_OIDC_SCOPE, ScheduledFunctionDevelopmentFunctionTypeEnum, SCHEDULED_FUNCTION_DEV_FUNCTION_SPECIFIER, storageListFilesResultFactory, assertStorageUploadOptionsStringFormat, firebaseStorageContextFactory, inContextFirebaseModelsServiceFactory, useFirebaseModelsService } from '@dereekb/firebase';
 import { partialServerError, isServerError, randomNumberFactory, cachedGetter, filterNullAndUndefinedValues, asSet, AUTH_ADMIN_ROLE, AUTH_TOS_SIGNED_ROLE, forEachKeyValue, KeyValueTypleValueFilter, filterUndefinedValues, isThrottled, mapObjectMap, batch, objectToMap, serverError, asArray, containsAllValues, websiteUrlDetails, mergeObjects, cronExpressionRepeatingEveryNMinutes, mapIdentityFunction, slashPathName, toRelativeSlashPathStartType, fixMultiSlashesInSlashPath, SLASH_PATH_SEPARATOR, objectHasNoKeys, websiteUrlFromPaths, pushItemOrArrayItemsIntoArray, makeGetter, asGetter, build, performAsyncTasks } from '@dereekb/util';
 import { HttpsError } from 'firebase-functions/https';
 import { hoursToMs, minutesToMs, toISODateString } from '@dereekb/date';
@@ -11,8 +11,8 @@ import { Injectable, Optional, Inject, Module, Post, Body, Req, Get, Param, Quer
 import { ModuleRef, NestFactory } from '@nestjs/core';
 import { asAnalyticsEventData } from '@dereekb/analytics';
 import { SegmentService, SegmentServiceModule } from '@dereekb/analytics/nestjs';
+import { isFullAccessRoleMap, FULL_ACCESS_ROLE_KEY, NO_ACCESS_ROLE_KEY, toTransformAndValidateFunctionResultFactory, transformAndValidateObjectFactory } from '@dereekb/model';
 import { https, scheduler } from 'firebase-functions/v2';
-import { toTransformAndValidateFunctionResultFactory, transformAndValidateObjectFactory } from '@dereekb/model';
 import admin from 'firebase-admin';
 import { ApiError } from '@google-cloud/storage';
 import { addHours, addMilliseconds } from 'date-fns';
@@ -21,7 +21,7 @@ import { fetchAssetLoader, delegatedAssetLoader, AssetLoader } from '@dereekb/rx
 import { ExpressAdapter } from '@nestjs/platform-express';
 import express from 'express';
 
-function _define_property$z(obj, key, value) {
+function _define_property$C(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -34,7 +34,7 @@ function _define_property$z(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$l(target) {
+function _object_spread$m(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -44,12 +44,12 @@ function _object_spread$l(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$z(target, key, source[key]);
+            _define_property$C(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$e(object, enumerableOnly) {
+function ownKeys$g(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -57,12 +57,12 @@ function ownKeys$e(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$e(target, source) {
+function _object_spread_props$g(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$e(Object(source)).forEach(function(key) {
+        ownKeys$g(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -101,7 +101,7 @@ function _type_of$7(obj) {
  */ function unauthenticatedError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('unauthenticated', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'unauthenticated', _object_spread_props$e(_object_spread$l({
+    return new HttpsError('unauthenticated', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'unauthenticated', _object_spread_props$g(_object_spread$m({
         status: 401,
         code: UNAUTHENTICATED_ERROR_CODE
     }, serverError), {
@@ -116,7 +116,7 @@ function _type_of$7(obj) {
  */ function forbiddenError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'forbidden', _object_spread_props$e(_object_spread$l({
+    return new HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'forbidden', _object_spread_props$g(_object_spread$m({
         status: 403,
         code: FORBIDDEN_ERROR_CODE
     }, serverError), {
@@ -131,7 +131,7 @@ function _type_of$7(obj) {
  */ function permissionDeniedError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'permission denied', _object_spread_props$e(_object_spread$l({
+    return new HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'permission denied', _object_spread_props$g(_object_spread$m({
         status: 403,
         code: PERMISSION_DENIED_ERROR_CODE
     }, serverError), {
@@ -146,7 +146,7 @@ function _type_of$7(obj) {
  */ function notFoundError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'not found', _object_spread_props$e(_object_spread$l({
+    return new HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'not found', _object_spread_props$g(_object_spread$m({
         status: 404,
         code: NOT_FOUND_ERROR_CODE
     }, serverError), {
@@ -161,7 +161,7 @@ function _type_of$7(obj) {
  */ function modelNotAvailableError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'model was not available', _object_spread_props$e(_object_spread$l({
+    return new HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'model was not available', _object_spread_props$g(_object_spread$m({
         status: 404,
         code: MODEL_NOT_AVAILABLE_ERROR_CODE
     }, serverError), {
@@ -176,7 +176,7 @@ function _type_of$7(obj) {
  */ function badRequestError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('invalid-argument', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'bad request', _object_spread_props$e(_object_spread$l({
+    return new HttpsError('invalid-argument', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'bad request', _object_spread_props$g(_object_spread$m({
         status: 400,
         code: BAD_REQUEST_ERROR_CODE
     }, serverError), {
@@ -191,7 +191,7 @@ function _type_of$7(obj) {
  */ function preconditionConflictError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('failed-precondition', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'conflict', _object_spread_props$e(_object_spread$l({
+    return new HttpsError('failed-precondition', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'conflict', _object_spread_props$g(_object_spread$m({
         status: 409,
         code: CONFLICT_ERROR_CODE
     }, serverError), {
@@ -206,7 +206,7 @@ function _type_of$7(obj) {
  */ function alreadyExistsError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('already-exists', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'already exists', _object_spread_props$e(_object_spread$l({
+    return new HttpsError('already-exists', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'already exists', _object_spread_props$g(_object_spread$m({
         status: 409,
         code: ALREADY_EXISTS_ERROR_CODE
     }, serverError), {
@@ -221,7 +221,7 @@ function _type_of$7(obj) {
  */ function unavailableError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('unavailable', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'service unavailable', _object_spread_props$e(_object_spread$l({
+    return new HttpsError('unavailable', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'service unavailable', _object_spread_props$g(_object_spread$m({
         status: 503,
         code: UNAVAILABLE_ERROR_CODE
     }, serverError), {
@@ -236,7 +236,7 @@ function _type_of$7(obj) {
  */ function unavailableOrDeactivatedFunctionError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('unimplemented', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'the requested function is not available or has been deactivated for use', _object_spread_props$e(_object_spread$l({
+    return new HttpsError('unimplemented', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'the requested function is not available or has been deactivated for use', _object_spread_props$g(_object_spread$m({
         status: 501,
         code: UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE
     }, serverError), {
@@ -251,7 +251,7 @@ function _type_of$7(obj) {
  */ function internalServerError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('internal', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'internal error', _object_spread_props$e(_object_spread$l({
+    return new HttpsError('internal', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'internal error', _object_spread_props$g(_object_spread$m({
         status: 500,
         code: INTERNAL_SERVER_ERROR_CODE
     }, serverError), {
@@ -487,7 +487,7 @@ function toIsoStringFromUnixSeconds(value) {
     return result;
 }
 
