@dereekb/firebase-server 13.6.17 → 13.8.0

package/oidc/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.6.17",
+  "version": "13.8.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.6.17",
-    "@dereekb/date": "13.6.17",
-    "@dereekb/firebase": "13.6.17",
-    "@dereekb/firebase-server": "13.6.17",
-    "@dereekb/model": "13.6.17",
-    "@dereekb/nestjs": "13.6.17",
-    "@dereekb/rxjs": "13.6.17",
-    "@dereekb/util": "13.6.17",
-    "@dereekb/zoho": "13.6.17",
+    "@dereekb/analytics": "13.8.0",
+    "@dereekb/date": "13.8.0",
+    "@dereekb/firebase": "13.8.0",
+    "@dereekb/firebase-server": "13.8.0",
+    "@dereekb/model": "13.8.0",
+    "@dereekb/nestjs": "13.8.0",
+    "@dereekb/rxjs": "13.8.0",
+    "@dereekb/util": "13.8.0",
+    "@dereekb/zoho": "13.8.0",
     "@nestjs/common": "^11.1.17",
-    "@nestjs/config": "^4.0.3",
+    "@nestjs/config": "^4.0.4",
     "express": "^5.0.0",
-    "firebase-admin": "^13.0.0",
+    "firebase-admin": "^13.8.0",
     "nanoid": "^5.1.7",
     "oidc-provider": "^9.7.0"
   },

package/oidc/src/lib/middleware/oauth-auth.module.d.ts

@@ -1,4 +1,4 @@
-import { type MiddlewareConsumer } from '@nestjs/common';
+import { type INestApplication } from '@nestjs/common';
 import { type SlashPath } from '@dereekb/util';
 /**
  * Configuration for `OidcAuthBearerTokenMiddleware` route protection.
@@ -6,12 +6,6 @@ import { type SlashPath } from '@dereekb/util';
  * Works in reverse of `FirebaseAppCheckMiddlewareConfig`: instead of protecting
  * all routes and ignoring some, this only protects explicitly specified paths.
  * Routes under the global API prefix (protected by AppCheck) are excluded.
- *
- * @example
- * ```ts
- * // Provide in your module:
- * { provide: OidcAuthMiddlewareConfig, useValue: { protectedPaths: ['/mcp'] } }
- * ```
  */
 export declare abstract class OidcAuthMiddlewareConfig {
     /**
@@ -24,27 +18,26 @@ export declare abstract class OidcAuthMiddlewareConfig {
     readonly protectedPaths: SlashPath[];
 }
 /**
- * Middleware module that applies OAuth bearer token verification
- * to paths specified in `OidcAuthMiddlewareConfig`.
+ * Applies OAuth bearer token verification as global Express middleware on
+ * the given NestJS application.
  *
- * Only protects explicitly listed paths — all other routes pass through.
- * This is the inverse of `ConfigureFirebaseAppCheckMiddlewareModule`, which
- * protects everything and ignores specific paths.
+ * Resolves `OidcService` and `OidcAuthMiddlewareConfig` from the app's DI container,
+ * then registers an Express middleware that verifies bearer tokens for the configured
+ * protected paths and attaches auth data to `req.auth`.
+ *
+ * This is an alternative to {@link ConfigureOidcAuthMiddlewareModule} for cases where
+ * NestJS module scoping makes the module approach impractical.
+ *
+ * @param nestApp - The NestJS application instance used to resolve dependencies and register the middleware.
