@dereekb/firebase-server 13.7.0 → 13.8.0

package/index.esm.js

@@ -1,4 +1,4 @@
-import { DBX_FIREBASE_SERVER_NO_AUTH_ERROR_CODE, UNAUTHENTICATED_ERROR_CODE, FORBIDDEN_ERROR_CODE, PERMISSION_DENIED_ERROR_CODE, NOT_FOUND_ERROR_CODE, MODEL_NOT_AVAILABLE_ERROR_CODE, BAD_REQUEST_ERROR_CODE, CONFLICT_ERROR_CODE, ALREADY_EXISTS_ERROR_CODE, UNAVAILABLE_ERROR_CODE, UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE, INTERNAL_SERVER_ERROR_CODE, FIREBASE_AUTH_USER_NOT_FOUND_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_EMAIL_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_INVALID_PHONE_NUMBER_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, FirestoreDocumentContextType, streamFromOnSnapshot, makeFirestoreQueryConstraintFunctionsDriver, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, firestoreContextFactory, firestoreField, optionalFirestoreField, setIdAndKeyFromKeyIdRefOnDocumentData, MODEL_FUNCTION_FIREBASE_CRUD_FUNCTION_SPECIFIER_DEFAULT, UNKNOWN_MODEL_TYPE_ERROR_CODE, BAD_DOCUMENT_QUERY_CURSOR_ERROR_CODE, limit, startAfter, DEFAULT_ON_CALL_QUERY_MODEL_LIMIT, MAX_ON_CALL_QUERY_MODEL_LIMIT, ScheduledFunctionDevelopmentFunctionTypeEnum, SCHEDULED_FUNCTION_DEV_FUNCTION_SPECIFIER, storageListFilesResultFactory, assertStorageUploadOptionsStringFormat, firebaseStorageContextFactory, inContextFirebaseModelsServiceFactory, useFirebaseModelsService } from '@dereekb/firebase';
+import { DBX_FIREBASE_SERVER_NO_AUTH_ERROR_CODE, UNAUTHENTICATED_ERROR_CODE, FORBIDDEN_ERROR_CODE, PERMISSION_DENIED_ERROR_CODE, NOT_FOUND_ERROR_CODE, MODEL_NOT_AVAILABLE_ERROR_CODE, BAD_REQUEST_ERROR_CODE, CONFLICT_ERROR_CODE, ALREADY_EXISTS_ERROR_CODE, UNAVAILABLE_ERROR_CODE, UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE, INTERNAL_SERVER_ERROR_CODE, FIREBASE_AUTH_USER_NOT_FOUND_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_EMAIL_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_INVALID_PHONE_NUMBER_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, setIdAndKeyFromKeyIdRefOnDocumentData, DBX_FIREBASE_SERVER_PASSWORD_RESET_INVALID_CODE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_NO_CONFIG_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_SEND_ONCE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_THROTTLE_ERROR_CODE, FirestoreDocumentContextType, streamFromOnSnapshot, makeFirestoreQueryConstraintFunctionsDriver, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, firestoreContextFactory, firestoreField, optionalFirestoreField, MODEL_FUNCTION_FIREBASE_CRUD_FUNCTION_SPECIFIER_DEFAULT, UNKNOWN_MODEL_TYPE_ERROR_CODE, BAD_DOCUMENT_QUERY_CURSOR_ERROR_CODE, limit, startAfter, DEFAULT_ON_CALL_QUERY_MODEL_LIMIT, MAX_ON_CALL_QUERY_MODEL_LIMIT, ScheduledFunctionDevelopmentFunctionTypeEnum, SCHEDULED_FUNCTION_DEV_FUNCTION_SPECIFIER, storageListFilesResultFactory, assertStorageUploadOptionsStringFormat, firebaseStorageContextFactory, inContextFirebaseModelsServiceFactory, useFirebaseModelsService } from '@dereekb/firebase';
 import { partialServerError, isServerError, randomNumberFactory, cachedGetter, filterNullAndUndefinedValues, asSet, AUTH_ADMIN_ROLE, AUTH_TOS_SIGNED_ROLE, forEachKeyValue, KeyValueTypleValueFilter, filterUndefinedValues, isThrottled, mapObjectMap, batch, objectToMap, serverError, asArray, containsAllValues, websiteUrlDetails, mergeObjects, cronExpressionRepeatingEveryNMinutes, mapIdentityFunction, slashPathName, toRelativeSlashPathStartType, fixMultiSlashesInSlashPath, SLASH_PATH_SEPARATOR, objectHasNoKeys, websiteUrlFromPaths, pushItemOrArrayItemsIntoArray, makeGetter, asGetter, build, performAsyncTasks } from '@dereekb/util';