-function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -501,22 +501,22 @@ function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$h(fn) {
+function _async_to_generator$j(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$h(thisArg, body) {
+function _ts_generator$j(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -632,9 +632,9 @@ function _ts_generator$h(thisArg, body) {
  * }
  * ```
  */ function getAuthUserOrUndefined(promise) {
-    return _async_to_generator$h(function() {
+    return _async_to_generator$j(function() {
         var result, error;
-        return _ts_generator$h(this, function(_state) {
+        return _ts_generator$j(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -682,12 +682,12 @@ function _call_super$5(_this, derived, args) {
     derived = _get_prototype_of$5(derived);
     return _possible_constructor_return$5(_this, _is_native_reflect_construct$5() ? Reflect.construct(derived, args || [], _get_prototype_of$5(_this).constructor) : derived.apply(_this, args));
 }
-function _class_call_check$r(instance, Constructor) {
+function _class_call_check$u(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _define_property$y(obj, key, value) {
+function _define_property$B(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -761,11 +761,11 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthUserExistsError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthUserExistsError, BaseError);
     function FirebaseServerAuthUserExistsError(code, identifierType, identifierValue) {
-        _class_call_check$r(this, FirebaseServerAuthUserExistsError);
+        _class_call_check$u(this, FirebaseServerAuthUserExistsError);
         var _this;
         _this = _call_super$5(this, FirebaseServerAuthUserExistsError, [
             "A user with the provided ".concat(identifierType, " already exists.")
-        ]), _define_property$y(_this, "code", void 0), _define_property$y(_this, "identifierType", void 0), _define_property$y(_this, "identifierValue", void 0);
+        ]), _define_property$B(_this, "code", void 0), _define_property$B(_this, "identifierType", void 0), _define_property$B(_this, "identifierValue", void 0);
         _this.code = code;
         _this.identifierType = identifierType;
         _this.identifierValue = identifierValue;
@@ -790,11 +790,11 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthUserBadInputError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthUserBadInputError, BaseError);
     function FirebaseServerAuthUserBadInputError(code, inputValue, message) {
-        _class_call_check$r(this, FirebaseServerAuthUserBadInputError);
+        _class_call_check$u(this, FirebaseServerAuthUserBadInputError);
         var _this;
         _this = _call_super$5(this, FirebaseServerAuthUserBadInputError, [
             message !== null && message !== void 0 ? message : "Invalid input for user creation: ".concat(inputValue)
-        ]), _define_property$y(_this, "code", void 0), _define_property$y(_this, "inputValue", void 0);
+        ]), _define_property$B(_this, "code", void 0), _define_property$B(_this, "inputValue", void 0);
         _this.code = code;
         _this.inputValue = inputValue;
         return _this;
@@ -806,7 +806,7 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, BaseError);
     function FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError() {
-        _class_call_check$r(this, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError);
+        _class_call_check$u(this, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError);
         return _call_super$5(this, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, [
             "This user has no setup configuration available."
         ]);
@@ -818,11 +818,11 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthNewUserSendSetupDetailsThrottleError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthNewUserSendSetupDetailsThrottleError, BaseError);
     function FirebaseServerAuthNewUserSendSetupDetailsThrottleError(lastSentAt) {
-        _class_call_check$r(this, FirebaseServerAuthNewUserSendSetupDetailsThrottleError);
+        _class_call_check$u(this, FirebaseServerAuthNewUserSendSetupDetailsThrottleError);
         var _this;
         _this = _call_super$5(this, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, [
             "This user was recently sent details. Try again later."
-        ]), _define_property$y(_this, "lastSentAt", void 0);
+        ]), _define_property$B(_this, "lastSentAt", void 0);
         _this.lastSentAt = lastSentAt;
         return _this;
     }
@@ -834,7 +834,7 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthNewUserSendSetupDetailsSendOnceError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, BaseError);
     function FirebaseServerAuthNewUserSendSetupDetailsSendOnceError() {
-        _class_call_check$r(this, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError);
+        _class_call_check$u(this, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError);
         return _call_super$5(this, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, [
             "The user has been sent details before and the sendSetupDetailsOnce configuration was true."
         ]);
@@ -848,7 +848,7 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthPasswordResetNoResetConfigError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthPasswordResetNoResetConfigError, BaseError);
     function FirebaseServerAuthPasswordResetNoResetConfigError() {
-        _class_call_check$r(this, FirebaseServerAuthPasswordResetNoResetConfigError);
+        _class_call_check$u(this, FirebaseServerAuthPasswordResetNoResetConfigError);
         return _call_super$5(this, FirebaseServerAuthPasswordResetNoResetConfigError, [
             "This user has no active password reset configuration."
         ]);
@@ -861,11 +861,11 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthPasswordResetThrottleError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthPasswordResetThrottleError, BaseError);
     function FirebaseServerAuthPasswordResetThrottleError(lastSentAt) {
-        _class_call_check$r(this, FirebaseServerAuthPasswordResetThrottleError);
+        _class_call_check$u(this, FirebaseServerAuthPasswordResetThrottleError);
         var _this;
         _this = _call_super$5(this, FirebaseServerAuthPasswordResetThrottleError, [
             "This user was recently sent password reset details. Try again later."
-        ]), _define_property$y(_this, "lastSentAt", void 0);
+        ]), _define_property$B(_this, "lastSentAt", void 0);
         _this.lastSentAt = lastSentAt;
         return _this;
     }
@@ -877,7 +877,7 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthPasswordResetSendOnceError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthPasswordResetSendOnceError, BaseError);
     function FirebaseServerAuthPasswordResetSendOnceError() {
-        _class_call_check$r(this, FirebaseServerAuthPasswordResetSendOnceError);
+        _class_call_check$u(this, FirebaseServerAuthPasswordResetSendOnceError);
         return _call_super$5(this, FirebaseServerAuthPasswordResetSendOnceError, [
             "The user has been sent password reset details before and the sendResetDetailsOnce configuration was true."
         ]);
@@ -890,7 +890,7 @@ function _is_native_reflect_construct$5() {
  */ var FirebaseServerAuthPasswordResetInvalidCodeError = /*#__PURE__*/ function(BaseError) {
     _inherits$5(FirebaseServerAuthPasswordResetInvalidCodeError, BaseError);
     function FirebaseServerAuthPasswordResetInvalidCodeError() {
-        _class_call_check$r(this, FirebaseServerAuthPasswordResetInvalidCodeError);
+        _class_call_check$u(this, FirebaseServerAuthPasswordResetInvalidCodeError);
         return _call_super$5(this, FirebaseServerAuthPasswordResetInvalidCodeError, [
             "The provided reset password code is invalid or expired."
         ]);
@@ -899,16 +899,16 @@ function _is_native_reflect_construct$5() {
 } 
 (BaseError);
 
-function _array_like_to_array$e(arr, len) {
+function _array_like_to_array$h(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$4(arr) {
+function _array_with_holes$5(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$a(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$e(arr);
+function _array_without_holes$c(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$h(arr);
 }
 function _assert_this_initialized$4(self) {
     if (self === void 0) {
@@ -916,7 +916,7 @@ function _assert_this_initialized$4(self) {
     }
     return self;
 }
-function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -930,16 +930,16 @@ function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$g(fn) {
+function _async_to_generator$i(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -949,12 +949,12 @@ function _call_super$4(_this, derived, args) {
     derived = _get_prototype_of$4(derived);
     return _possible_constructor_return$4(_this, _is_native_reflect_construct$4() ? Reflect.construct(derived, args || [], _get_prototype_of$4(_this).constructor) : derived.apply(_this, args));
 }
-function _class_call_check$q(instance, Constructor) {
+function _class_call_check$t(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$g(target, props) {
+function _defineProperties$i(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -963,11 +963,11 @@ function _defineProperties$g(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$g(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$g(Constructor.prototype, protoProps);
+function _create_class$i(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$i(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$x(obj, key, value) {
+function _define_property$A(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -999,10 +999,10 @@ function _inherits$4(subClass, superClass) {
     });
     if (superClass) _set_prototype_of$4(subClass, superClass);
 }
-function _iterable_to_array$a(iter) {
+function _iterable_to_array$c(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$4(arr, i) {
+function _iterable_to_array_limit$5(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -1026,13 +1026,13 @@ function _iterable_to_array_limit$4(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$4() {
+function _non_iterable_rest$5() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$a() {
+function _non_iterable_spread$c() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$k(target) {
+function _object_spread$l(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -1042,7 +1042,7 @@ function _object_spread$k(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$x(target, key, source[key]);
+            _define_property$A(target, key, source[key]);
         });
     }
     return target;
@@ -1060,23 +1060,23 @@ function _set_prototype_of$4(o, p) {
     };
     return _set_prototype_of$4(o, p);
 }
-function _sliced_to_array$4(arr, i) {
-    return _array_with_holes$4(arr) || _iterable_to_array_limit$4(arr, i) || _unsupported_iterable_to_array$e(arr, i) || _non_iterable_rest$4();
+function _sliced_to_array$5(arr, i) {
+    return _array_with_holes$5(arr) || _iterable_to_array_limit$5(arr, i) || _unsupported_iterable_to_array$h(arr, i) || _non_iterable_rest$5();
 }
-function _to_consumable_array$a(arr) {
-    return _array_without_holes$a(arr) || _iterable_to_array$a(arr) || _unsupported_iterable_to_array$e(arr) || _non_iterable_spread$a();
+function _to_consumable_array$c(arr) {
+    return _array_without_holes$c(arr) || _iterable_to_array$c(arr) || _unsupported_iterable_to_array$h(arr) || _non_iterable_spread$c();
 }
 function _type_of$5(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$e(o, minLen) {
+function _unsupported_iterable_to_array$h(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$e(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$h(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$e(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$h(o, minLen);
 }
 function _is_native_reflect_construct$4() {
     try {
@@ -1086,7 +1086,7 @@ function _is_native_reflect_construct$4() {
         return !!result;
     })();
 }
-function _ts_generator$g(thisArg, body) {
+function _ts_generator$i(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1218,16 +1218,16 @@ function _ts_generator$g(thisArg, body) {
  */ var AbstractFirebaseServerAuthUserContext = /*#__PURE__*/ function() {
     function AbstractFirebaseServerAuthUserContext(service, uid) {
         var _this = this;
-        _class_call_check$q(this, AbstractFirebaseServerAuthUserContext);
-        _define_property$x(this, "_service", void 0);
-        _define_property$x(this, "_uid", void 0);
-        _define_property$x(this, "_loadRecord", cachedGetter(function() {
+        _class_call_check$t(this, AbstractFirebaseServerAuthUserContext);
+        _define_property$A(this, "_service", void 0);
+        _define_property$A(this, "_uid", void 0);
+        _define_property$A(this, "_loadRecord", cachedGetter(function() {
             return _this._service.auth.getUser(_this._uid);
         }));
         this._service = service;
         this._uid = uid;
     }
-    _create_class$g(AbstractFirebaseServerAuthUserContext, [
+    _create_class$i(AbstractFirebaseServerAuthUserContext, [
         {
             key: "service",
             get: function get() {
@@ -1243,8 +1243,8 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "exists",
             value: function exists() {
-                return _async_to_generator$g(function() {
-                    return _ts_generator$g(this, function(_state) {
+                return _async_to_generator$i(function() {
+                    return _ts_generator$i(this, function(_state) {
                         return [
                             2,
                             getAuthUserOrUndefined(this._loadRecord()).then(Boolean)
@@ -1281,9 +1281,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "beginResetPassword",
             value: function beginResetPassword(options) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var _ref, password, now, expiresInMs, expiresAt, _obj, passwordClaimsData;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 password = this._generateResetPasswordKey();
@@ -1291,7 +1291,7 @@ function _ts_generator$g(thisArg, body) {
                                 // An explicit per-call lifetime wins over the context default; otherwise fall back to _resetCodeExpiresInMs().
                                 expiresInMs = (_ref = options === null || options === void 0 ? void 0 : options.resetCodeExpiresIn) !== null && _ref !== void 0 ? _ref : this._resetCodeExpiresInMs();
                                 expiresAt = new Date(now.getTime() + expiresInMs);
-                                passwordClaimsData = (_obj = {}, _define_property$x(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, password), _define_property$x(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, toISODateString(now)), _define_property$x(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, toISODateString(expiresAt)), _obj);
+                                passwordClaimsData = (_obj = {}, _define_property$A(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, password), _define_property$A(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, toISODateString(now)), _define_property$A(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, toISODateString(expiresAt)), _obj);
                                 // set the claims
                                 return [
                                     4,
@@ -1322,9 +1322,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadResetPasswordClaims",
             value: function loadResetPasswordClaims() {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var claims, result;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1346,9 +1346,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "setPassword",
             value: function setPassword(password) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var record, _obj;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1362,7 +1362,7 @@ function _ts_generator$g(thisArg, body) {
                                 // clear password reset claims
                                 return [
                                     4,
-                                    this.updateClaims((_obj = {}, _define_property$x(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, null), _define_property$x(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, null), _define_property$x(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, null), _obj))
+                                    this.updateClaims((_obj = {}, _define_property$A(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, null), _define_property$A(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, null), _define_property$A(_obj, FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, null), _obj))
                                 ];
                             case 2:
                                 _state.sent();
@@ -1378,9 +1378,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "updateUser",
             value: function updateUser(template) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var e, firebaseError, errorCode, email, phoneNumber;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 _state.trys.push([
@@ -1423,9 +1423,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadRoles",
             value: function loadRoles() {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var claims;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1446,9 +1446,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "addRoles",
             value: function addRoles(roles) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var claims;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         claims = this._claimsForRolesChange(roles);
                         return [
                             2,
@@ -1461,14 +1461,14 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "removeRoles",
             value: function removeRoles(roles) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var baseClaims, claims;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         baseClaims = this._claimsForRolesChange(roles);
                         claims = {};
                         forEachKeyValue(baseClaims, {
                             forEach: function forEach(param) {
-                                var _param = _sliced_to_array$4(param, 1), key = _param[0];
+                                var _param = _sliced_to_array$5(param, 1), key = _param[0];
                                 claims[key] = null; // set null on every key
                             },
                             filter: KeyValueTypleValueFilter.NONE // don't skip any key/value
@@ -1499,10 +1499,10 @@ function _ts_generator$g(thisArg, body) {
      * await userCtx.setRoles([AUTH_ADMIN_ROLE], { customFlag: 1 });
      * ```
      */ function setRoles(roles, claimsToRetain) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var claims;
-                    return _ts_generator$g(this, function(_state) {
-                        claims = _object_spread$k({}, claimsToRetain, this._claimsForRolesChange(_to_consumable_array$a(roles)));
+                    return _ts_generator$i(this, function(_state) {
+                        claims = _object_spread$l({}, claimsToRetain, this._claimsForRolesChange(_to_consumable_array$c(roles)));
                         return [
                             2,
                             this.setClaims(claims)
@@ -1535,9 +1535,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "updateClaims",
             value: function updateClaims(claims) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var currentClaims, newClaims;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1546,7 +1546,7 @@ function _ts_generator$g(thisArg, body) {
                                 ];
                             case 1:
                                 currentClaims = _state.sent();
-                                newClaims = _object_spread$k({}, currentClaims, filterUndefinedValues(claims, false));
+                                newClaims = _object_spread$l({}, currentClaims, filterUndefinedValues(claims, false));
                                 newClaims = filterNullAndUndefinedValues(newClaims);
                                 return [
                                     2,
@@ -1586,25 +1586,25 @@ function _ts_generator$g(thisArg, body) {
  */ var AbstractFirebaseServerAuthContext = /*#__PURE__*/ function() {
     function AbstractFirebaseServerAuthContext(service, context) {
         var _this = this;
-        _class_call_check$q(this, AbstractFirebaseServerAuthContext);
-        _define_property$x(this, "_service", void 0);
-        _define_property$x(this, "_context", void 0);
-        _define_property$x(this, "_authRoles", cachedGetter(function() {
+        _class_call_check$t(this, AbstractFirebaseServerAuthContext);
+        _define_property$A(this, "_service", void 0);
+        _define_property$A(this, "_context", void 0);
+        _define_property$A(this, "_authRoles", cachedGetter(function() {
             return _this.service.readRoles(_this.claims);
         }));
-        _define_property$x(this, "_isAdmin", cachedGetter(function() {
+        _define_property$A(this, "_isAdmin", cachedGetter(function() {
             return _this.service.isAdminInRoles(_this._authRoles());
         }));
-        _define_property$x(this, "_hasSignedTos", cachedGetter(function() {
+        _define_property$A(this, "_hasSignedTos", cachedGetter(function() {
             return _this.service.hasSignedTosInRoles(_this._authRoles());
         }));
-        _define_property$x(this, "_userContext", cachedGetter(function() {
+        _define_property$A(this, "_userContext", cachedGetter(function() {
             return _this.service.userContext(_this.context.auth.uid);
         }));
         this._service = service;
         this._context = context;
     }
-    _create_class$g(AbstractFirebaseServerAuthContext, [
+    _create_class$i(AbstractFirebaseServerAuthContext, [
         {
             key: "service",
             get: function get() {
@@ -1704,15 +1704,15 @@ function _ts_generator$g(thisArg, body) {
  * ```
  */ var AbstractFirebaseServerNewUserService = /*#__PURE__*/ function() {
     function AbstractFirebaseServerNewUserService(authService) {
-        _class_call_check$q(this, AbstractFirebaseServerNewUserService);
-        _define_property$x(this, "_authService", void 0);
+        _class_call_check$t(this, AbstractFirebaseServerNewUserService);
+        _define_property$A(this, "_authService", void 0);
         /**
      * Minimum time between setup content sends. Defaults to {@link DEFAULT_SETUP_COM_THROTTLE_TIME} (1 hour).
      * Override in subclasses to customize the throttle window.
-     */ _define_property$x(this, "setupThrottleTime", DEFAULT_SETUP_COM_THROTTLE_TIME);
+     */ _define_property$A(this, "setupThrottleTime", DEFAULT_SETUP_COM_THROTTLE_TIME);
         this._authService = authService;
     }
-    _create_class$g(AbstractFirebaseServerNewUserService, [
+    _create_class$i(AbstractFirebaseServerNewUserService, [
         {
             key: "authService",
             get: function get() {
@@ -1722,9 +1722,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "initializeNewUser",
             value: function initializeNewUser(input) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var uid, email, phone, sendSetupContent, sendSetupContentIfUserExists, sendSetupDetailsOnce, sendSetupIgnoreThrottle, sendSetupThrowErrors, data, sendDetailsInTestEnvironment, userRecordPromise, userRecord, userRecordId, createdUser, createResult, userContext, sentEmail, userContext1;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 uid = input.uid, email = input.email, phone = input.phone, sendSetupContent = input.sendSetupContent, sendSetupContentIfUserExists = input.sendSetupContentIfUserExists, sendSetupDetailsOnce = input.sendSetupDetailsOnce, sendSetupIgnoreThrottle = input.sendSetupIgnoreThrottle, sendSetupThrowErrors = input.sendSetupThrowErrors, data = input.data, sendDetailsInTestEnvironment = input.sendDetailsInTestEnvironment;
@@ -1819,16 +1819,16 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "addNewUserSetupClaims",
             value: function addNewUserSetupClaims(userContextOrUid, setupPassword) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var password, userContext;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 password = setupPassword !== null && setupPassword !== void 0 ? setupPassword : this.generateRandomSetupPassword();
                                 userContext = userContextFromUid(this.authService, userContextOrUid);
                                 return [
                                     4,
-                                    userContext.updateClaims(_define_property$x({}, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, password))
+                                    userContext.updateClaims(_define_property$A({}, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, password))
                                 ];
                             case 1:
                                 _state.sent();
@@ -1844,9 +1844,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "sendSetupContent",
             value: function sendSetupContent(userContextOrUid, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var setupDetails, sentContent, setupCommunicationAt, hasSentCommunication, lastSentAt, sendIsThrottled;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1927,9 +1927,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadSetupDetails",
             value: function loadSetupDetails(userContextOrUid, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var userContext, userExists, details;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 userContext = userContextFromUid(this.authService, userContextOrUid);
@@ -1963,9 +1963,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadSetupDetailsForUserContext",
             value: function loadSetupDetailsForUserContext(userContext, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var details, _ref, setupPassword, setupCommunicationAt;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -2001,9 +2001,9 @@ function _ts_generator$g(thisArg, body) {
      *
      * @param details - The user's setup details containing the user context.
      */ function updateSetupContentSentTime(details) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var setupCommunicationAt;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 setupCommunicationAt = toISODateString(new Date());
@@ -2026,9 +2026,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "markUserSetupAsComplete",
             value: function markUserSetupAsComplete(uid) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var userContext, userExists;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 userContext = this.authService.userContext(uid);
@@ -2070,9 +2070,9 @@ function _ts_generator$g(thisArg, body) {
      * @returns The created user record and the setup password used.
      * @throws {Error} Throws if the Firebase Admin SDK rejects the user creation.
      */ function createNewUser(input) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var uid, displayName, email, phoneNumber, inputPassword, password, user, e, firebaseError, errorCode;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 uid = input.uid, displayName = input.displayName, email = input.email, phoneNumber = input.phone, inputPassword = input.setupPassword;
@@ -2139,14 +2139,14 @@ function _ts_generator$g(thisArg, body) {
      *
      * @param userContext - The user context to clear setup claims from.
      */ function updateClaimsToClearUser(userContext) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var _obj;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
                                     4,
-                                    userContext.updateClaims((_obj = {}, _define_property$x(_obj, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, null), _define_property$x(_obj, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, null), _obj))
+                                    userContext.updateClaims((_obj = {}, _define_property$A(_obj, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, null), _define_property$A(_obj, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, null), _obj))
                                 ];
                             case 1:
                                 _state.sent();
@@ -2168,15 +2168,15 @@ function _ts_generator$g(thisArg, body) {
  */ var NoSetupContentFirebaseServerNewUserService = /*#__PURE__*/ function(AbstractFirebaseServerNewUserService) {
     _inherits$4(NoSetupContentFirebaseServerNewUserService, AbstractFirebaseServerNewUserService);
     function NoSetupContentFirebaseServerNewUserService() {
-        _class_call_check$q(this, NoSetupContentFirebaseServerNewUserService);
+        _class_call_check$t(this, NoSetupContentFirebaseServerNewUserService);
         return _call_super$4(this, NoSetupContentFirebaseServerNewUserService, arguments);
     }
-    _create_class$g(NoSetupContentFirebaseServerNewUserService, [
+    _create_class$i(NoSetupContentFirebaseServerNewUserService, [
         {
             key: "sendSetupContentToUser",
             value: function sendSetupContentToUser(_details) {
-                return _async_to_generator$g(function() {
-                    return _ts_generator$g(this, function(_state) {
+                return _async_to_generator$i(function() {
+                    return _ts_generator$i(this, function(_state) {
                         return [
                             2
                         ];
@@ -2261,15 +2261,15 @@ function _ts_generator$g(thisArg, body) {
  * ```
  */ var AbstractFirebaseServerUserPasswordResetService = /*#__PURE__*/ function() {
     function AbstractFirebaseServerUserPasswordResetService(authService) {
-        _class_call_check$q(this, AbstractFirebaseServerUserPasswordResetService);
-        _define_property$x(this, "_authService", void 0);
+        _class_call_check$t(this, AbstractFirebaseServerUserPasswordResetService);
+        _define_property$A(this, "_authService", void 0);
         /**
      * Minimum time between reset content sends. Defaults to {@link DEFAULT_RESET_COM_THROTTLE_TIME} (1 hour).
      * Override in subclasses to customize the throttle window.
-     */ _define_property$x(this, "resetThrottleTime", DEFAULT_RESET_COM_THROTTLE_TIME);
+     */ _define_property$A(this, "resetThrottleTime", DEFAULT_RESET_COM_THROTTLE_TIME);
         this._authService = authService;
     }
-    _create_class$g(AbstractFirebaseServerUserPasswordResetService, [
+    _create_class$i(AbstractFirebaseServerUserPasswordResetService, [
         {
             key: "authService",
             get: function get() {
@@ -2279,9 +2279,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "beginPasswordReset",
             value: function beginPasswordReset(input) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var uid, email, sendResetContent, sendResetDetailsOnce, sendResetIgnoreThrottle, sendResetThrowErrors, data, sendDetailsInTestEnvironment, resetCodeExpiresIn, resolvedUid, userRecord, userContext, claims, oobCode;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 uid = input.uid, email = input.email, sendResetContent = input.sendResetContent, sendResetDetailsOnce = input.sendResetDetailsOnce, sendResetIgnoreThrottle = input.sendResetIgnoreThrottle, sendResetThrowErrors = input.sendResetThrowErrors, data = input.data, sendDetailsInTestEnvironment = input.sendDetailsInTestEnvironment, resetCodeExpiresIn = input.resetCodeExpiresIn;
@@ -2359,9 +2359,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "sendResetContent",
             value: function sendResetContent(uid, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var resetDetails, sentContent, resetCommunicationAt, hasSentCommunication, lastSentAt, sendIsThrottled;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -2440,9 +2440,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadResetDetails",
             value: function loadResetDetails(uid, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var userContext, userExists, details;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 userContext = this.authService.userContext(uid);
@@ -2476,9 +2476,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "loadResetDetailsForUserContext",
             value: function loadResetDetailsForUserContext(userContext, config) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var details, claims;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -2516,15 +2516,15 @@ function _ts_generator$g(thisArg, body) {
      *
      * @param details - The user's reset details containing the user context.
      */ function updateResetContentSentTime(details) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var resetCommunicationAt;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 resetCommunicationAt = toISODateString(new Date());
                                 return [
                                     4,
-                                    details.userContext.updateClaims(_define_property$x({}, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, resetCommunicationAt))
+                                    details.userContext.updateClaims(_define_property$A({}, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, resetCommunicationAt))
                                 ];
                             case 1:
                                 _state.sent();
@@ -2539,9 +2539,9 @@ function _ts_generator$g(thisArg, body) {
         {
             key: "completePasswordReset",
             value: function completePasswordReset(input) {
-                return _async_to_generator$g(function() {
+                return _async_to_generator$i(function() {
                     var decoded, userContext, claims, storedCode, expiresAt, storedBuf, inputBuf;
-                    return _ts_generator$g(this, function(_state) {
+                    return _ts_generator$i(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 // Decode the composite token. A malformed token is treated identically to every other
@@ -2610,15 +2610,15 @@ function _ts_generator$g(thisArg, body) {
  */ var NoContentFirebaseServerUserPasswordResetService = /*#__PURE__*/ function(AbstractFirebaseServerUserPasswordResetService) {
     _inherits$4(NoContentFirebaseServerUserPasswordResetService, AbstractFirebaseServerUserPasswordResetService);
     function NoContentFirebaseServerUserPasswordResetService() {
-        _class_call_check$q(this, NoContentFirebaseServerUserPasswordResetService);
+        _class_call_check$t(this, NoContentFirebaseServerUserPasswordResetService);
         return _call_super$4(this, NoContentFirebaseServerUserPasswordResetService, arguments);
     }
-    _create_class$g(NoContentFirebaseServerUserPasswordResetService, [
+    _create_class$i(NoContentFirebaseServerUserPasswordResetService, [
         {
             key: "sendPasswordResetContentToUser",
             value: function sendPasswordResetContentToUser(_details) {
-                return _async_to_generator$g(function() {
-                    return _ts_generator$g(this, function(_state) {
+                return _async_to_generator$i(function() {
+                    return _ts_generator$i(this, function(_state) {
                         return [
                             2
                         ];
@@ -2650,7 +2650,7 @@ function _ts_generator$g(thisArg, body) {
  * }
  * ```
  */ var FirebaseServerAuthService = function FirebaseServerAuthService() {
-    _class_call_check$q(this, FirebaseServerAuthService);
+    _class_call_check$t(this, FirebaseServerAuthService);
 };
 /**
  * Base implementation of {@link FirebaseServerAuthService} providing standard admin/ToS checks,
@@ -2681,11 +2681,11 @@ function _ts_generator$g(thisArg, body) {
  * ```
  */ var AbstractFirebaseServerAuthService = /*#__PURE__*/ function() {
     function AbstractFirebaseServerAuthService(auth) {
-        _class_call_check$q(this, AbstractFirebaseServerAuthService);
-        _define_property$x(this, "_auth", void 0);
+        _class_call_check$t(this, AbstractFirebaseServerAuthService);
+        _define_property$A(this, "_auth", void 0);
         this._auth = auth;
     }
-    _create_class$g(AbstractFirebaseServerAuthService, [
+    _create_class$i(AbstractFirebaseServerAuthService, [
         {
             key: "auth",
             get: function get() {
@@ -2783,7 +2783,7 @@ function _ts_generator$g(thisArg, body) {
 } 
 ();
 
-function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2797,22 +2797,22 @@ function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$f(fn) {
+function _async_to_generator$h(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$f(thisArg, body) {
+function _ts_generator$h(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2940,9 +2940,9 @@ function _ts_generator$f(thisArg, body) {
  * const userData = await assertSnapshotData(userDocument);
  * ```
  */ function assertSnapshotData(document, message) {
-    return _async_to_generator$f(function() {
+    return _async_to_generator$h(function() {
         var data;
-        return _ts_generator$f(this, function(_state) {
+        return _ts_generator$h(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -2974,9 +2974,9 @@ function _ts_generator$f(thisArg, body) {
  * @returns The document's snapshot data with `id` and `key` attached.
  * @throws {HttpsError} Throws a {@link modelNotAvailableError} (404) if the document has no data.
  */ function assertSnapshotDataWithKey(document, message) {
-    return _async_to_generator$f(function() {
+    return _async_to_generator$h(function() {
         var data;
-        return _ts_generator$f(this, function(_state) {
+        return _ts_generator$h(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -3000,9 +3000,9 @@ function _ts_generator$f(thisArg, body) {
  * @param message - Optional custom error message.
  * @throws {HttpsError} Throws a {@link modelNotAvailableError} (404) if the document does not exist.
  */ function assertDocumentExists(document, message) {
-    return _async_to_generator$f(function() {
+    return _async_to_generator$h(function() {
         var exists;
-        return _ts_generator$f(this, function(_state) {
+        return _ts_generator$h(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -3068,7 +3068,7 @@ function _ts_generator$f(thisArg, body) {
     });
 }
 
