@dereekb/firebase-server 13.37.0 → 13.39.0

package/src/lib/nest/controller/model/model.api.get.service.d.ts

@@ -1,5 +1,6 @@
 import { type Maybe } from '@dereekb/util';
-import { type FirestoreModelIdentity, type FirestoreModelKey, type FirestoreModelType } from '@dereekb/firebase';
+import { type GrantedRoleMap } from '@dereekb/model';
+import { type FirebaseAuthUserId, type FirestoreModelIdentity, type FirestoreModelKey, type FirestoreModelType } from '@dereekb/firebase';
 import { type INestApplicationContext } from '@nestjs/common';
 import { ModelApiDispatchConfig } from './model.api.dispatch';
 import { type FirebaseServerAuthData } from '../auth.context.server';
@@ -7,6 +8,13 @@ import { type FirebaseServerAuthData } from '../auth.context.server';
  * Maximum number of keys allowed in a multi-read request.
  */
 export declare const MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
+/**
+ * Error code returned when a read targets a model the app declared SERVER-ONLY.
+ *
+ * Deliberately distinct from a permission error: nothing the caller can be granted will make this
+ * read succeed, so the message needs to say WHY rather than implying a missing role.
+ */
+export declare const MODEL_IS_SERVER_ONLY_ERROR_CODE = "MODEL_IS_SERVER_ONLY";
 /**
  * Result of a single document access read.
  */
@@ -29,6 +37,90 @@ export interface ModelAccessReadError {
     readonly message: string;
     readonly code?: string;
 }
+/**
+ * The resolved permission state for a single model key, as computed by that model's
+ * `roleMapForModel()` delegate for a specific user.
+ */
+export interface ModelAccessRoleMapResult {
+    readonly key: FirestoreModelKey;
+    /**
+     * Whether the underlying document exists.
+     *
+     * Roles are only computed for documents that exist — `FirebaseModelPermissionServiceInstance`
+     * gates on `isUsableOutputForRoles(output) => output.exists`, so a missing document always
+     * resolves to an empty role set. Surfacing existence separately is what lets a caller tell
+     * "the document is not there" apart from "the document is there and you may not touch it";
+     * both otherwise present as `roles: []`.
+     */
+    readonly exists: boolean;
+    /**
+     * True when the model granted the full-access marker ({@link FULL_ACCESS_ROLE_KEY}) rather than
+     * an enumerated role set — the shape admin short-circuits like `fullAccessRoleMap()` produce.
+     * When true, {@link roles} is empty and every role is implicitly granted.
+     */
+    readonly fullAccess: boolean;
+    /**
+     * The granted role names, sorted. Empty when {@link fullAccess} is true or nothing was granted.
+     */
+    readonly roles: string[];
+}
+/**
+ * Result of a multi-key role-map resolution.
+ */
+export interface ModelAccessMultiRoleMapResult {
+    /**
+     * The uid the roles were resolved for — the caller's own uid unless the request targeted
+     * another user. `undefined` for an unauthenticated resolution.
+     */
+    readonly uid?: string;
+    /**
+     * True when {@link uid} is someone other than the calling user.
+     */
+    readonly targeted: boolean;
+    readonly results: ModelAccessRoleMapResult[];
+    readonly errors: ModelAccessReadError[];
+}
+/**
+ * Input for {@link ModelApiGetService.readRoleMaps}.
+ */
+export interface ModelAccessRoleMapParams {
+    readonly modelType: FirestoreModelType;
+    readonly keys: FirestoreModelKey[];
+    /**
+     * The calling request's auth data.
+     */
+    readonly auth: Maybe<FirebaseServerAuthData>;
+    /**
+     * Resolve roles as this user instead of the caller. Callers are responsible for authorizing
+     * this before passing it — the service performs no permission check of its own on the target.
+     */
+    readonly targetUid?: Maybe<FirebaseAuthUserId>;
+}
+/**
+ * Input for {@link modelAccessRoleMapResultFromGrantedRoles}.
+ */
+export interface ModelAccessRoleMapResultParams {
+    readonly key: FirestoreModelKey;
+    /**
+     * The resolved `ContextGrantedModelRoles` for the key. Typed structurally (rather than importing
+     * the generic) so the mapper stays testable with a plain object.
+     */
+    readonly granted: {
+        readonly data?: Maybe<{
+            readonly exists?: boolean;
+        }>;
+        readonly roleMap: GrantedRoleMap<string>;
+    };
+}
+/**
+ * Maps a resolved `ContextGrantedModelRoles` into the flat {@link ModelAccessRoleMapResult} wire