  *
  * @example
  * ```ts
- * @Module({
- *   imports: [ConfigureOidcAuthMiddlewareModule],
- *   providers: [
- *     { provide: OidcAuthMiddlewareConfig, useValue: { protectedPaths: ['/mcp'] } }
- *   ]
- * })
- * export class AppModule {}
+ * export const APP_NEST_SERVER_CONFIG: NestServerInstanceConfig<AppModule> = {
+ *   moduleClass: AppModule,
+ *   configureNestServerInstance: (nestApp) => {
+ *     applyOidcAuthMiddleware(nestApp);
+ *   }
+ * };
  * ```
  */
-export declare class ConfigureOidcAuthMiddlewareModule {
-    private readonly config?;
-    private readonly logger;
-    constructor(config?: OidcAuthMiddlewareConfig | undefined);
-    configure(consumer: MiddlewareConsumer): void;
-}
+export declare function applyOidcAuthMiddleware(nestApp: INestApplication): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.6.17",
+  "version": "13.8.0",
   "exports": {
     "./test": {
       "module": "./test/index.esm.js",
@@ -43,27 +43,27 @@
   "main": "./index.cjs.js",
   "types": "./src/index.d.ts",
   "peerDependencies": {
-    "@dereekb/analytics": "13.6.17",
-    "@dereekb/date": "13.6.17",
-    "@dereekb/dbx-core": "13.6.17",
-    "@dereekb/firebase": "13.6.17",
-    "@dereekb/model": "13.6.17",
-    "@dereekb/nestjs": "13.6.17",
-    "@dereekb/rxjs": "13.6.17",
-    "@dereekb/util": "13.6.17",
-    "@dereekb/zoho": "13.6.17",
+    "@dereekb/analytics": "13.8.0",
+    "@dereekb/date": "13.8.0",
+    "@dereekb/dbx-core": "13.8.0",
+    "@dereekb/firebase": "13.8.0",
+    "@dereekb/model": "13.8.0",
+    "@dereekb/nestjs": "13.8.0",
+    "@dereekb/rxjs": "13.8.0",
+    "@dereekb/util": "13.8.0",
+    "@dereekb/zoho": "13.8.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.17",
-    "@nestjs/config": "^4.0.3",
-    "@nestjs/core": "^11.1.17",
-    "@nestjs/platform-express": "^11.1.17",
+    "@nestjs/config": "^4.0.4",
+    "@nestjs/core": "^11.1.18",
+    "@nestjs/platform-express": "^11.1.18",
     "@nestjs/testing": "^11.1.14",
     "archiver": "^7.0.0",
     "arktype": "^2.2.0",
     "date-fns": "^4.0.0",
     "express": "^5.0.0",
-    "firebase-admin": "^13.0.0",
+    "firebase-admin": "^13.8.0",
     "firebase-functions": "^7.0.0",
     "firebase-functions-test": "3.4.1",
     "jsonwebtoken": "^9.0.0",
@@ -71,6 +71,7 @@
     "nanoid": "^5.1.7",
     "oidc-provider": "^9.7.0",
     "rxjs": "^7.8.0",
+    "supertest": "^7.2.2",
     "ts-essentials": "^10.0.0"
   },
   "module": "./index.esm.js"

package/src/lib/auth/auth.service.d.ts

@@ -583,6 +583,234 @@ export declare abstract class AbstractFirebaseServerNewUserService<U extends Fir
 export declare class NoSetupContentFirebaseServerNewUserService<U extends FirebaseServerAuthUserContext = FirebaseServerAuthUserContext> extends AbstractFirebaseServerNewUserService<U> {
     protected sendSetupContentToUser(_details: FirebaseServerAuthNewUserSetupDetails<U>): Promise<void>;
 }
+/**
+ * Configuration for initiating a password reset flow for an existing Firebase Auth user.
+ *
+ * Supports identifying the user by UID or email, and optionally sending reset content
+ * (e.g., an email with the temporary password) immediately after initiation.
+ *
+ * @example
+ * ```typescript
+ * await passwordResetService.beginPasswordReset({
+ *   uid: 'some-uid',
+ *   sendResetContent: true,
+ *   sendResetThrowErrors: true
+ * });
+ * ```
+ */
+export interface FirebaseServerAuthInitiatePasswordReset<D = unknown> {
+    /**
+     * Specific user identifier to use.
+     */
+    readonly uid?: Maybe<FirebaseAuthUserId>;
+    /**
+     * Email for the user, if identifying by email.
+     */
+    readonly email?: Maybe<EmailAddress>;
+    /**
+     * Whether or not to send a reset email. Is false by default.
+     */
+    readonly sendResetContent?: Maybe<boolean>;
+    /**
+     * If true, and the reset content has been sent before, it will not be sent again.
+     */
+    readonly sendResetDetailsOnce?: Maybe<boolean>;
+    /**
+     * If true, will ignore throttling when sending reset content.
+     */
+    readonly sendResetIgnoreThrottle?: Maybe<boolean>;
+    /**
+     * Whether or not to throw an error if sending reset content fails. Is false by default.
+     */
+    readonly sendResetThrowErrors?: Maybe<boolean>;
+    /**
+     * Whether or not to force sending the test details.
+     */
+    readonly sendDetailsInTestEnvironment?: Maybe<boolean>;
+    /**
+     * Any additional reset context.