-function asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3082,22 +3082,22 @@ function asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$e(fn) {
+function _async_to_generator$g(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _instanceof$3(left, right) {
+function _instanceof$4(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -3105,7 +3105,7 @@ function _instanceof$3(left, right) {
         return left instanceof right;
     }
 }
-function _ts_generator$e(thisArg, body) {
+function _ts_generator$g(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3231,9 +3231,9 @@ function _ts_generator$e(thisArg, body) {
  *   enumeration-safe opaque response. Pass the caller's admin status here.
  * @returns The result of the function.
  */ function catchAndThrowPasswordResetServerErrors(fn, isAdmin) {
-    return _async_to_generator$e(function() {
+    return _async_to_generator$g(function() {
         var result, error;
-        return _ts_generator$e(this, function(_state) {
+        return _ts_generator$g(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -3254,13 +3254,13 @@ function _ts_generator$e(thisArg, body) {
                     ];
                 case 2:
                     error = _state.sent();
-                    if (_instanceof$3(error, FirebaseServerAuthPasswordResetInvalidCodeError)) {
+                    if (_instanceof$4(error, FirebaseServerAuthPasswordResetInvalidCodeError)) {
                         throw authServicePasswordResetInvalidCodeError();
-                    } else if (_instanceof$3(error, FirebaseServerAuthPasswordResetNoResetConfigError)) {
+                    } else if (_instanceof$4(error, FirebaseServerAuthPasswordResetNoResetConfigError)) {
                         throw isAdmin ? authServicePasswordResetNoConfigError() : authServicePasswordResetInvalidCodeError();
-                    } else if (_instanceof$3(error, FirebaseServerAuthPasswordResetSendOnceError)) {
+                    } else if (_instanceof$4(error, FirebaseServerAuthPasswordResetSendOnceError)) {
                         throw isAdmin ? authServicePasswordResetSendOnceError() : authServicePasswordResetInvalidCodeError();
-                    } else if (_instanceof$3(error, FirebaseServerAuthPasswordResetThrottleError)) {
+                    } else if (_instanceof$4(error, FirebaseServerAuthPasswordResetThrottleError)) {
                         throw authServicePasswordResetThrottleError();
                     }
                     throw error;
@@ -3367,7 +3367,7 @@ function _ts_generator$e(thisArg, body) {
     ];
 }
 
-function _class_call_check$p(instance, Constructor) {
+function _class_call_check$s(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
@@ -3379,7 +3379,7 @@ function _class_call_check$p(instance, Constructor) {
  * Implementations are typically injected via {@link FIREBASE_SERVER_ENV_TOKEN} and
  * backed by a {@link FirebaseServerEnvironmentConfig}.
  */ var FirebaseServerEnvService = function FirebaseServerEnvService() {
-    _class_call_check$p(this, FirebaseServerEnvService);
+    _class_call_check$s(this, FirebaseServerEnvService);
 } 
 ;
 
@@ -3406,15 +3406,15 @@ function _class_call_check$p(instance, Constructor) {
     });
 }
 
-function _array_like_to_array$d(arr, len) {
+function _array_like_to_array$g(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$9(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$d(arr);
+function _array_without_holes$b(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$g(arr);
 }
-function _define_property$w(obj, key, value) {
+function _define_property$z(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3427,13 +3427,13 @@ function _define_property$w(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$9(iter) {
+function _iterable_to_array$b(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$9() {
+function _non_iterable_spread$b() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$j(target) {
+function _object_spread$k(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3443,21 +3443,21 @@ function _object_spread$j(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$w(target, key, source[key]);
+            _define_property$z(target, key, source[key]);
         });
     }
     return target;
 }
-function _to_consumable_array$9(arr) {
-    return _array_without_holes$9(arr) || _iterable_to_array$9(arr) || _unsupported_iterable_to_array$d(arr) || _non_iterable_spread$9();
+function _to_consumable_array$b(arr) {
+    return _array_without_holes$b(arr) || _iterable_to_array$b(arr) || _unsupported_iterable_to_array$g(arr) || _non_iterable_spread$b();
 }
-function _unsupported_iterable_to_array$d(o, minLen) {
+function _unsupported_iterable_to_array$g(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$d(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$g(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$d(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$g(o, minLen);
 }
 /**
  * Converts a {@link FirestoreAccessorArrayUpdate} into Firestore {@link UpdateData} using
@@ -3483,23 +3483,23 @@ function _unsupported_iterable_to_array$d(o, minLen) {
             result = mapObjectMap(fieldUpdate, function(arrayUpdate) {
                 var result;
                 if (arrayUpdate) {
-                    result = arrayUpdateFunction.apply(void 0, _to_consumable_array$9(arrayUpdate)); // use spread operator to insert each value as an argument, as "nested arrays" are not allowed in the Firestore
+                    result = arrayUpdateFunction.apply(void 0, _to_consumable_array$b(arrayUpdate)); // use spread operator to insert each value as an argument, as "nested arrays" are not allowed in the Firestore
                 }
                 return result;
             });
         }
         return result;
     }
-    var updateData = _object_spread$j({}, createUpdatesWithArrayFunction(union, FieldValue.arrayUnion), createUpdatesWithArrayFunction(remove, FieldValue.arrayRemove));
+    var updateData = _object_spread$k({}, createUpdatesWithArrayFunction(union, FieldValue.arrayUnion), createUpdatesWithArrayFunction(remove, FieldValue.arrayRemove));
     return updateData;
 }
 
-function _class_call_check$o(instance, Constructor) {
+function _class_call_check$r(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$f(target, props) {
+function _defineProperties$h(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3508,11 +3508,11 @@ function _defineProperties$f(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$f(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$f(Constructor.prototype, protoProps);
+function _create_class$h(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$h(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$v(obj, key, value) {
+function _define_property$y(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3534,13 +3534,13 @@ function _define_property$v(obj, key, value) {
  * (get, exists) bypass the batch and read directly from Firestore.
  */ var WriteBatchFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
     function WriteBatchFirestoreDocumentDataAccessor(batch, documentRef) {
-        _class_call_check$o(this, WriteBatchFirestoreDocumentDataAccessor);
-        _define_property$v(this, "documentRef", void 0);
-        _define_property$v(this, "_batch", void 0);
+        _class_call_check$r(this, WriteBatchFirestoreDocumentDataAccessor);
+        _define_property$y(this, "documentRef", void 0);
+        _define_property$y(this, "_batch", void 0);
         this.documentRef = documentRef;
         this._batch = batch;
     }
-    _create_class$f(WriteBatchFirestoreDocumentDataAccessor, [
+    _create_class$h(WriteBatchFirestoreDocumentDataAccessor, [
         {
             key: "batch",
             get: function get() {
@@ -3652,14 +3652,14 @@ function _define_property$v(obj, key, value) {
  * All document accessors created from this context queue writes into the same batch.
  */ var WriteBatchFirestoreDocumentContext = /*#__PURE__*/ function() {
     function WriteBatchFirestoreDocumentContext(batch) {
-        _class_call_check$o(this, WriteBatchFirestoreDocumentContext);
-        _define_property$v(this, "_batch", void 0);
-        _define_property$v(this, "contextType", FirestoreDocumentContextType.BATCH);
-        _define_property$v(this, "accessorFactory", void 0);
+        _class_call_check$r(this, WriteBatchFirestoreDocumentContext);
+        _define_property$y(this, "_batch", void 0);
+        _define_property$y(this, "contextType", FirestoreDocumentContextType.BATCH);
+        _define_property$y(this, "accessorFactory", void 0);
         this._batch = batch;
         this.accessorFactory = writeBatchAccessorFactory(batch);
     }
-    _create_class$f(WriteBatchFirestoreDocumentContext, [
+    _create_class$h(WriteBatchFirestoreDocumentContext, [
         {
             key: "batch",
             get: function get() {
@@ -3678,12 +3678,12 @@ function _define_property$v(obj, key, value) {
     return new WriteBatchFirestoreDocumentContext(batch);
 }
 
-function _class_call_check$n(instance, Constructor) {
+function _class_call_check$q(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$e(target, props) {
+function _defineProperties$g(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3692,11 +3692,11 @@ function _defineProperties$e(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$e(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$e(Constructor.prototype, protoProps);
+function _create_class$g(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$g(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$u(obj, key, value) {
+function _define_property$x(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3717,11 +3717,11 @@ function _define_property$u(obj, key, value) {
  * batching or transactional context. Supports real-time streaming via `onSnapshot`.
  */ var DefaultFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
     function DefaultFirestoreDocumentDataAccessor(documentRef) {
-        _class_call_check$n(this, DefaultFirestoreDocumentDataAccessor);
-        _define_property$u(this, "_documentRef", void 0);
+        _class_call_check$q(this, DefaultFirestoreDocumentDataAccessor);
+        _define_property$x(this, "_documentRef", void 0);
         this._documentRef = documentRef;
     }
-    _create_class$e(DefaultFirestoreDocumentDataAccessor, [
+    _create_class$g(DefaultFirestoreDocumentDataAccessor, [
         {
             key: "documentRef",
             get: function get() {
@@ -3829,12 +3829,12 @@ function _define_property$u(obj, key, value) {
     };
 }
 
-function _class_call_check$m(instance, Constructor) {
+function _class_call_check$p(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$d(target, props) {
+function _defineProperties$f(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3843,11 +3843,11 @@ function _defineProperties$d(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$d(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$d(Constructor.prototype, protoProps);
+function _create_class$f(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$f(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$t(obj, key, value) {
+function _define_property$w(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3869,13 +3869,13 @@ function _define_property$t(obj, key, value) {
  * consistency. Writes are committed atomically when the transaction completes.
  */ var TransactionFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
     function TransactionFirestoreDocumentDataAccessor(transaction, documentRef) {
-        _class_call_check$m(this, TransactionFirestoreDocumentDataAccessor);
-        _define_property$t(this, "_transaction", void 0);
-        _define_property$t(this, "_documentRef", void 0);
+        _class_call_check$p(this, TransactionFirestoreDocumentDataAccessor);
+        _define_property$w(this, "_transaction", void 0);
+        _define_property$w(this, "_documentRef", void 0);
         this._transaction = transaction;
         this._documentRef = documentRef;
     }
-    _create_class$d(TransactionFirestoreDocumentDataAccessor, [
+    _create_class$f(TransactionFirestoreDocumentDataAccessor, [
         {
             key: "transaction",
             get: function get() {
@@ -3994,14 +3994,14 @@ function _define_property$t(obj, key, value) {
  * All document accessors created from this context operate within the same transaction.
  */ var TransactionFirestoreDocumentContext = /*#__PURE__*/ function() {
     function TransactionFirestoreDocumentContext(transaction) {
-        _class_call_check$m(this, TransactionFirestoreDocumentContext);
-        _define_property$t(this, "_transaction", void 0);
-        _define_property$t(this, "contextType", FirestoreDocumentContextType.TRANSACTION);
-        _define_property$t(this, "accessorFactory", void 0);
+        _class_call_check$p(this, TransactionFirestoreDocumentContext);
+        _define_property$w(this, "_transaction", void 0);
+        _define_property$w(this, "contextType", FirestoreDocumentContextType.TRANSACTION);
+        _define_property$w(this, "accessorFactory", void 0);
         this._transaction = transaction;
         this.accessorFactory = transactionAccessorFactory(transaction);
     }
-    _create_class$d(TransactionFirestoreDocumentContext, [
+    _create_class$f(TransactionFirestoreDocumentContext, [
         {
             key: "transaction",
             get: function get() {
@@ -4020,15 +4020,15 @@ function _define_property$t(obj, key, value) {
     return new TransactionFirestoreDocumentContext(transaction);
 }
 
-function _array_like_to_array$c(arr, len) {
+function _array_like_to_array$f(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$3(arr) {
+function _array_with_holes$4(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4042,22 +4042,22 @@ function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$d(fn) {
+function _async_to_generator$f(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _iterable_to_array_limit$3(arr, i) {
+function _iterable_to_array_limit$4(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -4081,21 +4081,21 @@ function _iterable_to_array_limit$3(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$3() {
+function _non_iterable_rest$4() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$3(arr, i) {
-    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$c(arr, i) || _non_iterable_rest$3();
+function _sliced_to_array$4(arr, i) {
+    return _array_with_holes$4(arr) || _iterable_to_array_limit$4(arr, i) || _unsupported_iterable_to_array$f(arr, i) || _non_iterable_rest$4();
 }
-function _unsupported_iterable_to_array$c(o, minLen) {
+function _unsupported_iterable_to_array$f(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$c(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$f(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$c(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$f(o, minLen);
 }
-function _ts_generator$d(thisArg, body) {
+function _ts_generator$f(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4218,7 +4218,7 @@ function _ts_generator$d(thisArg, body) {
         }
         var batches = batch(pathSegments, 2); // batch to tuple [string, string]
         batches.forEach(function(x) {
-            var _x = _sliced_to_array$3(x, 2), first = _x[0], second = _x[1];
+            var _x = _sliced_to_array$4(x, 2), first = _x[0], second = _x[1];
             ref = ref.doc(first).collection(second);
         });
     }
@@ -4245,7 +4245,7 @@ function _ts_generator$d(thisArg, body) {
     if (pathSegments === null || pathSegments === void 0 ? void 0 : pathSegments.length) {
         var batches = batch(pathSegments, 2); // batch to tuple [string, string]
         batches.forEach(function(x) {
-            var _x = _sliced_to_array$3(x, 2), first = _x[0], second = _x[1];
+            var _x = _sliced_to_array$4(x, 2), first = _x[0], second = _x[1];
             var collection = doc.collection(first);
             doc = second ? collection.doc(second) : collection.doc();
         });
@@ -4292,8 +4292,8 @@ function _ts_generator$d(thisArg, body) {
         },
         transactionFactoryForFirestore: function transactionFactoryForFirestore(firestore) {
             return function(fn) {
-                return _async_to_generator$d(function() {
-                    return _ts_generator$d(this, function(_state) {
+                return _async_to_generator$f(function() {
+                    return _ts_generator$f(this, function(_state) {
                         return [
                             2,
                             firestore.runTransaction(fn)
@@ -4313,15 +4313,15 @@ function _ts_generator$d(thisArg, body) {
     };
 }
 
-function _array_like_to_array$b(arr, len) {
+function _array_like_to_array$e(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$8(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$b(arr);
+function _array_without_holes$a(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$e(arr);
 }
-function _define_property$s(obj, key, value) {
+function _define_property$v(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4334,13 +4334,13 @@ function _define_property$s(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$8(iter) {
+function _iterable_to_array$a(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$8() {
+function _non_iterable_spread$a() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$i(target) {
+function _object_spread$j(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4350,12 +4350,12 @@ function _object_spread$i(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$s(target, key, source[key]);
+            _define_property$v(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$d(object, enumerableOnly) {
+function ownKeys$f(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -4363,27 +4363,27 @@ function ownKeys$d(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$d(target, source) {
+function _object_spread_props$f(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$d(Object(source)).forEach(function(key) {
+        ownKeys$f(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _to_consumable_array$8(arr) {
-    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$b(arr) || _non_iterable_spread$8();
+function _to_consumable_array$a(arr) {
+    return _array_without_holes$a(arr) || _iterable_to_array$a(arr) || _unsupported_iterable_to_array$e(arr) || _non_iterable_spread$a();
 }
-function _unsupported_iterable_to_array$b(o, minLen) {
+function _unsupported_iterable_to_array$e(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$b(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$e(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$b(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$e(o, minLen);
 }
 var _builder, _builder1;
 var _obj;
@@ -4391,31 +4391,31 @@ var _obj;
  * Maps each abstract query constraint type to its Google Cloud Firestore implementation.
  *
  * Used by {@link firestoreClientQueryConstraintFunctionsDriver} to build the server-side query driver.
- */ var FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING = (_obj = {}, _define_property$s(_obj, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+ */ var FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING = (_obj = {}, _define_property$v(_obj, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.limit(data.limit);
-}), _define_property$s(_obj, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.limitToLast(data.limit);
-}), _define_property$s(_obj, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.orderBy(data.fieldPath, data.directionStr);
-}), _define_property$s(_obj, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.orderBy(FieldPath.documentId(), data.directionStr);
-}), _define_property$s(_obj, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.where(data.fieldPath, data.opStr, data.value);
-}), _define_property$s(_obj, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.where(FieldPath.documentId(), data.opStr, data.value);
-}), _define_property$s(_obj, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.offset(data.offset);
-}), _define_property$s(_obj, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.startAt(data.snapshot);
-}), _define_property$s(_obj, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return (_builder = builder).startAt.apply(_builder, _to_consumable_array$8(data.fieldValues));
-}), _define_property$s(_obj, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return (_builder = builder).startAt.apply(_builder, _to_consumable_array$a(data.fieldValues));
+}), _define_property$v(_obj, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.startAfter(data.snapshot);
-}), _define_property$s(_obj, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.endAt(data.snapshot);
-}), _define_property$s(_obj, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return (_builder1 = builder).endAt.apply(_builder1, _to_consumable_array$8(data.fieldValues));
-}), _define_property$s(_obj, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+}), _define_property$v(_obj, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return (_builder1 = builder).endAt.apply(_builder1, _to_consumable_array$a(data.fieldValues));
+}), _define_property$v(_obj, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
     return builder.endBefore(data.snapshot);
 }), _obj);
 /**
@@ -4453,7 +4453,7 @@ var _obj;
  * const queryDriver = googleCloudFirestoreQueryDriver();
  * ```
  */ function googleCloudFirestoreQueryDriver() {
-    return _object_spread_props$d(_object_spread$i({}, firestoreClientQueryConstraintFunctionsDriver()), {
+    return _object_spread_props$f(_object_spread$j({}, firestoreClientQueryConstraintFunctionsDriver()), {
         countDocs: function countDocs(query) {
             return query.count().get().then(function(x) {
                 return x.data().count;
@@ -4619,7 +4619,7 @@ typeof SuppressedError === "function" ? SuppressedError : function(error, suppre
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 };
 
-function _class_call_check$l(instance, Constructor) {
+function _class_call_check$o(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
@@ -4630,7 +4630,7 @@ function _class_call_check$l(instance, Constructor) {
  * Analogous to {@link DbxAnalyticsService} on the frontend.
  * Apps extend this class and provide it via {@link ON_CALL_MODEL_ANALYTICS_SERVICE}.
  */ var OnCallModelAnalyticsService = function OnCallModelAnalyticsService() {
-    _class_call_check$l(this, OnCallModelAnalyticsService);
+    _class_call_check$o(this, OnCallModelAnalyticsService);
 };
 /**
  * Default injection token for the analytics service.
@@ -4655,7 +4655,7 @@ function _class_call_check$l(instance, Constructor) {
  * @deprecated Use {@link ON_CALL_MODEL_ANALYTICS_SERVICE} instead.
  */ var ON_CALL_MODEL_ANALYTICS_HANDLER = ON_CALL_MODEL_ANALYTICS_SERVICE;
 
-function _class_call_check$k(instance, Constructor) {
+function _class_call_check$n(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
@@ -4665,7 +4665,7 @@ function _class_call_check$k(instance, Constructor) {
  * Events are forwarded from FirebaseServerAnalyticsService to this listener
  * for processing by an analytics provider (e.g., Segment).
  */ var FirebaseServerAnalyticsServiceListener = function FirebaseServerAnalyticsServiceListener() {
-    _class_call_check$k(this, FirebaseServerAnalyticsServiceListener);
+    _class_call_check$n(this, FirebaseServerAnalyticsServiceListener);
 };
 /**
  * Creates a default no-op {@link FirebaseServerAnalyticsServiceListener}.
@@ -4695,12 +4695,12 @@ function _call_super$3(_this, derived, args) {
     derived = _get_prototype_of$3(derived);
     return _possible_constructor_return$3(_this, _is_native_reflect_construct$3() ? Reflect.construct(derived, [], _get_prototype_of$3(_this).constructor) : derived.apply(_this, args));
 }
-function _class_call_check$j(instance, Constructor) {
+function _class_call_check$m(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$c(target, props) {
+function _defineProperties$e(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -4709,11 +4709,11 @@ function _defineProperties$c(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$c(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
+function _create_class$e(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$e(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$r(obj, key, value) {
+function _define_property$u(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4793,9 +4793,9 @@ function _is_native_reflect_construct$3() {
  */ var FirebaseServerAnalyticsService = /*#__PURE__*/ function(OnCallModelAnalyticsService) {
     _inherits$3(FirebaseServerAnalyticsService, OnCallModelAnalyticsService);
     function FirebaseServerAnalyticsService(listener) {
-        _class_call_check$j(this, FirebaseServerAnalyticsService);
+        _class_call_check$m(this, FirebaseServerAnalyticsService);
         var _this;
-        _this = _call_super$3(this, FirebaseServerAnalyticsService), _define_property$r(_this, "_listener", void 0);
+        _this = _call_super$3(this, FirebaseServerAnalyticsService), _define_property$u(_this, "_listener", void 0);
         if (listener) {
             _this._listener = listener;
         } else {
@@ -4804,7 +4804,7 @@ function _is_native_reflect_construct$3() {
         }
         return _this;
     }
-    _create_class$c(FirebaseServerAnalyticsService, [
+    _create_class$e(FirebaseServerAnalyticsService, [
         {
             key: "handleOnCallAnalyticsEvent",
             value: function handleOnCallAnalyticsEvent(event) {
@@ -4844,7 +4844,7 @@ FirebaseServerAnalyticsService = __decorate([
     __param(0, Inject(FirebaseServerAnalyticsServiceListener))
 ], FirebaseServerAnalyticsService);
 
-function asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4858,22 +4858,22 @@ function asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$c(fn) {
+function _async_to_generator$e(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$c(thisArg, body) {
+function _ts_generator$e(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5037,7 +5037,7 @@ function _ts_generator$c(thisArg, body) {
  * });
  * ```
  */ function callWithAnalytics(config) {
-    return _async_to_generator$c(function() {
+    return _async_to_generator$e(function() {
         var service, details, context, execute, result, emitter, error;
         function _safeCall(fn) {
             try {
@@ -5047,7 +5047,7 @@ function _ts_generator$c(thisArg, body) {
                 console.error("callWithAnalytics: Failed to emit analytics event:", error);
             }
         }
-        return _ts_generator$c(this, function(_state) {
+        return _ts_generator$e(this, function(_state) {
             switch(_state.label){
                 case 0:
                     service = config.service, details = config.details, context = config.context, execute = config.execute;
@@ -5106,15 +5106,15 @@ function _ts_generator$c(thisArg, body) {
     })();
 }
 