 import { HttpsError } from 'firebase-functions/https';
 import { hoursToMs, toISODateString } from '@dereekb/date';
@@ -430,7 +430,7 @@ function _type_of$7(obj) {
     };
 }
 
-function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -444,22 +444,22 @@ function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$g(fn) {
+function _async_to_generator$h(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$g(thisArg, body) {
+function _ts_generator$h(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -575,9 +575,9 @@ function _ts_generator$g(thisArg, body) {
  * }
  * ```
  */ function getAuthUserOrUndefined(promise) {
-    return _async_to_generator$g(function() {
+    return _async_to_generator$h(function() {
         var error;
-        return _ts_generator$g(this, function(_state) {
+        return _ts_generator$h(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -602,9 +602,8 @@ function _ts_generator$g(thisArg, body) {
                             2,
                             undefined
                         ];
-                    } else {
-                        throw error;
                     }
+                    throw error;
                 case 3:
                     return [
                         2
@@ -782,6 +781,62 @@ function _is_native_reflect_construct$5() {
         ]);
     }
     return FirebaseServerAuthNewUserSendSetupDetailsSendOnceError;
+}(BaseError);
+// MARK: Password Reset Errors
+/**
+ * Thrown by {@link AbstractFirebaseServerUserPasswordResetService.sendResetContent} when the user
+ * has no active password reset claims, meaning no reset has been initiated or it has already been completed.
+ */ var FirebaseServerAuthPasswordResetNoResetConfigError = /*#__PURE__*/ function(BaseError) {
+    _inherits$5(FirebaseServerAuthPasswordResetNoResetConfigError, BaseError);
+    function FirebaseServerAuthPasswordResetNoResetConfigError() {
+        _class_call_check$r(this, FirebaseServerAuthPasswordResetNoResetConfigError);
+        return _call_super$5(this, FirebaseServerAuthPasswordResetNoResetConfigError, [
+            "This user has no active password reset configuration."
+        ]);
+    }
+    return FirebaseServerAuthPasswordResetNoResetConfigError;
+}(BaseError);
+/**
+ * Thrown by {@link AbstractFirebaseServerUserPasswordResetService.sendResetContent} when the user
+ * was recently sent reset content and the throttle window has not elapsed.
+ */ var FirebaseServerAuthPasswordResetThrottleError = /*#__PURE__*/ function(BaseError) {
+    _inherits$5(FirebaseServerAuthPasswordResetThrottleError, BaseError);
+    function FirebaseServerAuthPasswordResetThrottleError(lastSentAt) {
+        _class_call_check$r(this, FirebaseServerAuthPasswordResetThrottleError);
+        var _this;
+        _this = _call_super$5(this, FirebaseServerAuthPasswordResetThrottleError, [
+            "This user was recently sent password reset details. Try again later."
+        ]), _define_property$y(_this, "lastSentAt", void 0);
+        _this.lastSentAt = lastSentAt;
+        return _this;
+    }
+    return FirebaseServerAuthPasswordResetThrottleError;
+}(BaseError);
+/**
+ * Thrown by {@link AbstractFirebaseServerUserPasswordResetService.sendResetContent} when the user
+ * has already been sent reset content and the `sendResetDetailsOnce` option was enabled.