+     */
+    readonly data?: Maybe<D>;
+}
+/**
+ * Configuration options for sending password reset content (e.g., reset email) to a user.
+ *
+ * Controls throttling, send-once behavior, and error handling for the delivery process.
+ */
+export interface FirebaseServerAuthPasswordResetSendContentConfig<D = unknown> {
+    /**
+     * Whether or not to force sending the test details. Usage differs between providers.
+     */
+    readonly sendDetailsInTestEnvironment?: Maybe<boolean>;
+    /**
+     * Whether or not to skip sending again if the reset content has already been sent once.
+     */
+    readonly sendResetDetailsOnce?: Maybe<boolean>;
+    /**
+     * Whether or not to force sending again even if the send is being throttled.
+     */
+    readonly ignoreSendThrottleTime?: Maybe<boolean>;
+    /**
+     * Whether or not to throw errors if the send fails, instead of returning false.
+     *
+     * @see FirebaseServerAuthPasswordResetNoResetConfigError
+     * @see FirebaseServerAuthPasswordResetThrottleError
+     */
+    readonly throwErrors?: Maybe<boolean>;
+    /**
+     * Any additional reset context.
+     */
+    readonly data?: Maybe<D>;
+}
+/**
+ * Details about a user that is in the password reset phase, including their user context,
+ * reset claims data, and the send configuration that was used.
+ */
+export interface FirebaseServerAuthPasswordResetDetails<U extends FirebaseServerAuthUserContext = FirebaseServerAuthUserContext, D = unknown> extends FirebaseServerAuthPasswordResetSendContentConfig<D> {
+    readonly userContext: U;
+    readonly claims: FirebaseAuthResetUserPasswordClaimsData;
+}
+/**
+ * Input for completing a password reset, containing the temporary reset code
+ * and the desired new password.
+ */
+export interface FirebaseServerAuthCompletePasswordResetInput {
+    /**
+     * The temporary reset code from the reset email, to be verified against claims.
+     */
+    readonly resetPassword: string;
+    /**
+     * The new password to set after verification succeeds.
+     */
+    readonly newPassword: PasswordString;
+}
+/**
+ * Service for managing password reset flows for existing Firebase Auth users.
+ *
+ * Handles initiating password resets (generating temporary passwords), sending reset content
+ * (with throttling), loading reset state, and completing the reset by setting a new password.
+ *
+ * @example
+ * ```typescript
+ * const resetSvc = authService.passwordReset();
+ * const claims = await resetSvc.beginPasswordReset({ uid: 'some-uid', sendResetContent: true });
+ * // Later, after user verifies identity:
+ * await resetSvc.completePasswordReset('some-uid', { resetPassword: '123456', newPassword: 'newSecure' });
+ * ```
+ */
+export interface FirebaseServerUserPasswordResetService<D = unknown, U extends FirebaseServerAuthUserContext = FirebaseServerAuthUserContext> {
+    /**
+     * Initiates a password reset for the identified user, generating a temporary password
+     * and storing reset claims. Optionally sends reset content (e.g., email) immediately.
+     *
+     * When `sendResetContent` is true, this method delegates to {@link sendResetContent} and
+     * may throw the same errors (throttle, send-once, no-config) depending on the configuration.
+     *
+     * @param input - Configuration for the reset, including user identification and send options.
+     * @throws Throws if neither uid nor email is provided.
+     * @throws {FirebaseServerAuthPasswordResetThrottleError} When send is throttled and `sendResetThrowErrors` is true.
+     * @throws {FirebaseServerAuthPasswordResetSendOnceError} When already sent and `sendResetDetailsOnce` + `sendResetThrowErrors` are true.
+     * @throws {FirebaseServerAuthPasswordResetNoResetConfigError} When no reset claims exist and `sendResetThrowErrors` is true.
+     */
+    beginPasswordReset(input: FirebaseServerAuthInitiatePasswordReset<D>): Promise<FirebaseServerAuthResetUserPasswordClaims>;
+    /**
+     * Sends reset content (e.g., a reset email) to the user.
+     *
+     * Respects throttling and send-once constraints from the config. Returns `true` if
+     * content was actually sent, `false` if skipped due to throttling or send-once rules.
+     *
+     * @param uid - The target user's UID.
+     * @param config - Optional delivery configuration.