+ * shape — collapsing the full-access marker into a boolean, dropping the structural marker keys, and
+ * sorting the enumerated role keys so output is stable across calls.
+ *
+ * @param input - The key and its resolved granted-roles result.
+ * @returns The flattened per-key permission state.
+ */
+export declare function modelAccessRoleMapResultFromGrantedRoles(input: ModelAccessRoleMapResultParams): ModelAccessRoleMapResult;
 /**
  * Shape of a single failed-key entry from `useMultipleModels({ throwOnFirstError: false })`.
  * Exposed so the mapper below stays testable without a live nest context.
@@ -77,6 +169,29 @@ export declare class ModelApiGetService {
      * @param auth - The request's auth data (OIDC scopes are read from it).
      */
     private _assertReadScope;
+    /**
+     * Refuses a read of a model the app declared SERVER-ONLY, BEFORE `useModel` runs.
+     *
+     * The model API authorizes through `roleMapForModel` under the Admin SDK, which bypasses
+     * `firestore.rules` entirely. For a model the rules file deliberately leaves unmatched (or denies
+     * outright), those two systems disagree and the model API is the one handing out the document.
+     * Gating here — ahead of the role map, and on the ONE service both `/model/<type>/get` and the
+     * `model-get` MCP tool share — is what makes the two read paths agree.
+     *
+     * @param modelType - The Firestore model type being read.
+     * @param auth - The request's auth data; used to build the context the service lookup needs.
+     * @throws {HttpsError} `MODEL_IS_SERVER_ONLY` when the model opted in via `serverOnly`.
+     */
+    private _assertNotServerOnly;
+    /**
+     * Reads the `serverOnly` flag off the registered model service, tolerating a type whose service
+     * cannot be constructed (which `readDocument` then reports as an unknown model).
+     *
+     * @param modelType - The Firestore model type to inspect.
+     * @param auth - The request's auth data.
+     * @returns `true` when the model declared itself server-only.
+     */
+    private _isServerOnlyModel;
     /**
      * Returns the registered {@link FirestoreModelIdentity} for the given `modelType` string, or
      * `undefined` when no model of that type is registered.
@@ -114,6 +229,36 @@ export declare class ModelApiGetService {
      * @returns Results and errors for each requested key.
      */
     readDocuments(modelType: FirestoreModelType, keys: FirestoreModelKey[], auth: Maybe<FirebaseServerAuthData>): Promise<ModelAccessMultiReadResult>;
+    /**
+     * Resolves the granted role map for one or more keys of the same model type — i.e. "what is this
+     * user actually allowed to do with this document?".
+     *
+     * This is the same computation the permission-checked read path runs (`roleMapForModel()` on the
+     * model's registered service factory), but the resolved roles are returned instead of being
+     * consumed to allow/deny an operation. Because it runs the model's real delegate, derived and
+     * cascading roles are included exactly as the API would grant them.
+     *
+     * Per-key failures are captured in `errors` rather than thrown, matching {@link readDocuments}.
+     * A key that resolves to a missing document is NOT an error — it comes back with
+     * `exists: false, roles: []`, which is what distinguishes "not there" from "no access".
+     *
+     * @param params - Model type, keys, calling auth, and an optional target uid.
+     * @returns The per-key permission state plus the uid the roles were resolved for.
+     */
+    readRoleMaps(params: ModelAccessRoleMapParams): Promise<ModelAccessMultiRoleMapResult>;
+    /**
+     * Builds a synthetic {@link AuthData} for an arbitrary uid so role resolution can run *as* that
+     * user rather than as the caller.
+     *
+     * The target's custom claims are read from their Firebase Auth record and spread into the
+     * synthetic token, mirroring how Firebase merges custom claims into a real decoded ID token —
+     * so claim-reading permission delegates behave identically to a live request from that user.
+     *
+     * @param uid - The uid to resolve as.
+     * @returns An auth ref carrying the target user's claims.
+     * @throws {Error} If no Firebase Auth user exists for the uid.
+     */
+    private _makeAuthRefForUid;
     /**
      * Builds an {@link AuthDataRef} compatible with `useModel()` from the HTTP request auth.
      *