+ */ var FirebaseServerAuthPasswordResetSendOnceError = /*#__PURE__*/ function(BaseError) {
+    _inherits$5(FirebaseServerAuthPasswordResetSendOnceError, BaseError);
+    function FirebaseServerAuthPasswordResetSendOnceError() {
+        _class_call_check$r(this, FirebaseServerAuthPasswordResetSendOnceError);
+        return _call_super$5(this, FirebaseServerAuthPasswordResetSendOnceError, [
+            "The user has been sent password reset details before and the sendResetDetailsOnce configuration was true."
+        ]);
+    }
+    return FirebaseServerAuthPasswordResetSendOnceError;
+}(BaseError);
+/**
+ * Thrown by {@link AbstractFirebaseServerUserPasswordResetService.completePasswordReset} when the
+ * provided reset code does not match the one stored in the user's claims, or no reset is active.
+ */ var FirebaseServerAuthPasswordResetInvalidCodeError = /*#__PURE__*/ function(BaseError) {
+    _inherits$5(FirebaseServerAuthPasswordResetInvalidCodeError, BaseError);
+    function FirebaseServerAuthPasswordResetInvalidCodeError() {
+        _class_call_check$r(this, FirebaseServerAuthPasswordResetInvalidCodeError);
+        return _call_super$5(this, FirebaseServerAuthPasswordResetInvalidCodeError, [
+            "The provided reset password code is invalid or expired."
+        ]);
+    }
+    return FirebaseServerAuthPasswordResetInvalidCodeError;
 } 
 (BaseError);
 
@@ -802,7 +857,7 @@ function _assert_this_initialized$4(self) {
     }
     return self;
 }
-function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -816,16 +871,16 @@ function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$f(fn) {
+function _async_to_generator$g(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -972,7 +1027,7 @@ function _is_native_reflect_construct$4() {
         return !!result;
     })();
 }
-function _ts_generator$f(thisArg, body) {
+function _ts_generator$g(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1129,8 +1184,8 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "exists",
             value: function exists() {
-                return _async_to_generator$f(function() {
-                    return _ts_generator$f(this, function(_state) {
+                return _async_to_generator$g(function() {
+                    return _ts_generator$g(this, function(_state) {
                         return [
                             2,
                             getAuthUserOrUndefined(this._loadRecord()).then(function(x) {
@@ -1169,9 +1224,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "beginResetPassword",
             value: function beginResetPassword() {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var password, _obj, passwordClaimsData;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 password = this._generateResetPasswordKey();
@@ -1204,9 +1259,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "loadResetPasswordClaims",
             value: function loadResetPasswordClaims() {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var claims, result;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1228,9 +1283,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "setPassword",
             value: function setPassword(password) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var record, _obj;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1260,8 +1315,8 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "updateUser",
             value: function updateUser(template) {
-                return _async_to_generator$f(function() {
-                    return _ts_generator$f(this, function(_state) {
+                return _async_to_generator$g(function() {
+                    return _ts_generator$g(this, function(_state) {
                         return [
                             2,
                             this.service.auth.updateUser(this.uid, template)
@@ -1273,9 +1328,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "loadRoles",
             value: function loadRoles() {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var claims;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1296,9 +1351,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "addRoles",
             value: function addRoles(roles) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var claims;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         claims = this._claimsForRolesChange(roles);
                         return [
                             2,
@@ -1311,9 +1366,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "removeRoles",
             value: function removeRoles(roles) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var baseClaims, claims;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         baseClaims = this._claimsForRolesChange(roles);
                         claims = {};
                         forEachKeyValue(baseClaims, {
@@ -1349,9 +1404,9 @@ function _ts_generator$f(thisArg, body) {
      * await userCtx.setRoles([AUTH_ADMIN_ROLE], { customFlag: 1 });
      * ```
      */ function setRoles(roles, claimsToRetain) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var claims;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         claims = _object_spread$i({}, claimsToRetain, this._claimsForRolesChange(_to_consumable_array$a(roles)));
                         return [
                             2,
@@ -1385,9 +1440,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "updateClaims",