-function _array_like_to_array$a(arr, len) {
+function _array_like_to_array$d(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$2(arr) {
+function _array_with_holes$3(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _iterable_to_array_limit$2(arr, i) {
+function _iterable_to_array_limit$3(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -5138,7 +5138,7 @@ function _iterable_to_array_limit$2(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$2() {
+function _non_iterable_rest$3() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _object_without_properties(source, excluded) {
@@ -5177,16 +5177,16 @@ function _object_without_properties_loose(source, excluded) {
     }
     return target;
 }
-function _sliced_to_array$2(arr, i) {
-    return _array_with_holes$2(arr) || _iterable_to_array_limit$2(arr, i) || _unsupported_iterable_to_array$a(arr, i) || _non_iterable_rest$2();
+function _sliced_to_array$3(arr, i) {
+    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$d(arr, i) || _non_iterable_rest$3();
 }
-function _unsupported_iterable_to_array$a(o, minLen) {
+function _unsupported_iterable_to_array$d(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$a(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$d(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$a(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$d(o, minLen);
 }
 // MARK: Type Guards
 /**
@@ -5288,7 +5288,7 @@ function _unsupported_iterable_to_array$a(o, minLen) {
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
         for(var _iterator = Object.entries(config)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array$2(_step.value, 2), key = _step_value[0], handler = _step_value[1];
+            var _step_value = _sliced_to_array$3(_step.value, 2), key = _step_value[0], handler = _step_value[1];
             var details = readApiDetails(handler);
             if (details != null) {
                 // At the specifier level, details should be handler-level (OnCallModelFunctionApiDetails)
@@ -5328,7 +5328,7 @@ function _unsupported_iterable_to_array$a(o, minLen) {
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
         for(var _iterator = Object.entries(map)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array$2(_step.value, 2), key = _step_value[0], handler = _step_value[1];
+            var _step_value = _sliced_to_array$3(_step.value, 2), key = _step_value[0], handler = _step_value[1];
             var details = readApiDetails(handler);
             if (details != null) {
                 if (isOnCallModelTypeApiDetails(details)) {
@@ -5377,7 +5377,7 @@ function _unsupported_iterable_to_array$a(o, minLen) {
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
         for(var _iterator = Object.entries(map)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array$2(_step.value, 2), call = _step_value[0], handler = _step_value[1];
+            var _step_value = _sliced_to_array$3(_step.value, 2), call = _step_value[0], handler = _step_value[1];
             var details = readApiDetails(handler);
             if (details != null) {
                 result[call] = details;
@@ -5425,14 +5425,14 @@ function _unsupported_iterable_to_array$a(o, minLen) {
         try {
             // Pivot: iterate CRUD types, then model types within each
             for(var _iterator = Object.entries(topDetails)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                var _step_value = _sliced_to_array$2(_step.value, 2), callType = _step_value[0], crudDetails = _step_value[1];
+                var _step_value = _sliced_to_array$3(_step.value, 2), callType = _step_value[0], crudDetails = _step_value[1];
                 if (crudDetails == null) {
                     continue;
                 }
                 var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                 try {
                     for(var _iterator1 = Object.entries(crudDetails.modelTypes)[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                        var _step_value1 = _sliced_to_array$2(_step1.value, 2), modelType = _step_value1[0], modelDetails = _step_value1[1];
+                        var _step_value1 = _sliced_to_array$3(_step1.value, 2), modelType = _step_value1[0], modelDetails = _step_value1[1];
                         if (modelDetails == null) {
                             continue;
                         }
@@ -5702,7 +5702,7 @@ function resolveRequiredScopeFromApiDetails(apiDetails, call, modelType, specifi
     }));
 }
 
-function _define_property$q(obj, key, value) {
+function _define_property$t(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -5715,7 +5715,7 @@ function _define_property$q(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$h(target) {
+function _object_spread$i(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -5725,12 +5725,12 @@ function _object_spread$h(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$q(target, key, source[key]);
+            _define_property$t(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$c(object, enumerableOnly) {
+function ownKeys$e(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -5738,12 +5738,12 @@ function ownKeys$c(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$c(target, source) {
+function _object_spread_props$e(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$c(Object(source)).forEach(function(key) {
+        ownKeys$e(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -5822,7 +5822,7 @@ function _object_spread_props$c(target, source) {
         // Resolve the leaf handler's per-function requiredScope (if any) so the preAssert can enforce
         // it additively with the per-verb OIDC scope. Same call -> modelType -> specifier walk as analytics.
         var requiredScope = resolveRequiredScopeFromApiDetails(modelApiDetails, call, modelType, specifier);
-        preAssert(_object_spread_props$c(_object_spread$h({}, context), {
+        preAssert(_object_spread_props$e(_object_spread$i({}, context), {
             requiredScope: requiredScope
         }));
         var result;
@@ -5900,7 +5900,7 @@ function _object_spread_props$c(target, source) {
                 modelType: modelType,
                 specifier: specifier
             });
-            return crudFn(_object_spread_props$c(_object_spread$h({}, request), {
+            return crudFn(_object_spread_props$e(_object_spread$i({}, request), {
                 specifier: specifier,
                 data: request.data.data
             }));
@@ -6087,15 +6087,15 @@ function _object_spread_props$c(target, source) {
     }));
 }
 