package/src/lib/nest/controller/model/model.api.scope.d.ts

@@ -40,8 +40,9 @@ export interface ModelApiOidcScopeConfig {
  * `auth.oidcValidatedToken` (with the space-delimited `scope` string); a non-OIDC caller has neither
  * that field nor a `scope` on `auth.token`. Reading is defensive (the auth shape is only typed as
  * {@link FirebaseServerAuthData} here — the OIDC-specific `oidcValidatedToken` lives in the
- * `@dereekb/firebase-server/oidc` sub-package this core layer cannot import), delegating the actual
- * parse to the shared {@link oidcScopesFromScopeClaim} so there is no drift with `getOidcScopesFromRequest`.
+ * `@dereekb/firebase-server/oidc` sub-package this core layer cannot import), delegating entirely to the
+ * shared {@link oidcScopesFromRequestAuth} so there is no drift with `getOidcScopesFromRequest` or with
+ * the non-model endpoints that read scopes the same way.
  *
  * @param auth - The request auth data, or undefined for unauthenticated requests.
  * @returns The granted scope set, or `undefined` when the request carries no OIDC `scope` claim.

package/src/lib/nest/controller/session/index.d.ts

@@ -0,0 +1,4 @@
+export * from './session.api.config';
+export * from './session.api.service';
+export * from './session.api.controller';
+export * from './session.api.module';