+     * @throws {FirebaseServerAuthPasswordResetThrottleError} When throttled and `throwErrors` is true.
+     * @throws {FirebaseServerAuthPasswordResetSendOnceError} When already sent and `sendResetDetailsOnce` + `throwErrors` are true.
+     * @throws {FirebaseServerAuthPasswordResetNoResetConfigError} When no reset claims exist and `throwErrors` is true.
+     */
+    sendResetContent(uid: FirebaseAuthUserId, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<boolean>;
+    /**
+     * Loads the reset details for the user if they are in the reset phase.
+     *
+     * @param uid - The target user's UID.
+     * @param config - Optional config to forward to the details.
+     * @returns The reset details, or `undefined` if the user does not exist or has no reset claims.
+     */
+    loadResetDetails(uid: FirebaseAuthUserId, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<Maybe<FirebaseServerAuthPasswordResetDetails<U, D>>>;
+    /**
+     * Loads the reset details for a user context that is already resolved.
+     *
+     * @param userContext - The resolved user context.
+     * @param config - Optional config to forward to the details.
+     * @returns The reset details, or `undefined` if the user has no reset claims.
+     */
+    loadResetDetailsForUserContext(userContext: U, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<Maybe<FirebaseServerAuthPasswordResetDetails<U, D>>>;
+    /**
+     * Completes the password reset by verifying the temporary reset code against the user's
+     * claims and setting the new password. Clears reset claims on success.
+     *
+     * @param uid - The target user's UID.
+     * @param input - The reset code and new password.
+     * @throws {FirebaseServerAuthPasswordResetInvalidCodeError} When the reset code is invalid or no reset is active.
+     */
+    completePasswordReset(uid: FirebaseAuthUserId, input: FirebaseServerAuthCompletePasswordResetInput): Promise<admin.auth.UserRecord>;
+}
+/**
+ * Default throttle duration (1 hour) between reset content sends to prevent spam.
+ *
+ * Used by {@link AbstractFirebaseServerUserPasswordResetService.sendResetContent} to rate-limit delivery.
+ */
+export declare const DEFAULT_RESET_COM_THROTTLE_TIME: number;
+/**
+ * Base implementation of {@link FirebaseServerUserPasswordResetService} that handles reset initiation,
+ * claims management, throttled reset content delivery, and reset completion.
+ *
+ * Subclasses must implement {@link sendPasswordResetContentToUser} to define how reset content
+ * (e.g., reset email, SMS) is delivered to the user.
+ *
+ * @example
+ * ```typescript
+ * export class MyPasswordResetService extends AbstractFirebaseServerUserPasswordResetService<MyUserContext> {
+ *   protected async sendPasswordResetContentToUser(details: FirebaseServerAuthPasswordResetDetails<MyUserContext>): Promise<void> {
+ *     await this.emailService.sendResetEmail(details.userContext.uid, details.claims.resetPassword);
+ *   }
+ * }
+ * ```
+ */
+export declare abstract class AbstractFirebaseServerUserPasswordResetService<U extends FirebaseServerAuthUserContext = FirebaseServerAuthUserContext, C extends FirebaseServerAuthContext = FirebaseServerAuthContext, D = unknown> implements FirebaseServerUserPasswordResetService<D, U> {
+    private readonly _authService;
+    /**
+     * Minimum time between reset content sends. Defaults to {@link DEFAULT_RESET_COM_THROTTLE_TIME} (1 hour).
+     * Override in subclasses to customize the throttle window.
+     */
+    protected resetThrottleTime: Milliseconds;
+    constructor(authService: FirebaseServerAuthService<U, C>);
+    get authService(): FirebaseServerAuthService<U, C>;
+    beginPasswordReset(input: FirebaseServerAuthInitiatePasswordReset<D>): Promise<FirebaseServerAuthResetUserPasswordClaims>;
+    sendResetContent(uid: FirebaseAuthUserId, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<boolean>;
+    loadResetDetails(uid: FirebaseAuthUserId, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<Maybe<FirebaseServerAuthPasswordResetDetails<U, D>>>;
+    loadResetDetailsForUserContext(userContext: U, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<Maybe<FirebaseServerAuthPasswordResetDetails<U, D>>>;
+    /**
+     * Records the current timestamp as the last reset content communication date in the user's claims.
+     *
+     * @param details - The user's reset details containing the user context.