-function _array_like_to_array$9(arr, len) {
+function _array_like_to_array$c(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$7(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$9(arr);
+function _array_without_holes$9(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$c(arr);
 }
-function asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -6109,39 +6109,39 @@ function asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$b(fn) {
+function _async_to_generator$d(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _iterable_to_array$7(iter) {
+function _iterable_to_array$9(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$7() {
+function _non_iterable_spread$9() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$7(arr) {
-    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$9(arr) || _non_iterable_spread$7();
+function _to_consumable_array$9(arr) {
+    return _array_without_holes$9(arr) || _iterable_to_array$9(arr) || _unsupported_iterable_to_array$c(arr) || _non_iterable_spread$9();
 }
-function _unsupported_iterable_to_array$9(o, minLen) {
+function _unsupported_iterable_to_array$c(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$9(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$c(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$9(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$c(o, minLen);
 }
-function _ts_generator$b(thisArg, body) {
+function _ts_generator$d(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -6344,9 +6344,9 @@ function _ts_generator$b(thisArg, body) {
  * };
  * ```
  */ function executeOnCallQuery(config) {
-    return _async_to_generator$b(function() {
+    return _async_to_generator$d(function() {
         var _collection, _params_limit, _resultDocs_at, params, collection, loadCursorDocument, buildConstraints, _config_maxLimit, maxLimit, mapResult, requestedLimit, effectiveLimit, constraints, cursorSnapshot, e, errorInfo, executableQuery, querySnapshot, docs, hasMore, resultDocs, results, keys, cursorDocumentKey;
-        return _ts_generator$b(this, function(_state) {
+        return _ts_generator$d(this, function(_state) {
             switch(_state.label){
                 case 0:
                     params = config.params, collection = config.collection, loadCursorDocument = config.loadCursorDocument, buildConstraints = config.buildConstraints, _config_maxLimit = config.maxLimit, maxLimit = _config_maxLimit === void 0 ? MAX_ON_CALL_QUERY_MODEL_LIMIT : _config_maxLimit, mapResult = config.mapResult;
@@ -6398,7 +6398,7 @@ function _ts_generator$b(thisArg, body) {
                     // Fetch one extra to detect hasMore
                     constraints.push(limit(effectiveLimit + 1));
                     // Execute via the collection's query factory
-                    executableQuery = (_collection = collection).query.apply(_collection, _to_consumable_array$7(constraints));
+                    executableQuery = (_collection = collection).query.apply(_collection, _to_consumable_array$9(constraints));
                     return [
                         4,
                         executableQuery.getDocs()
@@ -6475,30 +6475,30 @@ function _ts_generator$b(thisArg, body) {
     }));
 }
 
-function _array_like_to_array$8(arr, len) {
+function _array_like_to_array$b(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$6(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$8(arr);
+function _array_without_holes$8(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$b(arr);
 }
-function _iterable_to_array$6(iter) {
+function _iterable_to_array$8(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$6() {
+function _non_iterable_spread$8() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$6(arr) {
-    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$8(arr) || _non_iterable_spread$6();
-}
-function _unsupported_iterable_to_array$8(o, minLen) {
+function _to_consumable_array$8(arr) {
+    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$b(arr) || _non_iterable_spread$8();
+}
+function _unsupported_iterable_to_array$b(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$8(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$b(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$8(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$b(o, minLen);
 }
 /**
  * Generates NestJS {@link ModuleMetadata} for an app's analytics module.
@@ -6523,18 +6523,18 @@ function _unsupported_iterable_to_array$8(o, minLen) {
         dependencyModule
     ] : [];
     return {
-        imports: _to_consumable_array$6(dependencyModuleImport).concat(_to_consumable_array$6(imports !== null && imports !== void 0 ? imports : [])),
+        imports: _to_consumable_array$8(dependencyModuleImport).concat(_to_consumable_array$8(imports !== null && imports !== void 0 ? imports : [])),
         exports: [
             FirebaseServerAnalyticsService,
             ON_CALL_MODEL_ANALYTICS_SERVICE
-        ].concat(_to_consumable_array$6(exports !== null && exports !== void 0 ? exports : [])),
+        ].concat(_to_consumable_array$8(exports !== null && exports !== void 0 ? exports : [])),
         providers: [
             FirebaseServerAnalyticsService,
             {
                 provide: ON_CALL_MODEL_ANALYTICS_SERVICE,
                 useExisting: FirebaseServerAnalyticsService
             }
-        ].concat(_to_consumable_array$6(providers !== null && providers !== void 0 ? providers : []))
+        ].concat(_to_consumable_array$8(providers !== null && providers !== void 0 ? providers : []))
     };
 }
 
@@ -6548,12 +6548,12 @@ function _call_super$2(_this, derived, args) {
     derived = _get_prototype_of$2(derived);
     return _possible_constructor_return$2(_this, _is_native_reflect_construct$2() ? Reflect.construct(derived, [], _get_prototype_of$2(_this).constructor) : derived.apply(_this, args));
 }
-function _class_call_check$i(instance, Constructor) {
+function _class_call_check$l(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$b(target, props) {
+function _defineProperties$d(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -6562,11 +6562,11 @@ function _defineProperties$b(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$b(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
+function _create_class$d(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$d(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$p(obj, key, value) {
+function _define_property$s(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -6598,7 +6598,7 @@ function _inherits$2(subClass, superClass) {
     });
     if (superClass) _set_prototype_of$2(subClass, superClass);
 }
-function _object_spread$g(target) {
+function _object_spread$h(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -6608,12 +6608,12 @@ function _object_spread$g(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$p(target, key, source[key]);
+            _define_property$s(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$b(object, enumerableOnly) {
+function ownKeys$d(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -6621,12 +6621,12 @@ function ownKeys$b(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$b(target, source) {
+function _object_spread_props$d(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$b(Object(source)).forEach(function(key) {
+        ownKeys$d(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -6669,17 +6669,17 @@ function _is_native_reflect_construct$2() {
  */ var FirebaseServerAnalyticsSegmentListenerService = /*#__PURE__*/ function(FirebaseServerAnalyticsServiceListener) {
     _inherits$2(FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsServiceListener);
     function FirebaseServerAnalyticsSegmentListenerService(_segmentService) {
-        _class_call_check$i(this, FirebaseServerAnalyticsSegmentListenerService);
+        _class_call_check$l(this, FirebaseServerAnalyticsSegmentListenerService);
         var _this;
-        _this = _call_super$2(this, FirebaseServerAnalyticsSegmentListenerService), _define_property$p(_this, "_segmentService", void 0);
+        _this = _call_super$2(this, FirebaseServerAnalyticsSegmentListenerService), _define_property$s(_this, "_segmentService", void 0);
         _this._segmentService = _segmentService;
         return _this;
     }
-    _create_class$b(FirebaseServerAnalyticsSegmentListenerService, [
+    _create_class$d(FirebaseServerAnalyticsSegmentListenerService, [
         {
             key: "handleOnCallAnalyticsEvent",
             value: function handleOnCallAnalyticsEvent(event) {
-                var properties = _object_spread$g(_object_spread_props$b(_object_spread$g({}, asAnalyticsEventData(event.properties)), {
+                var properties = _object_spread$h(_object_spread_props$d(_object_spread$h({}, asAnalyticsEventData(event.properties)), {
                     call: event.call,
                     modelType: event.modelType,
                     lifecycle: event.lifecycle
@@ -6736,7 +6736,7 @@ FirebaseServerAnalyticsSegmentListenerService = __decorate([
     __param(0, Inject(SegmentService))
 ], FirebaseServerAnalyticsSegmentListenerService);
 
-function _class_call_check$h(instance, Constructor) {
+function _class_call_check$k(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
@@ -6746,7 +6746,7 @@ function _class_call_check$h(instance, Constructor) {
  *
  * This module provides the {@link FirebaseServerAnalyticsSegmentListenerService} as the {@link FirebaseServerAnalyticsServiceListener} implementation and exports {@link SegmentServiceModule} for use in the app.
  */ var FirebaseServerAnalyticsSegmentModule = function FirebaseServerAnalyticsSegmentModule() {
-    _class_call_check$h(this, FirebaseServerAnalyticsSegmentModule);
+    _class_call_check$k(this, FirebaseServerAnalyticsSegmentModule);
 };
 FirebaseServerAnalyticsSegmentModule = __decorate([
     Module({
@@ -6791,12 +6791,12 @@ FirebaseServerAnalyticsSegmentModule = __decorate([
     };
 }
 
-function _class_call_check$g(instance, Constructor) {
+function _class_call_check$j(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _define_property$o(obj, key, value) {
+function _define_property$r(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -6809,7 +6809,7 @@ function _define_property$o(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$f(target) {
+function _object_spread$g(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -6819,12 +6819,12 @@ function _object_spread$f(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$o(target, key, source[key]);
+            _define_property$r(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$a(object, enumerableOnly) {
+function ownKeys$c(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -6832,12 +6832,12 @@ function ownKeys$a(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$a(target, source) {
+function _object_spread_props$c(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$a(Object(source)).forEach(function(key) {
+        ownKeys$c(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -6850,7 +6850,7 @@ function _object_spread_props$a(target, source) {
 /**
  * Nest provider module for Firebase that provides a firestore, etc. from the firestore token.
  */ var FirebaseServerAuthModule = function FirebaseServerAuthModule() {
-    _class_call_check$g(this, FirebaseServerAuthModule);
+    _class_call_check$j(this, FirebaseServerAuthModule);
 };
 FirebaseServerAuthModule = __decorate([
     Module({
@@ -6890,7 +6890,7 @@ FirebaseServerAuthModule = __decorate([
  */ function provideFirebaseServerAuthService(provider) {
     var _provider_inject;
     return [
-        _object_spread_props$a(_object_spread$f({}, provider), {
+        _object_spread_props$c(_object_spread$g({}, provider), {
             inject: (_provider_inject = provider.inject) !== null && _provider_inject !== void 0 ? _provider_inject : [
                 FIREBASE_AUTH_TOKEN
             ]
@@ -7079,27 +7079,86 @@ FirebaseServerAuthModule = __decorate([
     return claims[FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY] != null;
 }
 
-// MARK: Scope Reading
 /**
- * Reads the set of OIDC scopes carried by a model-api request's auth, or `undefined` for a non-OIDC
+ * Error code thrown by {@link assertEndpointOidcScope} when an OIDC caller is missing the scope a
+ * non-model endpoint requires.
+ *
+ * Distinct from the callModel-layer code so a client can tell "you cannot call this endpoint" apart
+ * from "you cannot make this model call".
+ */ var MISSING_ENDPOINT_OIDC_SCOPE_ERROR_CODE = 'MISSING_ENDPOINT_OIDC_SCOPE_ERROR';
+/**
+ * Reads the set of OIDC scopes carried by an authenticated request, or `undefined` for a non-OIDC
  * (regular Firebase ID-token) caller.
  *
  * The OIDC bearer-token middleware attaches the validated access-token claims at
  * `auth.oidcValidatedToken` (with the space-delimited `scope` string); a non-OIDC caller has neither
- * that field nor a `scope` on `auth.token`. Reading is defensive (the auth shape is only typed as
- * {@link FirebaseServerAuthData} here — the OIDC-specific `oidcValidatedToken` lives in the
- * `@dereekb/firebase-server/oidc` sub-package this core layer cannot import), delegating the actual
- * parse to the shared {@link oidcScopesFromScopeClaim} so there is no drift with `getOidcScopesFromRequest`.
+ * that field nor a `scope` on `auth.token`. Reading is defensive — the auth shape is only typed as
+ * {@link FirebaseServerAuthData} here, since the OIDC-specific `oidcValidatedToken` lives in the
+ * `@dereekb/firebase-server/oidc` sub-package this core layer cannot import — and the actual parse is
+ * delegated to the shared {@link oidcScopesFromScopeClaim} so there is no drift with
+ * `getOidcScopesFromRequest`.
  *
  * @param auth - The request auth data, or undefined for unauthenticated requests.
  * @returns The granted scope set, or `undefined` when the request carries no OIDC `scope` claim.
- */ function oidcScopesFromModelApiAuth(auth) {
+ */ function oidcScopesFromRequestAuth(auth) {
     var _auth_oidcValidatedToken, _auth_token;
     var oidcScope = auth === null || auth === void 0 ? void 0 : (_auth_oidcValidatedToken = auth.oidcValidatedToken) === null || _auth_oidcValidatedToken === void 0 ? void 0 : _auth_oidcValidatedToken.scope;
     var tokenScope = auth === null || auth === void 0 ? void 0 : (_auth_token = auth.token) === null || _auth_token === void 0 ? void 0 : _auth_token.scope;
     var scope = oidcScope !== null && oidcScope !== void 0 ? oidcScope : tokenScope;
     return oidcScopesFromScopeClaim(scope);
 }
+/**
+ * Enforces a single OIDC scope requirement for a plain (non-callModel) endpoint, throwing a `403`
+ * when an OIDC caller does not hold it.
+ *
+ * The non-model counterpart to `assertModelApiOidcScope`, which is unusable outside the model API
+ * because it requires a `{ call, modelType }` pair. Evaluation reuses the same shipped
+ * {@link oidcScopeTermSatisfied} primitive so a term means the same thing on both surfaces.
+ *
+ * Bypasses (no-op) when `grantedScopes` is `undefined` — i.e. a non-OIDC caller carrying a plain
+ * Firebase ID token, which has no `scope` claim to enforce against. **This is why scope-gating alone
+ * is never a sufficient gate**: an endpoint that must reject non-admins needs its own admin check,
+ * with the scope acting as defence in depth.
+ *
+ * @param input - The required term, the caller's granted scopes, and the endpoint name for the message.
+ * @throws A `403` forbidden error (code {@link MISSING_ENDPOINT_OIDC_SCOPE_ERROR_CODE}) when an OIDC
+ *   caller does not satisfy the requirement.
+ */ function assertEndpointOidcScope(input) {
+    var requiredScope = input.requiredScope, grantedScopes = input.grantedScopes, endpoint = input.endpoint;
+    if (requiredScope != null && grantedScopes != null && !oidcScopeTermSatisfied(requiredScope, grantedScopes)) {
+        var required = Array.isArray(requiredScope) ? requiredScope : [
+            requiredScope
+        ];
+        throw forbiddenError({
+            status: 403,
+            code: MISSING_ENDPOINT_OIDC_SCOPE_ERROR_CODE,
+            message: "Missing required OIDC scope for ".concat(endpoint, ": ").concat(required.join(' | ')),
+            data: {
+                requiredScopes: required,
+                endpoint: endpoint
+            }
+        });
+    }
+}
+
+// MARK: Scope Reading
+/**
+ * Reads the set of OIDC scopes carried by a model-api request's auth, or `undefined` for a non-OIDC
+ * (regular Firebase ID-token) caller.
+ *
+ * The OIDC bearer-token middleware attaches the validated access-token claims at
+ * `auth.oidcValidatedToken` (with the space-delimited `scope` string); a non-OIDC caller has neither
+ * that field nor a `scope` on `auth.token`. Reading is defensive (the auth shape is only typed as
+ * {@link FirebaseServerAuthData} here — the OIDC-specific `oidcValidatedToken` lives in the
+ * `@dereekb/firebase-server/oidc` sub-package this core layer cannot import), delegating entirely to the
+ * shared {@link oidcScopesFromRequestAuth} so there is no drift with `getOidcScopesFromRequest` or with
+ * the non-model endpoints that read scopes the same way.
+ *
+ * @param auth - The request auth data, or undefined for unauthenticated requests.
+ * @returns The granted scope set, or `undefined` when the request carries no OIDC `scope` claim.
+ */ function oidcScopesFromModelApiAuth(auth) {
+    return oidcScopesFromRequestAuth(auth);
+}
 /**
  * Enforces the OIDC scope requirement for a single model-api op, throwing a `403`
  * {@link CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE} error when the caller does not satisfy it.
@@ -7151,7 +7210,7 @@ FirebaseServerAuthModule = __decorate([
     return typeof term === 'string' ? term : term.join('|');
 }
 
-function _define_property$n(obj, key, value) {
+function _define_property$q(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -7164,7 +7223,7 @@ function _define_property$n(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$e(target) {
+function _object_spread$f(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -7174,12 +7233,12 @@ function _object_spread$e(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$n(target, key, source[key]);
+            _define_property$q(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$9(object, enumerableOnly) {
+function ownKeys$b(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -7187,12 +7246,12 @@ function ownKeys$9(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$9(target, source) {
+function _object_spread_props$b(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$9(Object(source)).forEach(function(key) {
+        ownKeys$b(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -7209,7 +7268,7 @@ function _object_spread_props$9(target, source) {
  * @param request - The base request to augment (must include the nestApplication reference).
  * @returns A new object combining the request properties with the nest context.
  */ function injectNestIntoRequest(nest, request) {
-    return _object_spread_props$9(_object_spread$e({}, request), {
+    return _object_spread_props$b(_object_spread$f({}, request), {
         nest: nest
     });
 }
@@ -7223,12 +7282,12 @@ function _object_spread_props$9(target, source) {
  * @param request - The base request to augment.
  * @returns A new object combining the request properties with the application context.
  */ function injectNestApplicationContextIntoRequest(nestContext, request) {
-    return _object_spread_props$9(_object_spread$e({}, request), {
+    return _object_spread_props$b(_object_spread$f({}, request), {
         nestApplication: nestContext
     });
 }
 
-function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7242,27 +7301,27 @@ function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$a(fn) {
+function _async_to_generator$c(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$f(instance, Constructor) {
+function _class_call_check$i(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$a(target, props) {
+function _defineProperties$c(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -7271,11 +7330,11 @@ function _defineProperties$a(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$a(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
+function _create_class$c(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$m(obj, key, value) {
+function _define_property$p(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -7288,7 +7347,7 @@ function _define_property$m(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$d(target) {
+function _object_spread$e(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -7298,12 +7357,12 @@ function _object_spread$d(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$m(target, key, source[key]);
+            _define_property$p(target, key, source[key]);
         });
     }
     return target;
 }
-function _ts_generator$a(thisArg, body) {
+function _ts_generator$c(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7420,22 +7479,22 @@ function _ts_generator$a(thisArg, body) {
  * }
  * ```
  */ var ModelApiDispatchConfig = function ModelApiDispatchConfig() {
-    _class_call_check$f(this, ModelApiDispatchConfig);
+    _class_call_check$i(this, ModelApiDispatchConfig);
     /**
      * The onCallModel() return value with _apiDetails attached.
-     */ _define_property$m(this, "callModelFn", void 0);
+     */ _define_property$p(this, "callModelFn", void 0);
     /**
      * Factory to create typed nest context from INestApplicationContext.
-     */ _define_property$m(this, "makeNestContext", void 0);
+     */ _define_property$p(this, "makeNestContext", void 0);
     /**
      * Optional model-api-layer OIDC group-scope default. See {@link ModelApiOidcScopeConfig.defaultRequiredScope}.
      * This is the home for the callModel group-scope default; providing it here enforces it across
      * dispatch AND the `/get` reads.
-     */ _define_property$m(this, "defaultRequiredScope", void 0);
+     */ _define_property$p(this, "defaultRequiredScope", void 0);
     /**
      * Optional per-model OIDC group-scope overrides. See {@link ModelApiOidcScopeConfig.modelRequiredScopes}.
      * The only place a plain `/get` read (no per-function handler) can be scope-gated beyond `model.read`.
-     */ _define_property$m(this, "modelRequiredScopes", void 0);
+     */ _define_property$p(this, "modelRequiredScopes", void 0);
 };
 /**
  * Injection token for providing the NestJS application context to the dispatch service.
@@ -7452,13 +7511,13 @@ function _ts_generator$a(thisArg, body) {
  * the callModel function.
  */ var ModelApiCallModelDispatchService = /*#__PURE__*/ function() {
     function ModelApiCallModelDispatchService(config, nestApplication) {
-        _class_call_check$f(this, ModelApiCallModelDispatchService);
-        _define_property$m(this, "config", void 0);
-        _define_property$m(this, "nestApplication", void 0);
+        _class_call_check$i(this, ModelApiCallModelDispatchService);
+        _define_property$p(this, "config", void 0);
+        _define_property$p(this, "nestApplication", void 0);
         this.config = config;
         this.nestApplication = nestApplication;
     }
-    _create_class$a(ModelApiCallModelDispatchService, [
+    _create_class$c(ModelApiCallModelDispatchService, [
         {
             key: "dispatch",
             value: /**
@@ -7469,9 +7528,9 @@ function _ts_generator$a(thisArg, body) {
      * @param rawRequest - The raw Express request.
      * @returns The handler's return value.
      */ function dispatch(params, auth, rawRequest) {
-                return _async_to_generator$a(function() {
+                return _async_to_generator$c(function() {
                     var call, modelType, specifier, apiDetails, requiredScope, callableRequest, appRequest, contextRequest;
-                    return _ts_generator$a(this, function(_state) {
+                    return _ts_generator$c(this, function(_state) {
                         // Enforce OIDC scope BEFORE dispatching — the relocated home of the callModel scope check.
                         // AND-of-ORs across the per-verb `model.<call>` scope and the effective group term (per-function
                         // `requiredScope` > per-model requirement > module default), bypassing non-OIDC callers. A nullish
@@ -7497,7 +7556,7 @@ function _ts_generator$a(thisArg, body) {
                             data: params,
                             auth: auth ? {
                                 uid: auth.uid,
-                                token: _object_spread$d({}, auth.token, auth.oidcValidatedToken)
+                                token: _object_spread$e({}, auth.token, auth.oidcValidatedToken)
                             } : undefined,
                             rawRequest: rawRequest,
                             acceptsStreaming: false
@@ -7533,7 +7592,15 @@ ModelApiCallModelDispatchService = __decorate([
     __param(1, Inject(MODEL_API_NEST_APPLICATION_CONTEXT))
 ], ModelApiCallModelDispatchService);
 