package/src/lib/nest/controller/session/session.api.config.d.ts

@@ -0,0 +1,104 @@
+import { type Maybe, type Milliseconds, type PromiseOrValue } from '@dereekb/util';
+import { type OidcScopeTerm } from '@dereekb/firebase';
+import { type FirebaseServerAuthData } from '../auth.context.server';
+/**
+ * Route prefix the session API controller is mounted at. Under the `/api` global route prefix the
+ * routes become `/api/session/*`.
+ */
+export declare const SESSION_API_ROUTE_PREFIX = "session";
+/**
+ * Path (relative to the API base URL) of the direct-Firestore session endpoint.
+ *
+ * The `@dereekb/dbx-cli` client posts to `<apiBaseUrl>${FIRESTORE_SESSION_API_PATH}`.
+ */
+export declare const FIRESTORE_SESSION_API_PATH = "/session/firestore";
+/**
+ * Path prefix apps must add to their OIDC `protectedPaths` so the bearer-token middleware
+ * authenticates the session endpoint (today typically `['/api/model', '/mcp']`).
+ *
+ * Without this the endpoint is reachable unauthenticated — `req.auth` would be `undefined` and the
+ * request rejected as unauthenticated, but the gate belongs at the middleware, not the handler.
+ */
+export declare const FIREBASE_SERVER_SESSION_API_PROTECTED_PATH = "/api/session";
+/**
+ * Default lifetime requested for the minted App Check token. Matches the Admin SDK's own default.
+ */
+export declare const DEFAULT_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS: Milliseconds;
+/**
+ * Minimum lifetime the Admin SDK accepts for an App Check token (30 minutes).
+ */
+export declare const MIN_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS: Milliseconds;
+/**
+ * Maximum lifetime the Admin SDK accepts for an App Check token (7 days).
+ *
+ * Deliberately NOT the default: this endpoint mints a valid web-app App Check attestation for
+ * whoever calls it, so the shortest workable lifetime is the right one.
+ */
+export declare const MAX_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS: Milliseconds;
+/**
+ * Window a Firebase Auth custom token may be exchanged for an ID token within (1 hour, fixed by
+ * Firebase). The exchanged ID token then lives its own hour from sign-in.
+ */
+export declare const FIREBASE_CUSTOM_TOKEN_EXCHANGE_WINDOW_MILLIS: Milliseconds;
+/**
+ * Signature for the predicate that authorizes a caller to open a direct-Firestore session.
+ *
+ * Receives the calling request's auth data (`undefined` for an unauthenticated request) and returns
+ * true when that caller may be handed a custom token + App Check attestation. Typically an admin
+ * check, e.g. `(auth) => authRoleClaimsService.toRoles(auth?.token ?? {}).has('admin')`.
+ *
+ * This is the LOAD-BEARING gate. `assertIsAdminInRequest` cannot be used here — it needs a
+ * `NestContextCallableRequestWithOptionalAuth` with `.nest` attached, and a plain Nest controller
+ * only has an Express request carrying `req.auth` — so the check is delegated to the app, keeping
+ * `@dereekb/firebase-server` app-agnostic about what "admin" means.
+ *
+ * When no predicate is provided the endpoint fails closed for EVERY caller.
+ */
+export type FirestoreSessionAdminPredicate = (auth: Maybe<FirebaseServerAuthData>) => PromiseOrValue<boolean>;
+/**
+ * NestJS injection token for the {@link FirestoreSessionAdminPredicate} provider.
+ */
+export declare const FIRESTORE_SESSION_ADMIN_PREDICATE = "FIRESTORE_SESSION_ADMIN_PREDICATE";
+/**
+ * Optional configuration for the session API module, supplied by the app via its dependency module.
+ *
+ * Everything here is optional — with no config provided the endpoint still mints custom tokens, just
+ * without an App Check attestation (correct for a project that does not enforce App Check, and for
+ * emulator-backed local development).
+ */
+export declare abstract class SessionApiModuleConfig {
+    /**
+     * The Firebase `appId` of the registered **web** app to mint App Check tokens for. This is the same
+     * `appId` the browser client initializes with — the attestation must match an app the project's
+     * App Check enforcement recognizes.
+     *
+     * When unset, no App Check token is minted and the response's `appCheckToken` is omitted.
+     */
+    readonly appCheckAppId?: string;
+    /**
+     * Lifetime to request for the minted App Check token. Clamped to
+     * [{@link MIN_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS}, {@link MAX_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS}].
+     *
+     * Defaults to {@link DEFAULT_FIRESTORE_SESSION_APP_CHECK_TTL_MILLIS}.
+     */
+    readonly appCheckTokenTtlMillis?: Milliseconds;
+    /**
+     * OIDC scope term an OIDC caller must hold to open a session. Defaults to
+     * {@link FIRESTORE_SESSION_OIDC_SCOPE}. Pass `null` to disable scope enforcement entirely (the admin
+     * predicate remains the real gate either way).
+     */
+    readonly requiredScope?: Maybe<OidcScopeTerm>;
+}
+/**
+ * Resolves the effective App Check TTL from the module config, clamped to the Admin SDK's accepted range.
+ *
+ * @param ttlMillis - The configured TTL, or `undefined` to use the default.
+ * @returns The TTL to request, in milliseconds.
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function firestoreSessionAppCheckTtlMillis(ttlMillis: Maybe<Milliseconds>): Milliseconds;
+/**
+ * The default {@link SessionApiModuleConfig.requiredScope}, re-exported for apps that want to widen it
+ * into an OR-group rather than replace it.
+ */
+export declare const DEFAULT_FIRESTORE_SESSION_REQUIRED_OIDC_SCOPE: OidcScopeTerm;