+     */
+    protected updateResetContentSentTime(details: FirebaseServerAuthPasswordResetDetails<U, D>): Promise<void>;
+    completePasswordReset(uid: FirebaseAuthUserId, input: FirebaseServerAuthCompletePasswordResetInput): Promise<admin.auth.UserRecord>;
+    /**
+     * Delivers reset content (e.g., reset email, SMS) to the user.
+     *
+     * Subclasses must implement this to define the actual delivery mechanism.
+     *
+     * @param details - The user's reset details, including their context and reset claims.
+     */
+    protected abstract sendPasswordResetContentToUser(details: FirebaseServerAuthPasswordResetDetails<U, D>): Promise<void>;
+}
+/**
+ * No-op implementation of {@link AbstractFirebaseServerUserPasswordResetService} that skips sending reset content.
+ *
+ * Used as the default {@link FirebaseServerUserPasswordResetService} when no custom delivery mechanism is configured.
+ */
+export declare class NoContentFirebaseServerUserPasswordResetService<U extends FirebaseServerAuthUserContext = FirebaseServerAuthUserContext> extends AbstractFirebaseServerUserPasswordResetService<U> {
+    protected sendPasswordResetContentToUser(_details: FirebaseServerAuthPasswordResetDetails<U>): Promise<void>;
+}
 /**
  * Reference to a FirebaseServerAuthService
  */
@@ -686,6 +914,10 @@ export declare abstract class FirebaseServerAuthService<U extends FirebaseServer
      * Returns a {@link FirebaseServerNewUserService} for programmatic user creation and setup management.
      */
     abstract newUser(): FirebaseServerNewUserService;
+    /**
+     * Returns a {@link FirebaseServerUserPasswordResetService} for managing password reset flows.
+     */
+    abstract passwordReset(): FirebaseServerUserPasswordResetService;
     /**
      * Converts a Firebase Admin {@link admin.auth.UserRecord} into a normalized {@link FirebaseAuthDetails} object.
      *
@@ -735,6 +967,7 @@ export declare abstract class AbstractFirebaseServerAuthService<U extends Fireba
     abstract readRoles(claims: AuthClaims): AuthRoleSet;
     abstract claimsForRoles(roles: AuthRoleSet): AuthClaimsUpdate;
     newUser(): FirebaseServerNewUserService;
+    passwordReset(): FirebaseServerUserPasswordResetService;
     authContextInfo(context: AuthDataRef): Maybe<FirebaseAuthContextInfo>;
     authDetailsForRecord(record: admin.auth.UserRecord): FirebaseAuthDetails;
 }

package/src/lib/auth/auth.service.error.d.ts

@@ -65,3 +65,32 @@ export declare class FirebaseServerAuthNewUserSendSetupDetailsThrottleError exte
 export declare class FirebaseServerAuthNewUserSendSetupDetailsSendOnceError extends BaseError {
     constructor();
 }
+/**
+ * Thrown by {@link AbstractFirebaseServerUserPasswordResetService.sendResetContent} when the user
+ * has no active password reset claims, meaning no reset has been initiated or it has already been completed.
+ */
+export declare class FirebaseServerAuthPasswordResetNoResetConfigError extends BaseError {
+    constructor();
+}
+/**
+ * Thrown by {@link AbstractFirebaseServerUserPasswordResetService.sendResetContent} when the user
+ * was recently sent reset content and the throttle window has not elapsed.
+ */
+export declare class FirebaseServerAuthPasswordResetThrottleError extends BaseError {
+    readonly lastSentAt: Date;
+    constructor(lastSentAt: Date);
+}
+/**
+ * Thrown by {@link AbstractFirebaseServerUserPasswordResetService.sendResetContent} when the user
+ * has already been sent reset content and the `sendResetDetailsOnce` option was enabled.
+ */
+export declare class FirebaseServerAuthPasswordResetSendOnceError extends BaseError {
+    constructor();
+}
+/**
+ * Thrown by {@link AbstractFirebaseServerUserPasswordResetService.completePasswordReset} when the
+ * provided reset code does not match the one stored in the user's claims, or no reset is active.
+ */
+export declare class FirebaseServerAuthPasswordResetInvalidCodeError extends BaseError {
+    constructor();
+}

package/src/lib/auth/auth.service.error.util.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Wraps an async function that uses {@link FirebaseServerUserPasswordResetService} methods,
+ * catching password-reset-specific errors and re-throwing them as appropriate {@link HttpsError} instances
+ * suitable for returning to clients.