-function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
+function _array_like_to_array$a(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes$2(arr) {
+    if (Array.isArray(arr)) return arr;
+}
+function asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7547,27 +7614,27 @@ function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$9(fn) {
+function _async_to_generator$b(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$e(instance, Constructor) {
+function _class_call_check$h(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$9(target, props) {
+function _defineProperties$b(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -7576,11 +7643,11 @@ function _defineProperties$9(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$9(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
+function _create_class$b(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$l(obj, key, value) {
+function _define_property$o(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -7593,7 +7660,7 @@ function _define_property$l(obj, key, value) {
     }
     return obj;
 }
-function _instanceof$2(left, right) {
+function _instanceof$3(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -7601,7 +7668,34 @@ function _instanceof$2(left, right) {
         return left instanceof right;
     }
 }
-function _object_spread$c(target) {
+function _iterable_to_array_limit$2(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest$2() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread$d(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -7611,12 +7705,42 @@ function _object_spread$c(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$l(target, key, source[key]);
+            _define_property$o(target, key, source[key]);
         });
     }
     return target;
 }
-function _ts_generator$9(thisArg, body) {
+function ownKeys$a(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$a(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$a(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _sliced_to_array$2(arr, i) {
+    return _array_with_holes$2(arr) || _iterable_to_array_limit$2(arr, i) || _unsupported_iterable_to_array$a(arr, i) || _non_iterable_rest$2();
+}
+function _unsupported_iterable_to_array$a(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$a(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$a(o, minLen);
+}
+function _ts_generator$b(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7719,6 +7843,49 @@ function _ts_generator$9(thisArg, body) {
 /**
  * Maximum number of keys allowed in a multi-read request.
  */ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
+/**
+ * Error code returned when a read targets a model the app declared SERVER-ONLY.
+ *
+ * Deliberately distinct from a permission error: nothing the caller can be granted will make this
+ * read succeed, so the message needs to say WHY rather than implying a missing role.
+ */ var MODEL_IS_SERVER_ONLY_ERROR_CODE = 'MODEL_IS_SERVER_ONLY';
+/**
+ * Role-map keys that are structural markers rather than granted role names, so they are never
+ * reported as roles.
+ *
+ * {@link FULL_ACCESS_ROLE_KEY} is surfaced through `fullAccess` instead. {@link NO_ACCESS_ROLE_KEY}
+ * is what `noAccessRoleMap()` sets and means "no roles at all" — both a missing document and an
+ * explicit no-access grant carry it, so leaking it would report `__EMPTY__` as a granted role and
+ * make the no-access case indistinguishable from a real one-role grant.
+ */ var MODEL_ACCESS_ROLE_MAP_MARKER_KEYS = new Set([
+    FULL_ACCESS_ROLE_KEY,
+    NO_ACCESS_ROLE_KEY
+]);
+/**
+ * Maps a resolved `ContextGrantedModelRoles` into the flat {@link ModelAccessRoleMapResult} wire
+ * shape — collapsing the full-access marker into a boolean, dropping the structural marker keys, and
+ * sorting the enumerated role keys so output is stable across calls.
+ *
+ * @param input - The key and its resolved granted-roles result.
+ * @returns The flattened per-key permission state.
+ */ function modelAccessRoleMapResultFromGrantedRoles(input) {
+    var _granted_data;
+    var key = input.key, granted = input.granted;
+    var fullAccess = isFullAccessRoleMap(granted.roleMap);
+    var roles = fullAccess ? [] : Object.entries(granted.roleMap).filter(function(param) {
+        var _param = _sliced_to_array$2(param, 2), roleKey = _param[0], value = _param[1];
+        return value === true && !MODEL_ACCESS_ROLE_MAP_MARKER_KEYS.has(roleKey);
+    }).map(function(param) {
+        var _param = _sliced_to_array$2(param, 1), roleKey = _param[0];
+        return roleKey;
+    }).sort();
+    return {
+        key: key,
+        exists: ((_granted_data = granted.data) === null || _granted_data === void 0 ? void 0 : _granted_data.exists) === true,
+        fullAccess: fullAccess,
+        roles: roles
+    };
+}
 /**
  * Maps a single `useMultipleModels` failure entry into the public {@link ModelAccessReadError}
  * shape. Unwraps the typical Firebase error shapes via {@link firebaseServerErrorInfo} so
@@ -7738,7 +7905,7 @@ function _ts_generator$9(thisArg, body) {
     var info = firebaseServerErrorInfo(entry.error);
     var serverMessage = (_info_httpsErrorDetailsServerError = info.httpsErrorDetailsServerError) === null || _info_httpsErrorDetailsServerError === void 0 ? void 0 : _info_httpsErrorDetailsServerError.message;
     var httpsMessage = (_info_httpsError = info.httpsError) === null || _info_httpsError === void 0 ? void 0 : _info_httpsError.message;
-    var plainMessage = _instanceof$2(entry.error, Error) ? entry.error.message : undefined;
+    var plainMessage = _instanceof$3(entry.error, Error) ? entry.error.message : undefined;
     var code = (_info_serverErrorCode = info.serverErrorCode) !== null && _info_serverErrorCode !== void 0 ? _info_serverErrorCode : info.firebaseErrorCode;
     return {
         key: entry.key,
@@ -7778,16 +7945,16 @@ function _ts_generator$9(thisArg, body) {
  * enforcing `'read'` role permissions per document.
  */ var ModelApiGetService = /*#__PURE__*/ function() {
     function ModelApiGetService(config, nestApplication) {
-        _class_call_check$e(this, ModelApiGetService);
-        _define_property$l(this, "_nestContext", void 0);
-        _define_property$l(this, "_defaultRequiredScope", void 0);
-        _define_property$l(this, "_modelRequiredScopes", void 0);
-        _define_property$l(this, "_identityByModelType", void 0);
+        _class_call_check$h(this, ModelApiGetService);
+        _define_property$o(this, "_nestContext", void 0);
+        _define_property$o(this, "_defaultRequiredScope", void 0);
+        _define_property$o(this, "_modelRequiredScopes", void 0);
+        _define_property$o(this, "_identityByModelType", void 0);
         this._nestContext = config.makeNestContext(nestApplication);
         this._defaultRequiredScope = config.defaultRequiredScope;
         this._modelRequiredScopes = config.modelRequiredScopes;
     }
-    _create_class$9(ModelApiGetService, [
+    _create_class$b(ModelApiGetService, [
         {
             /**
      * Enforces the OIDC read-scope requirement for a direct document read before it hits Firestore.
@@ -7812,6 +7979,57 @@ function _ts_generator$9(thisArg, body) {
         },
         {
             /**
+     * Refuses a read of a model the app declared SERVER-ONLY, BEFORE `useModel` runs.
+     *
+     * The model API authorizes through `roleMapForModel` under the Admin SDK, which bypasses
+     * `firestore.rules` entirely. For a model the rules file deliberately leaves unmatched (or denies
+     * outright), those two systems disagree and the model API is the one handing out the document.
+     * Gating here — ahead of the role map, and on the ONE service both `/model/<type>/get` and the
+     * `model-get` MCP tool share — is what makes the two read paths agree.
+     *
+     * @param modelType - The Firestore model type being read.
+     * @param auth - The request's auth data; used to build the context the service lookup needs.
+     * @throws {HttpsError} `MODEL_IS_SERVER_ONLY` when the model opted in via `serverOnly`.
+     */ key: "_assertNotServerOnly",
+            value: function _assertNotServerOnly(modelType, auth) {
+                if (this._isServerOnlyModel(modelType, auth)) {
+                    throw forbiddenError({
+                        status: 403,
+                        code: MODEL_IS_SERVER_ONLY_ERROR_CODE,
+                        message: 'Model "'.concat(modelType, '" is server-only and cannot be read through the model API. It has no client read grant in firestore.rules either — reach it through a callable that owns its access policy.'),
+                        data: {
+                            modelType: modelType
+                        }
+                    });
+                }
+            }
+        },
+        {
+            /**
+     * Reads the `serverOnly` flag off the registered model service, tolerating a type whose service
+     * cannot be constructed (which `readDocument` then reports as an unknown model).
+     *
+     * @param modelType - The Firestore model type to inspect.
+     * @param auth - The request's auth data.
+     * @returns `true` when the model declared itself server-only.
+     */ key: "_isServerOnlyModel",
+            value: function _isServerOnlyModel(modelType, auth) {
+                var authRef = this._makeAuthRef(auth);
+                var result = false;
+                try {
+                    var inContextService = this._nestContext.model(authRef);
+                    var modelService = inContextService(modelType);
+                    result = (modelService === null || modelService === void 0 ? void 0 : modelService.serverOnly) === true;
+                } catch (unused) {
+                    // an unregistered / unconstructable type is not our error to raise here — the subsequent
+                    // useModel call reports it as an unknown model
+                    result = false;
+                }
+                return result;
+            }
+        },
+        {
+            /**
      * Returns the registered {@link FirestoreModelIdentity} for the given `modelType` string, or
      * `undefined` when no model of that type is registered.
      *
@@ -7878,12 +8096,13 @@ function _ts_generator$9(thisArg, body) {
      * @returns The document key and data.
      * @throws {Error} Permission or not-found errors from useModel.
      */ function readDocument(modelType, key, auth) {
-                return _async_to_generator$9(function() {
+                return _async_to_generator$b(function() {
                     var authRef, doc, snapshot;
-                    return _ts_generator$9(this, function(_state) {
+                    return _ts_generator$b(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 this._assertReadScope(modelType, auth);
+                                this._assertNotServerOnly(modelType, auth);
                                 authRef = this._makeAuthRef(auth);
                                 return [
                                     4,
@@ -7929,10 +8148,11 @@ function _ts_generator$9(thisArg, body) {
      * @param auth - The authenticated user's auth data from the request.
      * @returns Results and errors for each requested key.
      */ function readDocuments(modelType, keys, auth) {
-                return _async_to_generator$9(function() {
+                return _async_to_generator$b(function() {
                     var authRef;
-                    return _ts_generator$9(this, function(_state) {
+                    return _ts_generator$b(this, function(_state) {
                         this._assertReadScope(modelType, auth);
+                        this._assertNotServerOnly(modelType, auth);
                         authRef = this._makeAuthRef(auth);
                         return [
                             2,
@@ -7942,17 +8162,17 @@ function _ts_generator$9(thisArg, body) {
                                 roles: 'read',
                                 throwOnFirstError: false,
                                 use: function use(successful, failure) {
-                                    return _async_to_generator$9(function() {
+                                    return _async_to_generator$b(function() {
                                         var results, errors;
-                                        return _ts_generator$9(this, function(_state) {
+                                        return _ts_generator$b(this, function(_state) {
                                             switch(_state.label){
                                                 case 0:
                                                     return [
                                                         4,
                                                         Promise.all(successful.map(function(reader) {
-                                                            return _async_to_generator$9(function() {
+                                                            return _async_to_generator$b(function() {
                                                                 var snapshot;
-                                                                return _ts_generator$9(this, function(_state) {
+                                                                return _ts_generator$b(this, function(_state) {
                                                                     switch(_state.label){
                                                                         case 0:
                                                                             return [
@@ -7994,27 +8214,207 @@ function _ts_generator$9(thisArg, body) {
             }
         },
         {
-            /**
-     * Builds an {@link AuthDataRef} compatible with `useModel()` from the HTTP request auth.
+            key: "readRoleMaps",
+            value: /**
+     * Resolves the granted role map for one or more keys of the same model type — i.e. "what is this
+     * user actually allowed to do with this document?".
      *
-     * Uses the same synthetic auth pattern as {@link ModelApiDispatchService.dispatch}.
-     * The OIDC-validated claim subset is layered over the base token so the synthetic
-     * `auth.token` keeps standard JWT claims (`iat`, `auth_time`, `email`, …) that
-     * downstream consumers like `authContextInfo` rely on.
+     * This is the same computation the permission-checked read path runs (`roleMapForModel()` on the
+     * model's registered service factory), but the resolved roles are returned instead of being
+     * consumed to allow/deny an operation. Because it runs the model's real delegate, derived and
+     * cascading roles are included exactly as the API would grant them.
      *
-     * @param auth - The Firebase server auth data from the HTTP request, or undefined for unauthenticated requests.
-     * @returns An object containing a synthetic {@link AuthData} for use with `useModel()`, or undefined auth.
-     */ key: "_makeAuthRef",
-            value: function _makeAuthRef(auth) {
-                var synthetic;
-                if (auth) {
-                    var _auth_token, _auth_oidcValidatedToken;
-                    var baseToken = (_auth_token = auth.token) !== null && _auth_token !== void 0 ? _auth_token : {};
-                    var oidcToken = (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : {};
-                    synthetic = {
-                        uid: auth.uid,
-                        token: _object_spread$c({}, baseToken, oidcToken)
-                    };
+     * Per-key failures are captured in `errors` rather than thrown, matching {@link readDocuments}.
+     * A key that resolves to a missing document is NOT an error — it comes back with
+     * `exists: false, roles: []`, which is what distinguishes "not there" from "no access".
+     *
+     * @param params - Model type, keys, calling auth, and an optional target uid.
+     * @returns The per-key permission state plus the uid the roles were resolved for.
+     */ function readRoleMaps(params) {
+                return _async_to_generator$b(function() {
+                    var _authRef_auth, modelType, keys, auth, targetUid, targeted, authRef, _tmp, context, service, settled, results, errors, uid;
+                    return _ts_generator$b(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                modelType = params.modelType, keys = params.keys, auth = params.auth, targetUid = params.targetUid;
+                                this._assertReadScope(modelType, auth);
+                                targeted = targetUid != null && targetUid !== (auth === null || auth === void 0 ? void 0 : auth.uid);
+                                if (!targeted) return [
+                                    3,
+                                    2
+                                ];
+                                return [
+                                    4,
+                                    this._makeAuthRefForUid(targetUid)
+                                ];
+                            case 1:
+                                _tmp = _state.sent();
+                                return [
+                                    3,
+                                    3
+                                ];
+                            case 2:
+                                _tmp = this._makeAuthRef(auth);
+                                _state.label = 3;
+                            case 3:
+                                authRef = _tmp;
+                                context = this._nestContext.makeModelContext(authRef);
+                                service = this._nestContext.firebaseModelsService(modelType, context);
+                                return [
+                                    4,
+                                    Promise.all(keys.map(function(key) {
+                                        return _async_to_generator$b(function() {
+                                            var entry, granted, error;
+                                            return _ts_generator$b(this, function(_state) {
+                                                switch(_state.label){
+                                                    case 0:
+                                                        _state.trys.push([
+                                                            0,
+                                                            2,
+                                                            ,
+                                                            3
+                                                        ]);
+                                                        return [
+                                                            4,
+                                                            service.roleMapForKey(key)
+                                                        ];
+                                                    case 1:
+                                                        granted = _state.sent();
+                                                        entry = {
+                                                            result: modelAccessRoleMapResultFromGrantedRoles({
+                                                                key: key,
+                                                                granted: granted
+                                                            })
+                                                        };
+                                                        return [
+                                                            3,
+                                                            3
+                                                        ];
+                                                    case 2:
+                                                        error = _state.sent();
+                                                        entry = {
+                                                            error: modelAccessReadErrorFromUseMultipleModelsFailure({
+                                                                key: key,
+                                                                error: error
+                                                            })
+                                                        };
+                                                        return [
+                                                            3,
+                                                            3
+                                                        ];
+                                                    case 3:
+                                                        return [
+                                                            2,
+                                                            entry
+                                                        ];
+                                                }
+                                            });
+                                        })();
+                                    }))
+                                ];
+                            case 4:
+                                settled = _state.sent();
+                                results = [];
+                                errors = [];
+                                settled.forEach(function(entry) {
+                                    if (entry.result != null) {
+                                        results.push(entry.result);
+                                    } else if (entry.error != null) {
+                                        errors.push(entry.error);
+                                    }
+                                });
+                                uid = (_authRef_auth = authRef.auth) === null || _authRef_auth === void 0 ? void 0 : _authRef_auth.uid;
+                                return [
+                                    2,
+                                    _object_spread_props$a(_object_spread$d({}, uid == null ? {} : {
+                                        uid: uid
+                                    }), {
+                                        targeted: targeted,
+                                        results: results,
+                                        errors: errors
+                                    })
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "_makeAuthRefForUid",
+            value: /**
+     * Builds a synthetic {@link AuthData} for an arbitrary uid so role resolution can run *as* that
+     * user rather than as the caller.
+     *
+     * The target's custom claims are read from their Firebase Auth record and spread into the
+     * synthetic token, mirroring how Firebase merges custom claims into a real decoded ID token —
+     * so claim-reading permission delegates behave identically to a live request from that user.
+     *
+     * @param uid - The uid to resolve as.
+     * @returns An auth ref carrying the target user's claims.
+     * @throws {Error} If no Firebase Auth user exists for the uid.
+     */ function _makeAuthRefForUid(uid) {
+                return _async_to_generator$b(function() {
+                    var userContext, exists, record;
+                    return _ts_generator$b(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                userContext = this._nestContext.authService.userContext(uid);
+                                return [
+                                    4,
+                                    userContext.exists()
+                                ];
+                            case 1:
+                                exists = _state.sent();
+                                if (!exists) {
+                                    throw new Error('No user exists with uid "'.concat(uid, '".'));
+                                }
+                                return [
+                                    4,
+                                    userContext.loadRecord()
+                                ];
+                            case 2:
+                                record = _state.sent();
+                                return [
+                                    2,
+                                    {
+                                        auth: {
+                                            uid: uid,
+                                            token: _object_spread_props$a(_object_spread$d({}, record.customClaims), {
+                                                uid: uid,
+                                                sub: uid,
+                                                email: record.email,
+                                                email_verified: record.emailVerified
+                                            })
+                                        }
+                                    }
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            /**
+     * Builds an {@link AuthDataRef} compatible with `useModel()` from the HTTP request auth.
+     *
+     * Uses the same synthetic auth pattern as {@link ModelApiDispatchService.dispatch}.
+     * The OIDC-validated claim subset is layered over the base token so the synthetic
+     * `auth.token` keeps standard JWT claims (`iat`, `auth_time`, `email`, …) that
+     * downstream consumers like `authContextInfo` rely on.
+     *
+     * @param auth - The Firebase server auth data from the HTTP request, or undefined for unauthenticated requests.
+     * @returns An object containing a synthetic {@link AuthData} for use with `useModel()`, or undefined auth.
+     */ key: "_makeAuthRef",
+            value: function _makeAuthRef(auth) {
+                var synthetic;
+                if (auth) {
+                    var _auth_token, _auth_oidcValidatedToken;
+                    var baseToken = (_auth_token = auth.token) !== null && _auth_token !== void 0 ? _auth_token : {};
+                    var oidcToken = (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : {};
+                    synthetic = {
+                        uid: auth.uid,
+                        token: _object_spread$d({}, baseToken, oidcToken)
+                    };
                 }
                 return {
                     auth: synthetic
@@ -8030,7 +8430,7 @@ ModelApiGetService = __decorate([
     __param(1, Inject(MODEL_API_NEST_APPLICATION_CONTEXT))
 ], ModelApiGetService);
 
-function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -8044,27 +8444,27 @@ function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$8(fn) {
+function _async_to_generator$a(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$d(instance, Constructor) {
+function _class_call_check$g(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$8(target, props) {
+function _defineProperties$a(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -8073,11 +8473,11 @@ function _defineProperties$8(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$8(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
+function _create_class$a(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$k(obj, key, value) {
+function _define_property$n(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -8090,7 +8490,7 @@ function _define_property$k(obj, key, value) {
     }
     return obj;
 }
-function _instanceof$1(left, right) {
+function _instanceof$2(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -8098,7 +8498,7 @@ function _instanceof$1(left, right) {
         return left instanceof right;
     }
 }
-function _ts_generator$8(thisArg, body) {
+function _ts_generator$a(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -8223,13 +8623,13 @@ function _ts_generator$8(thisArg, body) {
  * Auth is provided by the OIDC bearer token middleware on the `req.auth` field.
  */ var ModelApiController = /*#__PURE__*/ function() {
     function ModelApiController(dispatchService, accessService) {
-        _class_call_check$d(this, ModelApiController);
-        _define_property$k(this, "dispatchService", void 0);
-        _define_property$k(this, "accessService", void 0);
+        _class_call_check$g(this, ModelApiController);
+        _define_property$n(this, "dispatchService", void 0);
+        _define_property$n(this, "accessService", void 0);
         this.dispatchService = dispatchService;
         this.accessService = accessService;
     }
-    _create_class$8(ModelApiController, [
+    _create_class$a(ModelApiController, [
         {
             key: "directDispatch",
             value: // MARK: Direct Dispatch
@@ -8243,8 +8643,8 @@ function _ts_generator$8(thisArg, body) {
      * @param req - The Express request containing auth credentials on `req.auth`.
      * @returns The result of the dispatched model call.
      */ function directDispatch(body, req) {
-                return _async_to_generator$8(function() {
-                    return _ts_generator$8(this, function(_state) {
+                return _async_to_generator$a(function() {
+                    return _ts_generator$a(this, function(_state) {
                         return [
                             2,
                             this._dispatch(body, req)
@@ -8268,9 +8668,9 @@ function _ts_generator$8(thisArg, body) {
      * @param req - The Express request containing auth credentials on `req.auth`.
      * @returns The document data for the requested model key.
      */ function getOne(modelType, key, req) {
-                return _async_to_generator$8(function() {
+                return _async_to_generator$a(function() {
                     var auth, error;
-                    return _ts_generator$8(this, function(_state) {
+                    return _ts_generator$a(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 if (!key) {
@@ -8324,9 +8724,9 @@ function _ts_generator$8(thisArg, body) {
      * @param req - The Express request containing auth credentials on `req.auth`.
      * @returns An object with `results` (document data array) and `errors` (per-key failures).
      */ function getMany(modelType, body, req) {
-                return _async_to_generator$8(function() {
+                return _async_to_generator$a(function() {
                     var keys, auth, error;
-                    return _ts_generator$8(this, function(_state) {
+                    return _ts_generator$a(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 keys = body.keys;
@@ -8389,9 +8789,9 @@ function _ts_generator$8(thisArg, body) {
      * @param req - The Express request whose path segments encode modelType, call, and optional specifier.
      * @returns The result of the dispatched model call.
      */ function handleDispatchRequest(req) {
-                return _async_to_generator$8(function() {
+                return _async_to_generator$a(function() {
                     var _this__parsePath, modelType, call, specifier, params;
-                    return _ts_generator$8(this, function(_state) {
+                    return _ts_generator$a(this, function(_state) {
                         if (!ALLOWED_DISPATCH_METHODS.has(req.method)) {
                             throw new HttpException({
                                 statusCode: 405,
@@ -8464,9 +8864,9 @@ function _ts_generator$8(thisArg, body) {
         {
             key: "_dispatch",
             value: function _dispatch(params, req) {
-                return _async_to_generator$8(function() {
+                return _async_to_generator$a(function() {
                     var auth, error;
-                    return _ts_generator$8(this, function(_state) {
+                    return _ts_generator$a(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 auth = req.auth;
@@ -8503,7 +8903,7 @@ function _ts_generator$8(thisArg, body) {
             key: "_toHttpException",
             value: function _toHttpException(error) {
                 var result;
-                if (_instanceof$1(error, HttpException)) {
+                if (_instanceof$2(error, HttpException)) {
                     result = error;
                 } else {
                     var _ref, _ref1, _ref2;
@@ -8549,15 +8949,15 @@ ModelApiController = __decorate([
     __param(1, Inject(ModelApiGetService))
 ], ModelApiController);
 