package/src/lib/nest/controller/session/session.api.controller.d.ts

@@ -0,0 +1,26 @@
+import { type Request } from 'express';
+import { FirestoreSessionApiService, type FirestoreSessionResult } from './session.api.service';
+/**
+ * REST controller that hands an authenticated admin caller the credentials needed to talk to
+ * Firestore directly, rather than only through the model HTTP API.
+ *
+ * Mounted at `session` — under the `/api` global prefix the route becomes `GET /api/session/firestore`.
+ *
+ * Auth comes from the global OIDC bearer middleware, so `'/api/session'` MUST be listed in the OIDC
+ * module's `protectedPaths` (see `FIREBASE_SERVER_SESSION_API_PROTECTED_PATH`). Follows `McpController`:
+ * there are no NestJS guards in this codebase — protection is path-prefix middleware plus the
+ * per-endpoint checks in {@link FirestoreSessionApiService}.
+ */
+export declare class SessionApiController {
+    private readonly sessionService;
+    constructor(sessionService: FirestoreSessionApiService);
+    /**
+     * Mints a short-lived Firebase Auth custom token (+ App Check attestation, when configured) for the
+     * calling user.
+     *
+     * @param req - The Express request carrying auth credentials on `req.auth`.
+     * @returns The {@link FirestoreSessionResult} credential bundle.
+     */
+    getFirestoreSession(req: Request): Promise<FirestoreSessionResult>;
+    private _toHttpException;
+}

package/src/lib/nest/controller/session/session.api.module.d.ts

@@ -0,0 +1,49 @@
+import { type ModuleMetadata } from '@nestjs/common';
+import { type ClassType } from '@dereekb/util';
+/**
+ * Configuration for {@link sessionApiModuleMetadata}.
+ */
+export interface SessionApiModuleMetadataConfig extends Pick<ModuleMetadata, 'imports' | 'exports' | 'providers'> {
+    /**
+     * Module that exports the session endpoint's dependencies.
+     *
+     * Should provide:
+     * - `FIRESTORE_SESSION_ADMIN_PREDICATE` — the app's admin check. Without it the endpoint rejects
+     *   EVERY caller (fail-closed), and logs a warning at boot.
+     * - {@link SessionApiModuleConfig} — the registered web app's `appId` to mint App Check tokens for,
+     *   plus optional TTL / scope overrides. Without it sessions carry no App Check attestation.
+     *
+     * `FIREBASE_APP_TOKEN` is not listed because `nestServerInstance` provides it globally.
+     */
+    readonly dependencyModule: ClassType;
+}
+/**
+ * Generates NestJS module metadata for the direct-Firestore session API.
+ *
+ * Mirrors the convention used by `modelApiModuleMetadata` and `mcpModuleMetadata`: the consumer
+ * provides a dependency module exposing the required tokens, and this factory wires the controller +
+ * service.
+ *
+ * Remember to add `FIREBASE_SERVER_SESSION_API_PROTECTED_PATH` (`'/api/session'`) to the OIDC module's
+ * `protectedPaths` — the controller relies on the bearer middleware having populated `req.auth`.
+ *
+ * @param metadataConfig - Configuration including the dependency module.
+ * @returns NestJS module metadata exposing the session controller + service.
+ *
+ * @example
+ * ```typescript
+ * @Module({
+ *   imports: [DemoApiAuthModule],
+ *   providers: [
+ *     { provide: SessionApiModuleConfig, useValue: { appCheckAppId: environment.firebase.appId } },
+ *     { provide: FIRESTORE_SESSION_ADMIN_PREDICATE, useValue: (auth) => DEMO_AUTH_CLAIMS_SERVICE.toRoles(auth?.token ?? {}).has('admin') }
+ *   ],
+ *   exports: [SessionApiModuleConfig, FIRESTORE_SESSION_ADMIN_PREDICATE]
+ * })
+ * export class DemoSessionApiDependencyModule {}
+ *
+ * @Module(sessionApiModuleMetadata({ dependencyModule: DemoSessionApiDependencyModule }))
+ * export class DemoSessionApiModule {}
+ * ```
+ */
+export declare function sessionApiModuleMetadata(metadataConfig: SessionApiModuleMetadataConfig): ModuleMetadata;