+ *
+ * Error mapping:
+ * - {@link FirebaseServerAuthPasswordResetInvalidCodeError} → permission-denied (403)
+ * - {@link FirebaseServerAuthPasswordResetNoResetConfigError} → bad-request (400)
+ * - {@link FirebaseServerAuthPasswordResetThrottleError} → unavailable (503)
+ * - {@link FirebaseServerAuthPasswordResetSendOnceError} → bad-request (400)
+ *
+ * @param fn - The async function to execute.
+ * @returns The result of the function.
+ */
+export declare function catchAndThrowPasswordResetServerErrors<T>(fn: () => Promise<T>): Promise<T>;
+/**
+ * Creates a permission-denied (403) server error for an invalid or expired password reset code.
+ *
+ * @returns An {@link HttpsError} with code `permission-denied`.
+ */
+export declare function authServicePasswordResetInvalidCodeError(): import("firebase-functions/https").HttpsError;
+/**
+ * Creates a bad-request (400) server error when no active password reset exists for the user.
+ *
+ * @returns An {@link HttpsError} with code `invalid-argument`.
+ */
+export declare function authServicePasswordResetNoConfigError(): import("firebase-functions/https").HttpsError;
+/**
+ * Creates an unavailable (503) server error when password reset email sending is throttled.
+ *
+ * @returns An {@link HttpsError} with code `unavailable`.
+ */
+export declare function authServicePasswordResetThrottleError(): import("firebase-functions/https").HttpsError;
+/**
+ * Creates a bad-request (400) server error when the password reset email has already been sent
+ * and the send-once constraint is active.
+ *
+ * @returns An {@link HttpsError} with code `invalid-argument`.
+ */
+export declare function authServicePasswordResetSendOnceError(): import("firebase-functions/https").HttpsError;

package/src/lib/auth/index.d.ts

@@ -1,4 +1,5 @@
 export * from './auth.service';
 export * from './auth.service.error';
+export * from './auth.service.error.util';
 export * from './auth.context';
 export * from './auth.util';

package/src/lib/function/error.d.ts

@@ -14,100 +14,83 @@ export declare function unauthenticatedContextHasNoAuthData(): HttpsError;
  * @returns A new unauthenticated {@link HttpsError} with the no-auth error code.
  */
 export declare function unauthenticatedContextHasNoUidError(): HttpsError;
-/**
- * Standard error code constants and factory functions for creating typed {@link HttpsError} instances.
- *
- * Each factory wraps the Firebase `HttpsError` with a consistent shape: an HTTP status code,
- * a string error code, and an optional {@link ServerError} detail object.
- */
-export declare const UNAUTHENTICATED_ERROR_CODE = "UNAUTHENTICATED";
 /**
  * Creates an unauthenticated (401) {@link HttpsError}.
  *
  * @param messageOrError - Optional error message string or partial server error object.
  * @returns A new unauthenticated (401) {@link HttpsError}.
  */
-export declare function unauthenticatedError(messageOrError?: ErrorMessageOrPartialServerError): HttpsError;
-export declare const FORBIDDEN_ERROR_CODE = "FORBIDDEN";
+export declare function unauthenticatedError(messageOrError?: Maybe<ErrorMessageOrPartialServerError>): HttpsError;
 /**
  * Creates a forbidden (403) {@link HttpsError}.
  *
  * @param messageOrError - Optional error message string or partial server error object.
  * @returns A new forbidden (403) {@link HttpsError}.
  */
-export declare function forbiddenError(messageOrError?: ErrorMessageOrPartialServerError): HttpsError;
-export declare const PERMISSION_DENIED_ERROR_CODE = "PERMISSION_DENIED";
+export declare function forbiddenError(messageOrError?: Maybe<ErrorMessageOrPartialServerError>): HttpsError;
 /**
  * Creates a permission-denied (403) {@link HttpsError}.
  *
  * @param messageOrError - Optional error message string or partial server error object.
  * @returns A new permission-denied (403) {@link HttpsError}.
  */
-export declare function permissionDeniedError(messageOrError?: ErrorMessageOrPartialServerError): HttpsError;
-export declare const NOT_FOUND_ERROR_CODE = "NOT_FOUND";
+export declare function permissionDeniedError(messageOrError?: Maybe<ErrorMessageOrPartialServerError>): HttpsError;
 /**
  * Creates a not-found (404) {@link HttpsError}.