-function _array_like_to_array$7(arr, len) {
+function _array_like_to_array$9(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$5(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
+function _array_without_holes$7(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$9(arr);
 }
-function _define_property$j(obj, key, value) {
+function _define_property$m(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -8570,13 +8970,13 @@ function _define_property$j(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$5(iter) {
+function _iterable_to_array$7(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$5() {
+function _non_iterable_spread$7() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$b(target) {
+function _object_spread$c(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -8586,21 +8986,21 @@ function _object_spread$b(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$j(target, key, source[key]);
+            _define_property$m(target, key, source[key]);
         });
     }
     return target;
 }
-function _to_consumable_array$5(arr) {
-    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$5();
+function _to_consumable_array$7(arr) {
+    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$9(arr) || _non_iterable_spread$7();
 }
-function _unsupported_iterable_to_array$7(o, minLen) {
+function _unsupported_iterable_to_array$9(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$9(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$9(o, minLen);
 }
 // MARK: Module Metadata
 /**
@@ -8625,14 +9025,14 @@ function _unsupported_iterable_to_array$7(o, minLen) {
     return {
         imports: [
             dependencyModule
-        ].concat(_to_consumable_array$5(imports !== null && imports !== void 0 ? imports : [])),
+        ].concat(_to_consumable_array$7(imports !== null && imports !== void 0 ? imports : [])),
         controllers: [
             ModelApiController
         ],
         exports: [
             ModelApiGetService,
             ModelApiCallModelDispatchService
-        ].concat(_to_consumable_array$5(exports !== null && exports !== void 0 ? exports : [])),
+        ].concat(_to_consumable_array$7(exports !== null && exports !== void 0 ? exports : [])),
         providers: [
             ModelApiGetService,
             ModelApiCallModelDispatchService,
@@ -8644,7 +9044,7 @@ function _unsupported_iterable_to_array$7(o, minLen) {
                     // a full app-level context where all providers (e.g., server actions) are resolvable.
                     return {
                         get: function get(typeOrToken, options) {
-                            return moduleRef.get(typeOrToken, _object_spread$b({
+                            return moduleRef.get(typeOrToken, _object_spread$c({
                                 strict: false
                             }, options));
                         }
@@ -8654,6 +9054,810 @@ function _unsupported_iterable_to_array$7(o, minLen) {
                     ModuleRef
                 ]
             }
+        ].concat(_to_consumable_array$7(providers !== null && providers !== void 0 ? providers : []))
+    };
+}
+
+function _class_call_check$f(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _define_property$l(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+// MARK: Paths
+/**
+ * Route prefix the session API controller is mounted at. Under the `/api` global route prefix the
+ * routes become `/api/session/*`.
+ */ var SESSION_API_ROUTE_PREFIX = 'session';
+/**
+ * Path (relative to the API base URL) of the direct-Firestore session endpoint.
+ *
+ * The `@dereekb/dbx-cli` client posts to `<apiBaseUrl>${FIRESTORE_SESSION_API_PATH}`.
+ */ var FIRESTORE_SESSION_API_PATH = '/session/firestore';
+/**
+ * Path prefix apps must add to their OIDC `protectedPaths` so the bearer-token middleware
+ * authenticates the session endpoint (today typically `['/api/model', '/mcp']`).
+ *
+ * Without this the endpoint is reachable unauthenticated — `req.auth` would be `undefined` and the
+ * request rejected as unauthenticated, but the gate belongs at the middleware, not the handler.
+ */ var FIREBASE_SERVER_SESSION_API_PROTECTED_PATH = '/api/session';
+// MARK: TTL
+/**
+ * Default lifetime requested for the minted App Check token. Matches the Admin SDK's own default.
+ */ var DEFAULT_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS = 60 * 60 * 1000;
+/**
+ * Minimum lifetime the Admin SDK accepts for an App Check token (30 minutes).
+ */ var MIN_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS = 30 * 60 * 1000;
+/**
+ * Maximum lifetime the Admin SDK accepts for an App Check token (7 days).
+ *
+ * Deliberately NOT the default: this endpoint mints a valid web-app App Check attestation for
+ * whoever calls it, so the shortest workable lifetime is the right one.
+ */ var MAX_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * Window a Firebase Auth custom token may be exchanged for an ID token within (1 hour, fixed by
+ * Firebase). The exchanged ID token then lives its own hour from sign-in.
+ */ var FIREBASE_CUSTOM_TOKEN_EXCHANGE_WINDOW_MILLIS = 60 * 60 * 1000;
+/**
+ * NestJS injection token for the {@link FirestoreSessionAdminPredicate} provider.
+ */ var FIRESTORE_SESSION_ADMIN_PREDICATE = 'FIRESTORE_SESSION_ADMIN_PREDICATE';
+// MARK: Config
+/**
+ * Optional configuration for the session API module, supplied by the app via its dependency module.
+ *
+ * Everything here is optional — with no config provided the endpoint still mints custom tokens, just
+ * without an App Check attestation (correct for a project that does not enforce App Check, and for
+ * emulator-backed local development).
+ */ var SessionApiModuleConfig = function SessionApiModuleConfig() {
+    _class_call_check$f(this, SessionApiModuleConfig);
+    /**
+     * The Firebase `appId` of the registered **web** app to mint App Check tokens for. This is the same
+     * `appId` the browser client initializes with — the attestation must match an app the project's
+     * App Check enforcement recognizes.
+     *
+     * When unset, no App Check token is minted and the response's `appCheckToken` is omitted.
+     */ _define_property$l(this, "appCheckAppId", void 0);
+    /**
+     * Lifetime to request for the minted App Check token. Clamped to
+     * [{@link MIN_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS}, {@link MAX_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS}].
+     *
+     * Defaults to {@link DEFAULT_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS}.
+     */ _define_property$l(this, "appCheckTokenTtlMillis", void 0);
+    /**
+     * OIDC scope term an OIDC caller must hold to open a session. Defaults to
+     * {@link FIRESTORE_SESSION_OIDC_SCOPE}. Pass `null` to disable scope enforcement entirely (the admin
+     * predicate remains the real gate either way).
+     */ _define_property$l(this, "requiredScope", void 0);
+};
+/**
+ * Resolves the effective App Check TTL from the module config, clamped to the Admin SDK's accepted range.
+ *
+ * @param ttlMillis - The configured TTL, or `undefined` to use the default.
+ * @returns The TTL to request, in milliseconds.
+ * @__NO_SIDE_EFFECTS__
+ */ function firestoreSessionAppCheckTtlMillis(ttlMillis) {
+    var requested = ttlMillis !== null && ttlMillis !== void 0 ? ttlMillis : DEFAULT_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS;
+    return Math.min(Math.max(requested, MIN_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS), MAX_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS);
+}
+/**
+ * The default {@link SessionApiModuleConfig.requiredScope}, re-exported for apps that want to widen it
+ * into an OR-group rather than replace it.
+ */ var DEFAULT_FIRESTORE_SESSION_REQUIRED_OIDC_SCOPE = FIRESTORE_SESSION_OIDC_SCOPE;
+
+function _array_like_to_array$8(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$6(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$8(arr);
+}
+function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$9(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check$e(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties$9(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class$9(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$k(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _iterable_to_array$6(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$6() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread$b(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$k(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$9(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$9(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$9(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _to_consumable_array$6(arr) {
+    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$8(arr) || _non_iterable_spread$6();
+}
+function _unsupported_iterable_to_array$8(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$8(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$8(o, minLen);
+}
+function _ts_generator$9(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+var FirestoreSessionApiService_1;
+/**
+ * Error code thrown when the caller is not authorized to open a direct-Firestore session.
+ */ var FIRESTORE_SESSION_FORBIDDEN_ERROR_CODE = 'FIRESTORE_SESSION_FORBIDDEN_ERROR';
+/**
+ * Mints the direct-Firestore session credential bundle returned by `SessionApiController`.
+ *
+ * ## Security
+ *
+ * This service hands out a valid web-app App Check token and a custom token for the caller's own uid.
+ * Two gates apply, in order:
+ *
+ * 1. The app-supplied {@link FirestoreSessionAdminPredicate} — the load-bearing check. **Fails closed**
+ *    when the app provides no predicate.
+ * 2. The OIDC scope requirement (default {@link FIRESTORE_SESSION_OIDC_SCOPE}) — defence in depth only.
+ *    It cannot stand alone: a non-OIDC caller carries no `scope` claim and every enforcement site in
+ *    this codebase treats that as "skip".
+ *
+ * The custom token is ALWAYS minted for `auth.uid`; there is no way to ask for someone else's session,
+ * so a granted session is exactly as privileged as the caller already is under Firestore rules.
+ */ var FirestoreSessionApiService = FirestoreSessionApiService_1 = /*#__PURE__*/ function() {
+    function FirestoreSessionApiService(app, config, adminPredicate) {
+        _class_call_check$e(this, FirestoreSessionApiService);
+        _define_property$k(this, "_logger", new Logger(FirestoreSessionApiService_1.name));
+        _define_property$k(this, "_app", void 0);
+        _define_property$k(this, "_config", void 0);
+        _define_property$k(this, "_adminPredicate", void 0);
+        this._app = app;
+        this._config = config;
+        this._adminPredicate = adminPredicate;
+        if (!adminPredicate) {
+            this._logger.warn("No ".concat(FIRESTORE_SESSION_ADMIN_PREDICATE, " provided — ").concat(FIRESTORE_SESSION_API_PATH, " will reject every caller. Provide one from the session module's dependency module."));
+        }
+        if (!(config === null || config === void 0 ? void 0 : config.appCheckAppId)) {
+            this._logger.warn("No SessionApiModuleConfig.appCheckAppId configured — ".concat(FIRESTORE_SESSION_API_PATH, " will issue sessions without an App Check attestation. Direct Firestore access will be rejected wherever App Check is enforced."));
+        }
+    }
+    _create_class$9(FirestoreSessionApiService, [
+        {
+            key: "createFirestoreSession",
+            value: /**
+     * Mints a direct-Firestore session for the calling user after enforcing the admin predicate and the
+     * OIDC scope requirement.
+     *
+     * @param auth - The authenticated request's auth data (`req.auth`).
+     * @returns The credential bundle the client needs to connect to Firestore as this user.
+     * @throws {HttpsError} A `401` when the request carries no uid, or a `403` when either gate rejects the caller.
+     */ function createFirestoreSession(auth) {
+                return _async_to_generator$9(function() {
+                    var _Math, _this__config, _this__config1, uid, isAllowed, _tmp, configuredScope, now, customToken, appCheckToken, appCheckTtlMillis, appCheckAppId, _created_ttlMillis, _this__config2, ttlMillis, created, expiresAtMillis;
+                    return _ts_generator$9(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                uid = auth === null || auth === void 0 ? void 0 : auth.uid;
+                                if (!uid) {
+                                    throw unauthenticatedError({
+                                        message: 'A direct-Firestore session requires an authenticated caller.'
+                                    });
+                                }
+                                if (!this._adminPredicate) return [
+                                    3,
+                                    2
+                                ];
+                                return [
+                                    4,
+                                    this._adminPredicate(auth)
+                                ];
+                            case 1:
+                                _tmp = _state.sent();
+                                return [
+                                    3,
+                                    3
+                                ];
+                            case 2:
+                                _tmp = false;
+                                _state.label = 3;
+                            case 3:
+                                isAllowed = _tmp;
+                                if (!isAllowed) {
+                                    throw forbiddenError({
+                                        status: 403,
+                                        code: FIRESTORE_SESSION_FORBIDDEN_ERROR_CODE,
+                                        message: 'Not authorized to open a direct-Firestore session.'
+                                    });
+                                }
+                                // an explicit `null` disables scope enforcement; only an ABSENT value falls back to the default
+                                configuredScope = (_this__config = this._config) === null || _this__config === void 0 ? void 0 : _this__config.requiredScope;
+                                assertEndpointOidcScope({
+                                    requiredScope: configuredScope === undefined ? DEFAULT_FIRESTORE_SESSION_REQUIRED_OIDC_SCOPE : configuredScope,
+                                    grantedScopes: oidcScopesFromRequestAuth(auth),
+                                    endpoint: FIRESTORE_SESSION_API_PATH
+                                });
+                                now = Date.now();
+                                return [
+                                    4,
+                                    this._app.auth().createCustomToken(uid)
+                                ];
+                            case 4:
+                                customToken = _state.sent();
+                                appCheckAppId = (_this__config1 = this._config) === null || _this__config1 === void 0 ? void 0 : _this__config1.appCheckAppId;
+                                if (!appCheckAppId) return [
+                                    3,
+                                    6
+                                ];
+                                ttlMillis = firestoreSessionAppCheckTtlMillis((_this__config2 = this._config) === null || _this__config2 === void 0 ? void 0 : _this__config2.appCheckTokenTtlMillis);
+                                return [
+                                    4,
+                                    this._app.appCheck().createToken(appCheckAppId, {
+                                        ttlMillis: ttlMillis
+                                    })
+                                ];
+                            case 5:
+                                created = _state.sent();
+                                appCheckToken = created.token;
+                                appCheckTtlMillis = (_created_ttlMillis = created.ttlMillis) !== null && _created_ttlMillis !== void 0 ? _created_ttlMillis : ttlMillis;
+                                _state.label = 6;
+                            case 6:
+                                // the session lives only as long as its shortest-lived credential
+                                expiresAtMillis = (_Math = Math).min.apply(_Math, [
+                                    now + FIREBASE_CUSTOM_TOKEN_EXCHANGE_WINDOW_MILLIS
+                                ].concat(_to_consumable_array$6(appCheckTtlMillis == null ? [] : [
+                                    now + appCheckTtlMillis
+                                ])));
+                                return [
+                                    2,
+                                    _object_spread_props$9(_object_spread$b({
+                                        uid: uid,
+                                        customToken: customToken
+                                    }, appCheckToken ? {
+                                        appCheckToken: appCheckToken
+                                    } : undefined), {
+                                        expiresAt: new Date(expiresAtMillis).toISOString()
+                                    })
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return FirestoreSessionApiService;
+}();
+FirestoreSessionApiService = FirestoreSessionApiService_1 = __decorate([
+    Injectable(),
+    __param(0, Inject(FIREBASE_APP_TOKEN)),
+    __param(1, Optional()),
+    __param(1, Inject(SessionApiModuleConfig)),
+    __param(2, Optional()),
+    __param(2, Inject(FIRESTORE_SESSION_ADMIN_PREDICATE))
+], FirestoreSessionApiService);
+
+function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$8(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check$d(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties$8(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class$8(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$j(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof$1(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _ts_generator$8(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * REST controller that hands an authenticated admin caller the credentials needed to talk to
+ * Firestore directly, rather than only through the model HTTP API.
+ *
+ * Mounted at `session` — under the `/api` global prefix the route becomes `GET /api/session/firestore`.
+ *
+ * Auth comes from the global OIDC bearer middleware, so `'/api/session'` MUST be listed in the OIDC
+ * module's `protectedPaths` (see `FIREBASE_SERVER_SESSION_API_PROTECTED_PATH`). Follows `McpController`:
+ * there are no NestJS guards in this codebase — protection is path-prefix middleware plus the
+ * per-endpoint checks in {@link FirestoreSessionApiService}.
+ */ var SessionApiController = /*#__PURE__*/ function() {
+    function SessionApiController(sessionService) {
+        _class_call_check$d(this, SessionApiController);
+        _define_property$j(this, "sessionService", void 0);
+        this.sessionService = sessionService;
+    }
+    _create_class$8(SessionApiController, [
+        {
+            key: "getFirestoreSession",
+            value: /**
+     * Mints a short-lived Firebase Auth custom token (+ App Check attestation, when configured) for the
+     * calling user.
+     *
+     * @param req - The Express request carrying auth credentials on `req.auth`.
+     * @returns The {@link FirestoreSessionResult} credential bundle.
+     */ function getFirestoreSession(req) {
+                return _async_to_generator$8(function() {
+                    var auth, error;
+                    return _ts_generator$8(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                auth = req.auth;
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
+                                return [
+                                    4,
+                                    this.sessionService.createFirestoreSession(auth)
+                                ];
+                            case 2:
+                                return [
+                                    2,
+                                    _state.sent()
+                                ];
+                            case 3:
+                                error = _state.sent();
+                                throw this._toHttpException(error);
+                            case 4:
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "_toHttpException",
+            value: function _toHttpException(error) {
+                var result;
+                if (_instanceof$1(error, HttpException)) {
+                    result = error;
+                } else {
+                    var _ref, _ref1, _ref2, _ref3;
+                    var _error_httpErrorCode, _error_details;
+                    var status = (_ref = (_ref1 = error === null || error === void 0 ? void 0 : error.status) !== null && _ref1 !== void 0 ? _ref1 : error === null || error === void 0 ? void 0 : (_error_httpErrorCode = error.httpErrorCode) === null || _error_httpErrorCode === void 0 ? void 0 : _error_httpErrorCode.status) !== null && _ref !== void 0 ? _ref : HttpStatus.INTERNAL_SERVER_ERROR;
+                    var message = (_ref2 = error === null || error === void 0 ? void 0 : error.message) !== null && _ref2 !== void 0 ? _ref2 : 'Internal server error';
+                    // `forbiddenError`/`unauthenticatedError` build an HttpsError whose top-level `code` is the
+                    // coarse functions code ('permission-denied'), with the specific one under `details`. Prefer
+                    // the specific code so a client can tell FIRESTORE_SESSION_FORBIDDEN_ERROR (not an admin) apart
+                    // from MISSING_ENDPOINT_OIDC_SCOPE_ERROR (admin, but the token lacks `session.firestore`).
+                    var code = (_ref3 = error === null || error === void 0 ? void 0 : (_error_details = error.details) === null || _error_details === void 0 ? void 0 : _error_details.code) !== null && _ref3 !== void 0 ? _ref3 : error === null || error === void 0 ? void 0 : error.code;
+                    result = new HttpException({
+                        statusCode: status,
+                        message: message,
+                        code: code
+                    }, status);
+                }
+                return result;
+            }
+        }
+    ]);
+    return SessionApiController;
+}();
+__decorate([
+    Get('firestore'),
+    __param(0, Req())
+], SessionApiController.prototype, "getFirestoreSession", null);
+SessionApiController = __decorate([
+    Controller(SESSION_API_ROUTE_PREFIX),
+    __param(0, Inject(FirestoreSessionApiService))
+], SessionApiController);
+
+function _array_like_to_array$7(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
+}
+function _iterable_to_array$5(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$5() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$5();
+}
+function _unsupported_iterable_to_array$7(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
+}
+// MARK: Module Metadata
+/**
+ * Generates NestJS module metadata for the direct-Firestore session API.
+ *
+ * Mirrors the convention used by `modelApiModuleMetadata` and `mcpModuleMetadata`: the consumer
+ * provides a dependency module exposing the required tokens, and this factory wires the controller +
+ * service.
+ *
+ * Remember to add `FIREBASE_SERVER_SESSION_API_PROTECTED_PATH` (`'/api/session'`) to the OIDC module's
+ * `protectedPaths` — the controller relies on the bearer middleware having populated `req.auth`.
+ *
+ * @param metadataConfig - Configuration including the dependency module.
+ * @returns NestJS module metadata exposing the session controller + service.
+ *
+ * @example
+ * ```typescript
+ * @Module({
+ *   imports: [DemoApiAuthModule],
+ *   providers: [
+ *     { provide: SessionApiModuleConfig, useValue: { appCheckAppId: environment.firebase.appId } },
+ *     { provide: FIRESTORE_SESSION_ADMIN_PREDICATE, useValue: (auth) => DEMO_AUTH_CLAIMS_SERVICE.toRoles(auth?.token ?? {}).has('admin') }
+ *   ],
+ *   exports: [SessionApiModuleConfig, FIRESTORE_SESSION_ADMIN_PREDICATE]
+ * })
+ * export class DemoSessionApiDependencyModule {}
+ *
+ * @Module(sessionApiModuleMetadata({ dependencyModule: DemoSessionApiDependencyModule }))
+ * export class DemoSessionApiModule {}
+ * ```
+ */ function sessionApiModuleMetadata(metadataConfig) {
+    var dependencyModule = metadataConfig.dependencyModule, imports = metadataConfig.imports, exports = metadataConfig.exports, providers = metadataConfig.providers;
+    return {
+        imports: [
+            dependencyModule
+        ].concat(_to_consumable_array$5(imports !== null && imports !== void 0 ? imports : [])),
+        controllers: [
+            SessionApiController
+        ],
+        exports: [
+            FirestoreSessionApiService
+        ].concat(_to_consumable_array$5(exports !== null && exports !== void 0 ? exports : [])),
+        providers: [
+            FirestoreSessionApiService
         ].concat(_to_consumable_array$5(providers !== null && providers !== void 0 ? providers : []))
     };
 }
@@ -11563,7 +12767,7 @@ function _ts_generator$2(thisArg, body) {
                             return x[0];
                         }).catch(function(e) {
                             var publicUrlBackup;
-                            if (_instanceof(e, Error) && e.name === 'SigningError' && (isTestNodeEnv() || process.env.FIREBASE_STORAGE_EMULATOR_HOST)) {
+                            if (_instanceof(e, Error) && e.name === 'SigningError' && (isTestNodeEnv() || process.env['FIREBASE_STORAGE_EMULATOR_HOST'])) {
                                 // NOTE: Signing does not behave properly in the emulator as it is not supported.
                                 // https://github.com/firebase/firebase-tools/issues/3400
                                 // we can return the public url instead.
@@ -13275,4 +14479,4 @@ function _define_property(obj, key, value) {
 } 
 ();
 