package/src/lib/nest/controller/session/session.api.service.d.ts

@@ -0,0 +1,71 @@
+import type * as admin from 'firebase-admin';
+import { type ISO8601DateString, type Maybe } from '@dereekb/util';
+import { type FirebaseAuthUserId } from '@dereekb/firebase';
+import { type FirebaseServerAuthData } from '../auth.context.server';
+import { type FirestoreSessionAdminPredicate, SessionApiModuleConfig } from './session.api.config';
+/**
+ * Error code thrown when the caller is not authorized to open a direct-Firestore session.
+ */
+export declare const FIRESTORE_SESSION_FORBIDDEN_ERROR_CODE = "FIRESTORE_SESSION_FORBIDDEN_ERROR";
+/**
+ * A short-lived credential bundle that lets a headless client connect directly to Firestore as the
+ * authenticated user, through the app's security rules.
+ */
+export interface FirestoreSessionResult {
+    /**
+     * The uid the session was minted for — the calling user's real Firebase Auth uid.
+     */
+    readonly uid: FirebaseAuthUserId;
+    /**
+     * A Firebase Auth custom token to exchange via `signInWithCustomToken`. The user's stored
+     * `setCustomUserClaims` claims are spread at the TOP LEVEL of the exchanged ID token, so security
+     * rules reading `request.auth.token.<claim>` behave exactly as they do for the browser app.
+     */
+    readonly customToken: string;
+    /**
+     * An App Check attestation minted for the project's registered web app, for clients that cannot run
+     * a browser-only attestation provider (reCAPTCHA v3). Feed it to `initializeAppCheck` through a
+     * `CustomProvider`.
+     *
+     * Omitted when the app did not configure {@link SessionApiModuleConfig.appCheckAppId}.
+     */
+    readonly appCheckToken?: string;
+    /**
+     * When the session as a whole stops being usable — the earliest expiry among its credentials.
+     * A long-running client should re-fetch rather than assume one session covers the whole job.
+     */
+    readonly expiresAt: ISO8601DateString;
+}
+/**
+ * Mints the direct-Firestore session credential bundle returned by `SessionApiController`.
+ *
+ * ## Security
+ *
+ * This service hands out a valid web-app App Check token and a custom token for the caller's own uid.
+ * Two gates apply, in order:
+ *
+ * 1. The app-supplied {@link FirestoreSessionAdminPredicate} — the load-bearing check. **Fails closed**
+ *    when the app provides no predicate.
+ * 2. The OIDC scope requirement (default {@link FIRESTORE_SESSION_OIDC_SCOPE}) — defence in depth only.
+ *    It cannot stand alone: a non-OIDC caller carries no `scope` claim and every enforcement site in
+ *    this codebase treats that as "skip".
+ *
+ * The custom token is ALWAYS minted for `auth.uid`; there is no way to ask for someone else's session,
+ * so a granted session is exactly as privileged as the caller already is under Firestore rules.
+ */
+export declare class FirestoreSessionApiService {
+    private readonly _logger;
+    private readonly _app;
+    private readonly _config;
+    private readonly _adminPredicate;
+    constructor(app: admin.app.App, config?: SessionApiModuleConfig, adminPredicate?: FirestoreSessionAdminPredicate);
+    /**
+     * Mints a direct-Firestore session for the calling user after enforcing the admin predicate and the
+     * OIDC scope requirement.
+     *
+     * @param auth - The authenticated request's auth data (`req.auth`).
+     * @returns The credential bundle the client needs to connect to Firestore as this user.
+     * @throws {HttpsError} A `401` when the request carries no uid, or a `403` when either gate rejects the caller.
+     */
+    createFirestoreSession(auth: Maybe<FirebaseServerAuthData>): Promise<FirestoreSessionResult>;
+}

package/test/package.json

@@ -1,16 +1,17 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.37.0",
+  "version": "13.39.0",
+  "type": "module",
   "peerDependencies": {
-    "@dereekb/analytics": "13.37.0",
-    "@dereekb/date": "13.37.0",
-    "@dereekb/firebase": "13.37.0",
-    "@dereekb/firebase-server": "13.37.0",
-    "@dereekb/firebase-server/oidc": "13.37.0",
-    "@dereekb/model": "13.37.0",
-    "@dereekb/nestjs": "13.37.0",
-    "@dereekb/rxjs": "13.37.0",
-    "@dereekb/util": "13.37.0",
+    "@dereekb/analytics": "13.39.0",
+    "@dereekb/date": "13.39.0",
+    "@dereekb/firebase": "13.39.0",
+    "@dereekb/firebase-server": "13.39.0",
+    "@dereekb/firebase-server/oidc": "13.39.0",
+    "@dereekb/model": "13.39.0",
+    "@dereekb/nestjs": "13.39.0",
+    "@dereekb/rxjs": "13.39.0",
+    "@dereekb/util": "13.39.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,18 +24,17 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.37.0"
+    "@dereekb/nestjs": "13.39.0"
   },
   "exports": {
     "./package.json": "./package.json",
     ".": {
-      "module": "./index.esm.js",
       "types": "./index.d.ts",
-      "import": "./index.cjs.mjs",
-      "default": "./index.cjs.js"
+      "import": "./index.esm.js",
+      "default": "./index.esm.js"
     }
   },
   "module": "./index.esm.js",
-  "main": "./index.cjs.js",
+  "main": "./index.esm.js",
   "types": "./index.d.ts"
-}
+}