  *
  * @param messageOrError - Optional error message string or partial server error object.
  * @returns A new not-found (404) {@link HttpsError}.
  */
-export declare function notFoundError(messageOrError?: ErrorMessageOrPartialServerError): HttpsError;
-export declare const MODEL_NOT_AVAILABLE_ERROR_CODE = "MODEL_NOT_AVAILABLE";
+export declare function notFoundError(messageOrError?: Maybe<ErrorMessageOrPartialServerError>): HttpsError;
 /**
  * Creates a model-not-available (404) {@link HttpsError}, used when a Firestore document does not exist.
  *
  * @param messageOrError - Optional error message string or partial server error object.
  * @returns A new model-not-available (404) {@link HttpsError}.
  */
-export declare function modelNotAvailableError(messageOrError?: ErrorMessageOrPartialServerError): HttpsError;
-export declare const BAD_REQUEST_ERROR_CODE = "BAD_REQUEST";
+export declare function modelNotAvailableError(messageOrError?: Maybe<ErrorMessageOrPartialServerError>): HttpsError;
 /**
  * Creates a bad-request (400) {@link HttpsError}.
  *
  * @param messageOrError - Optional error message string or partial server error object.
  * @returns A new bad-request (400) {@link HttpsError}.
  */
-export declare function badRequestError(messageOrError?: ErrorMessageOrPartialServerError): HttpsError;
-export declare const CONFLICT_ERROR_CODE = "CONFLICT";
+export declare function badRequestError(messageOrError?: Maybe<ErrorMessageOrPartialServerError>): HttpsError;
 /**
  * Creates a precondition-conflict (409) {@link HttpsError}.
  *
  * @param messageOrError - Optional error message string or partial server error object.
  * @returns A new precondition-conflict (409) {@link HttpsError}.
  */
-export declare function preconditionConflictError(messageOrError?: ErrorMessageOrPartialServerError): HttpsError;
-export declare const ALREADY_EXISTS_ERROR_CODE = "ALREADY_EXISTS";
+export declare function preconditionConflictError(messageOrError?: Maybe<ErrorMessageOrPartialServerError>): HttpsError;
 /**
  * Creates an already-exists (409) {@link HttpsError}.
  *
  * @param messageOrError - Optional error message string or partial server error object.
  * @returns A new already-exists (409) {@link HttpsError}.
  */
-export declare function alreadyExistsError(messageOrError?: ErrorMessageOrPartialServerError): HttpsError;
-export declare const UNAVAILABLE_ERROR_CODE = "UNAVAILABLE";
+export declare function alreadyExistsError(messageOrError?: Maybe<ErrorMessageOrPartialServerError>): HttpsError;
 /**
  * Creates an unavailable (503) {@link HttpsError}.
  *
  * @param messageOrError - Optional error message string or partial server error object.
  * @returns A new unavailable (503) {@link HttpsError}.
  */
-export declare function unavailableError(messageOrError?: ErrorMessageOrPartialServerError): HttpsError;
-export declare const UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE = "UNAVAILABLE_OR_DEACTIVATED_FUNCTION";
+export declare function unavailableError(messageOrError?: Maybe<ErrorMessageOrPartialServerError>): HttpsError;
 /**
  * Creates an unimplemented (501) {@link HttpsError} for deactivated or unavailable functions.
  *
  * @param messageOrError - Optional error message string or partial server error object.
  * @returns A new unimplemented (501) {@link HttpsError}.
  */
-export declare function unavailableOrDeactivatedFunctionError(messageOrError?: ErrorMessageOrPartialServerError): HttpsError;
-export declare const INTERNAL_SERVER_ERROR_CODE = "INTERNAL_ERROR";
+export declare function unavailableOrDeactivatedFunctionError(messageOrError?: Maybe<ErrorMessageOrPartialServerError>): HttpsError;
 /**
  * Creates an internal-error (500) {@link HttpsError}.
  *
  * @param messageOrError - Optional error message string or partial server error object.
  * @returns A new internal-error (500) {@link HttpsError}.
  */
-export declare function internalServerError(messageOrError?: ErrorMessageOrPartialServerError): HttpsError;
+export declare function internalServerError(messageOrError?: Maybe<ErrorMessageOrPartialServerError>): HttpsError;
 /**
  * Discriminator for the type of Firebase server error encountered.
  */