-export { AbstractFirebaseNestContext, AbstractFirebaseServerActionsContext, AbstractFirebaseServerAuthContext, AbstractFirebaseServerAuthService, AbstractFirebaseServerAuthUserContext, AbstractFirebaseServerNewUserService, AbstractFirebaseServerUserPasswordResetService, AbstractNestContext, AbstractServerFirebaseNestContext, ConfigureFirebaseAppCheckMiddlewareModule, ConfigureFirebaseWebhookMiddlewareModule, DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR, DEFAULT_RESET_CODE_EXPIRES_IN, DEFAULT_RESET_COM_THROTTLE_TIME, DEFAULT_SERVER_ASSETS_BASE_PATH, DEFAULT_SETUP_COM_THROTTLE_TIME, DefaultFirebaseServerEnvService, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_SERVER_ENV_TOKEN, FIREBASE_SERVER_VALIDATION_ERROR_CODE, FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN, FIREBASE_STORAGE_CONTEXT_TOKEN, FIREBASE_STORAGE_TOKEN, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FirebaseAppCheckMiddleware, FirebaseAppCheckMiddlewareConfig, FirebaseNestServerRootModule, FirebaseRawBodyMiddleware, FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsSegmentModule, FirebaseServerAnalyticsService, FirebaseServerAnalyticsServiceListener, FirebaseServerAuthModule, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, FirebaseServerAuthPasswordResetInvalidCodeError, FirebaseServerAuthPasswordResetNoResetConfigError, FirebaseServerAuthPasswordResetSendOnceError, FirebaseServerAuthPasswordResetThrottleError, FirebaseServerAuthService, FirebaseServerAuthUserBadInputError, FirebaseServerAuthUserExistsError, FirebaseServerEnvService, FirebaseServerFirestoreContextModule, FirebaseServerFirestoreModule, FirebaseServerStorageContextModule, FirebaseServerStorageModule, FirebaseServerStorageService, GlobalRoutePrefixConfig, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MODEL_API_NEST_APPLICATION_CONTEXT, ModelApiCallModelDispatchService, ModelApiController, ModelApiDispatchConfig, ModelApiGetService, NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE, NoContentFirebaseServerUserPasswordResetService, NoSetupContentFirebaseServerNewUserService, ON_CALL_MODEL_ANALYTICS_HANDLER, ON_CALL_MODEL_ANALYTICS_SERVICE, OnCallModelAnalyticsService, PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE, SkipAppCheck, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE, _onCallWithCallTypeFunction, aggregateCrudModelApiDetails, aggregateModelApiDetails, aggregateSpecifierApiDetails, alreadyExistsError, appAnalyticsModuleMetadata, appFirestoreModuleMetadata, assertContextHasAuth, assertDocumentExists, assertHasRolesInRequest, assertHasSignedTosInRequest, assertIsAdminInRequest, assertIsAdminOrTargetUserInRequestData, assertIsContextWithAuthData, assertModelApiOidcScope, assertRequestRequiresAuthForFunction, assertSnapshotData, assertSnapshotDataWithKey, authServicePasswordResetInvalidCodeError, authServicePasswordResetNoConfigError, authServicePasswordResetSendOnceError, authServicePasswordResetThrottleError, badRequestError, blockingFunctionHandlerWithNestContextFactory, buildNestServerRootModule, callWithAnalytics, catchAndThrowPasswordResetServerErrors, cloudEventHandlerWithNestContextFactory, collectionRefForPath, createModelUnknownModelTypeError, decodeFirebaseServerUserPasswordResetOobCode, defaultFirebaseServerActionsTransformFactoryLogErrorFunction, defaultProvideFirebaseServerStorageServiceSimple, deleteModelUnknownModelTypeError, developmentUnknownSpecifierError, docRefForPath, documentModelNotAvailableError, encodeFirebaseServerUserPasswordResetOobCode, executeOnCallQuery, firebaseAuthTokenFromDecodedIdToken, firebaseServerActionsContext, firebaseServerActionsTransformContext, firebaseServerActionsTransformFactory, firebaseServerAppTokenProvider, firebaseServerAuthModuleMetadata, firebaseServerDevFunctions, firebaseServerEnvTokenProvider, firebaseServerEnvTokenProviders, firebaseServerErrorInfo, firebaseServerErrorInfoCodePair, firebaseServerErrorInfoServerErrorCodePair, firebaseServerErrorInfoServerErrorPair, firebaseServerFirestoreContextModuleMetadata, firebaseServerStorageDefaultBucketIdTokenProvider, firebaseServerStorageModuleMetadata, firebaseServerValidationError, firebaseServerValidationServerError, firestoreClientQueryConstraintFunctionsDriver, firestoreEncryptedField, firestoreServerIncrementUpdateToUpdateData, forbiddenError, getAuthUserOrUndefined, getModelApiDetails, googleCloudFileMetadataToStorageMetadata, googleCloudFirebaseStorageContextFactory, googleCloudFirebaseStorageDrivers, googleCloudFirestoreAccessorDriver, googleCloudFirestoreContextFactory, googleCloudFirestoreDrivers, googleCloudFirestoreQueryDriver, googleCloudStorageAccessorFile, googleCloudStorageAccessorFolder, googleCloudStorageBucketForStorageFilePath, googleCloudStorageFileForStorageFilePath, googleCloudStorageFirebaseStorageAccessorDriver, googleCloudStorageFromFirebaseAdminStorage, googleCloudStorageListFilesResultFactory, handleFirebaseAuthError, handleFirebaseError, hasAuthRolesInRequest, hasNewUserSetupPasswordInRequest, hasSignedTosInRequest, inAuthContext, injectNestApplicationContextIntoRequest, injectNestIntoRequest, internalServerError, invokeModelUnknownModelTypeError, isActualSpecifier, isAdminInRequest, isAdminOrTargetUserInRequestData, isContextWithAuthData, isFirebaseError, isFirebaseHttpsError, isOnCallCrudModelApiDetails, isOnCallHandlerApiDetails, isOnCallModelTypeApiDetails, isOnCallSpecifierApiDetails, makeBlockingFunctionWithHandler, makeOnScheduleHandlerWithNestApplicationRequest, makeScheduledFunctionDevelopmentFunction, modelAccessReadErrorFromUseMultipleModelsFailure, modelApiModuleMetadata, modelNotAvailableError, nestAppHasDevelopmentSchedulerEnabled, nestAppIsProductionEnvironment, nestFirebaseDoesNotExistError, nestFirebaseForbiddenPermissionError, nestServerInstance, noRunNameSpecifiedForScheduledFunctionDevelopmentFunction, noopFirebaseServerAnalyticsServiceListener, noopOnCallModelAnalyticsService, notFoundError, oidcScopesFromModelApiAuth, onCallAnalyticsEmitterInstance, onCallCreateModel, onCallDeleteModel, onCallDevelopmentFunction, onCallHandlerWithNestApplicationFactory, onCallHandlerWithNestContextFactory, onCallInvokeModel, onCallModel, onCallModelMissingCallTypeError, onCallModelUnknownCallTypeError, onCallQueryModel, onCallReadModel, onCallSpecifierHandler, onCallUpdateModel, onScheduleHandlerWithNestApplicationFactory, onScheduleHandlerWithNestContextFactory, optionalAuthContext, optionalFirestoreEncryptedField, permissionDeniedError, phoneNumberAlreadyExistsError, preconditionConflictError, provideAppFirestoreCollections, provideFirebaseServerAuthService, provideFirebaseServerStorageService, queryModelBadCursorError, queryModelUnknownModelTypeError, readApiDetails, readModelUnknownModelTypeError, resolveAdminOnlyValue, resolveAnalyticsFromApiDetails, resolveRequiredScopeFromApiDetails, setNestContextOnRequest, setNestContextOnScheduleRequest, taskQueueFunctionHandlerWithNestContextFactory, unauthenticatedContextHasNoAuthData, unauthenticatedContextHasNoUidError, unauthenticatedError, unavailableError, unavailableOrDeactivatedFunctionError, unknownModelCrudFunctionSpecifierError, unknownScheduledFunctionDevelopmentFunctionName, unknownScheduledFunctionDevelopmentFunctionType, updateModelUnknownModelTypeError, userContextFromUid, verifyAppCheckInRequest, withApiDetails };
+export { AbstractFirebaseNestContext, AbstractFirebaseServerActionsContext, AbstractFirebaseServerAuthContext, AbstractFirebaseServerAuthService, AbstractFirebaseServerAuthUserContext, AbstractFirebaseServerNewUserService, AbstractFirebaseServerUserPasswordResetService, AbstractNestContext, AbstractServerFirebaseNestContext, ConfigureFirebaseAppCheckMiddlewareModule, ConfigureFirebaseWebhookMiddlewareModule, DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR, DEFAULT_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS, DEFAULT_FIRESTORE_SESSION_REQUIRED_OIDC_SCOPE, DEFAULT_RESET_CODE_EXPIRES_IN, DEFAULT_RESET_COM_THROTTLE_TIME, DEFAULT_SERVER_ASSETS_BASE_PATH, DEFAULT_SETUP_COM_THROTTLE_TIME, DefaultFirebaseServerEnvService, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_CUSTOM_TOKEN_EXCHANGE_WINDOW_MILLIS, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_SERVER_ENV_TOKEN, FIREBASE_SERVER_SESSION_API_PROTECTED_PATH, FIREBASE_SERVER_VALIDATION_ERROR_CODE, FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN, FIREBASE_STORAGE_CONTEXT_TOKEN, FIREBASE_STORAGE_TOKEN, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FIRESTORE_SESSION_ADMIN_PREDICATE, FIRESTORE_SESSION_API_PATH, FIRESTORE_SESSION_FORBIDDEN_ERROR_CODE, FirebaseAppCheckMiddleware, FirebaseAppCheckMiddlewareConfig, FirebaseNestServerRootModule, FirebaseRawBodyMiddleware, FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsSegmentModule, FirebaseServerAnalyticsService, FirebaseServerAnalyticsServiceListener, FirebaseServerAuthModule, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, FirebaseServerAuthPasswordResetInvalidCodeError, FirebaseServerAuthPasswordResetNoResetConfigError, FirebaseServerAuthPasswordResetSendOnceError, FirebaseServerAuthPasswordResetThrottleError, FirebaseServerAuthService, FirebaseServerAuthUserBadInputError, FirebaseServerAuthUserExistsError, FirebaseServerEnvService, FirebaseServerFirestoreContextModule, FirebaseServerFirestoreModule, FirebaseServerStorageContextModule, FirebaseServerStorageModule, FirebaseServerStorageService, FirestoreSessionApiService, GlobalRoutePrefixConfig, MAX_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MIN_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS, MISSING_ENDPOINT_OIDC_SCOPE_ERROR_CODE, MODEL_API_NEST_APPLICATION_CONTEXT, MODEL_IS_SERVER_ONLY_ERROR_CODE, ModelApiCallModelDispatchService, ModelApiController, ModelApiDispatchConfig, ModelApiGetService, NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE, NoContentFirebaseServerUserPasswordResetService, NoSetupContentFirebaseServerNewUserService, ON_CALL_MODEL_ANALYTICS_HANDLER, ON_CALL_MODEL_ANALYTICS_SERVICE, OnCallModelAnalyticsService, PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE, SESSION_API_ROUTE_PREFIX, SessionApiController, SessionApiModuleConfig, SkipAppCheck, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE, _onCallWithCallTypeFunction, aggregateCrudModelApiDetails, aggregateModelApiDetails, aggregateSpecifierApiDetails, alreadyExistsError, appAnalyticsModuleMetadata, appFirestoreModuleMetadata, assertContextHasAuth, assertDocumentExists, assertEndpointOidcScope, assertHasRolesInRequest, assertHasSignedTosInRequest, assertIsAdminInRequest, assertIsAdminOrTargetUserInRequestData, assertIsContextWithAuthData, assertModelApiOidcScope, assertRequestRequiresAuthForFunction, assertSnapshotData, assertSnapshotDataWithKey, authServicePasswordResetInvalidCodeError, authServicePasswordResetNoConfigError, authServicePasswordResetSendOnceError, authServicePasswordResetThrottleError, badRequestError, blockingFunctionHandlerWithNestContextFactory, buildNestServerRootModule, callWithAnalytics, catchAndThrowPasswordResetServerErrors, cloudEventHandlerWithNestContextFactory, collectionRefForPath, createModelUnknownModelTypeError, decodeFirebaseServerUserPasswordResetOobCode, defaultFirebaseServerActionsTransformFactoryLogErrorFunction, defaultProvideFirebaseServerStorageServiceSimple, deleteModelUnknownModelTypeError, developmentUnknownSpecifierError, docRefForPath, documentModelNotAvailableError, encodeFirebaseServerUserPasswordResetOobCode, executeOnCallQuery, firebaseAuthTokenFromDecodedIdToken, firebaseServerActionsContext, firebaseServerActionsTransformContext, firebaseServerActionsTransformFactory, firebaseServerAppTokenProvider, firebaseServerAuthModuleMetadata, firebaseServerDevFunctions, firebaseServerEnvTokenProvider, firebaseServerEnvTokenProviders, firebaseServerErrorInfo, firebaseServerErrorInfoCodePair, firebaseServerErrorInfoServerErrorCodePair, firebaseServerErrorInfoServerErrorPair, firebaseServerFirestoreContextModuleMetadata, firebaseServerStorageDefaultBucketIdTokenProvider, firebaseServerStorageModuleMetadata, firebaseServerValidationError, firebaseServerValidationServerError, firestoreClientQueryConstraintFunctionsDriver, firestoreEncryptedField, firestoreServerIncrementUpdateToUpdateData, firestoreSessionAppCheckTtlMillis, forbiddenError, getAuthUserOrUndefined, getModelApiDetails, googleCloudFileMetadataToStorageMetadata, googleCloudFirebaseStorageContextFactory, googleCloudFirebaseStorageDrivers, googleCloudFirestoreAccessorDriver, googleCloudFirestoreContextFactory, googleCloudFirestoreDrivers, googleCloudFirestoreQueryDriver, googleCloudStorageAccessorFile, googleCloudStorageAccessorFolder, googleCloudStorageBucketForStorageFilePath, googleCloudStorageFileForStorageFilePath, googleCloudStorageFirebaseStorageAccessorDriver, googleCloudStorageFromFirebaseAdminStorage, googleCloudStorageListFilesResultFactory, handleFirebaseAuthError, handleFirebaseError, hasAuthRolesInRequest, hasNewUserSetupPasswordInRequest, hasSignedTosInRequest, inAuthContext, injectNestApplicationContextIntoRequest, injectNestIntoRequest, internalServerError, invokeModelUnknownModelTypeError, isActualSpecifier, isAdminInRequest, isAdminOrTargetUserInRequestData, isContextWithAuthData, isFirebaseError, isFirebaseHttpsError, isOnCallCrudModelApiDetails, isOnCallHandlerApiDetails, isOnCallModelTypeApiDetails, isOnCallSpecifierApiDetails, makeBlockingFunctionWithHandler, makeOnScheduleHandlerWithNestApplicationRequest, makeScheduledFunctionDevelopmentFunction, modelAccessReadErrorFromUseMultipleModelsFailure, modelAccessRoleMapResultFromGrantedRoles, modelApiModuleMetadata, modelNotAvailableError, nestAppHasDevelopmentSchedulerEnabled, nestAppIsProductionEnvironment, nestFirebaseDoesNotExistError, nestFirebaseForbiddenPermissionError, nestServerInstance, noRunNameSpecifiedForScheduledFunctionDevelopmentFunction, noopFirebaseServerAnalyticsServiceListener, noopOnCallModelAnalyticsService, notFoundError, oidcScopesFromModelApiAuth, oidcScopesFromRequestAuth, onCallAnalyticsEmitterInstance, onCallCreateModel, onCallDeleteModel, onCallDevelopmentFunction, onCallHandlerWithNestApplicationFactory, onCallHandlerWithNestContextFactory, onCallInvokeModel, onCallModel, onCallModelMissingCallTypeError, onCallModelUnknownCallTypeError, onCallQueryModel, onCallReadModel, onCallSpecifierHandler, onCallUpdateModel, onScheduleHandlerWithNestApplicationFactory, onScheduleHandlerWithNestContextFactory, optionalAuthContext, optionalFirestoreEncryptedField, permissionDeniedError, phoneNumberAlreadyExistsError, preconditionConflictError, provideAppFirestoreCollections, provideFirebaseServerAuthService, provideFirebaseServerStorageService, queryModelBadCursorError, queryModelUnknownModelTypeError, readApiDetails, readModelUnknownModelTypeError, resolveAdminOnlyValue, resolveAnalyticsFromApiDetails, resolveRequiredScopeFromApiDetails, sessionApiModuleMetadata, setNestContextOnRequest, setNestContextOnScheduleRequest, taskQueueFunctionHandlerWithNestContextFactory, unauthenticatedContextHasNoAuthData, unauthenticatedContextHasNoUidError, unauthenticatedError, unavailableError, unavailableOrDeactivatedFunctionError, unknownModelCrudFunctionSpecifierError, unknownScheduledFunctionDevelopmentFunctionName, unknownScheduledFunctionDevelopmentFunctionType, updateModelUnknownModelTypeError, userContextFromUid, verifyAppCheckInRequest, withApiDetails };