package/twilio/package.json

@@ -1,25 +1,25 @@
 {
   "name": "@dereekb/firebase-server/twilio",
-  "version": "13.37.0",
+  "version": "13.39.0",
+  "type": "module",
   "peerDependencies": {
-    "@dereekb/date": "13.37.0",
-    "@dereekb/firebase": "13.37.0",
-    "@dereekb/firebase-server": "13.37.0",
-    "@dereekb/model": "13.37.0",
-    "@dereekb/nestjs": "13.37.0",
-    "@dereekb/rxjs": "13.37.0",
-    "@dereekb/util": "13.37.0"
+    "@dereekb/date": "13.39.0",
+    "@dereekb/firebase": "13.39.0",
+    "@dereekb/firebase-server": "13.39.0",
+    "@dereekb/model": "13.39.0",
+    "@dereekb/nestjs": "13.39.0",
+    "@dereekb/rxjs": "13.39.0",
+    "@dereekb/util": "13.39.0"
   },
   "exports": {
     "./package.json": "./package.json",
     ".": {
-      "module": "./index.esm.js",
       "types": "./index.d.ts",
-      "import": "./index.cjs.mjs",
-      "default": "./index.cjs.js"
+      "import": "./index.esm.js",
+      "default": "./index.esm.js"
     }
   },
   "module": "./index.esm.js",
-  "main": "./index.cjs.js",
+  "main": "./index.esm.js",
   "types": "./index.d.ts"
-}
+}

package/zoho/package.json

@@ -1,16 +1,17 @@
 {
   "name": "@dereekb/firebase-server/zoho",
-  "version": "13.37.0",
+  "version": "13.39.0",
+  "type": "module",
   "peerDependencies": {
-    "@dereekb/analytics": "13.37.0",
-    "@dereekb/date": "13.37.0",
-    "@dereekb/model": "13.37.0",
-    "@dereekb/nestjs": "13.37.0",
-    "@dereekb/rxjs": "13.37.0",
-    "@dereekb/firebase": "13.37.0",
-    "@dereekb/firebase-server": "13.37.0",
-    "@dereekb/util": "13.37.0",
-    "@dereekb/zoho": "13.37.0",
+    "@dereekb/analytics": "13.39.0",
+    "@dereekb/date": "13.39.0",
+    "@dereekb/model": "13.39.0",
+    "@dereekb/nestjs": "13.39.0",
+    "@dereekb/rxjs": "13.39.0",
+    "@dereekb/firebase": "13.39.0",
+    "@dereekb/firebase-server": "13.39.0",
+    "@dereekb/util": "13.39.0",
+    "@dereekb/zoho": "13.39.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1"
@@ -18,13 +19,12 @@
   "exports": {
     "./package.json": "./package.json",
     ".": {
-      "module": "./index.esm.js",
       "types": "./index.d.ts",
-      "import": "./index.cjs.mjs",
-      "default": "./index.cjs.js"
+      "import": "./index.esm.js",
+      "default": "./index.esm.js"
     }
   },
   "module": "./index.esm.js",
-  "main": "./index.cjs.js",
+  "main": "./index.esm.js",
   "types": "./index.d.ts"
-}
+}

package/calcom/index.cjs.default.js

@@ -1 +0,0 @@
-exports._default = require('./index.cjs.js').default;