             value: function updateClaims(claims) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var currentClaims, newClaims;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1572,9 +1627,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "initializeNewUser",
             value: function initializeNewUser(input) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var uid, email, phone, sendSetupContent, sendSetupContentIfUserExists, sendSetupDetailsOnce, sendSetupIgnoreThrottle, sendSetupThrowErrors, data, sendDetailsInTestEnvironment, userRecordPromise, userRecord, userRecordId, createdUser, createResult, userContext, sentEmail, userContext1;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 uid = input.uid, email = input.email, phone = input.phone, sendSetupContent = input.sendSetupContent, sendSetupContentIfUserExists = input.sendSetupContentIfUserExists, sendSetupDetailsOnce = input.sendSetupDetailsOnce, sendSetupIgnoreThrottle = input.sendSetupIgnoreThrottle, sendSetupThrowErrors = input.sendSetupThrowErrors, data = input.data, sendDetailsInTestEnvironment = input.sendDetailsInTestEnvironment;
@@ -1669,9 +1724,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "addNewUserSetupClaims",
             value: function addNewUserSetupClaims(userContextOrUid, setupPassword) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var password, userContext;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 password = setupPassword !== null && setupPassword !== void 0 ? setupPassword : this.generateRandomSetupPassword();
@@ -1694,9 +1749,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "sendSetupContent",
             value: function sendSetupContent(userContextOrUid, config) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var setupDetails, sentContent, setupCommunicationAt, hasSentCommunication, lastSentAt, sendIsThrottled;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1777,9 +1832,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "loadSetupDetails",
             value: function loadSetupDetails(userContextOrUid, config) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var userContext, userExists, details;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 userContext = userContextFromUid(this.authService, userContextOrUid);
@@ -1813,9 +1868,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "loadSetupDetailsForUserContext",
             value: function loadSetupDetailsForUserContext(userContext, config) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var details, _ref, setupPassword, setupCommunicationAt;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1851,9 +1906,9 @@ function _ts_generator$f(thisArg, body) {
      *
      * @param details - The user's setup details containing the user context.
      */ function updateSetupContentSentTime(details) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var setupCommunicationAt;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 setupCommunicationAt = toISODateString(new Date());
@@ -1876,9 +1931,9 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "markUserSetupAsComplete",
             value: function markUserSetupAsComplete(uid) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var userContext, userExists;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 userContext = this.authService.userContext(uid);
@@ -1920,9 +1975,9 @@ function _ts_generator$f(thisArg, body) {
      * @returns The created user record and the setup password used.
      * @throws Throws if the Firebase Admin SDK rejects the user creation.
      */ function createNewUser(input) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var uid, displayName, email, phoneNumber, inputPassword, password, user, e, firebaseError, errorCode;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 uid = input.uid, displayName = input.displayName, email = input.email, phoneNumber = input.phone, inputPassword = input.setupPassword;
@@ -1989,9 +2044,9 @@ function _ts_generator$f(thisArg, body) {
      *
      * @param userContext - The user context to clear setup claims from.
      */ function updateClaimsToClearUser(userContext) {
-                return _async_to_generator$f(function() {
+                return _async_to_generator$g(function() {
                     var _obj;
-                    return _ts_generator$f(this, function(_state) {
+                    return _ts_generator$g(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -2025,8 +2080,8 @@ function _ts_generator$f(thisArg, body) {
         {
             key: "sendSetupContentToUser",
             value: function sendSetupContentToUser(_details) {
-                return _async_to_generator$f(function() {
-                    return _ts_generator$f(this, function(_state) {
+                return _async_to_generator$g(function() {
+                    return _ts_generator$g(this, function(_state) {
                         return [
                             2
                         ];
@@ -2039,111 +2094,460 @@ function _ts_generator$f(thisArg, body) {
     return NoSetupContentFirebaseServerNewUserService;
 }(AbstractFirebaseServerNewUserService);
 /**
- * Abstract contract for a Firebase Server authentication service.
- *
- * Provides the core API for creating auth contexts from callable requests, managing user contexts,
- * checking admin/ToS status, converting between roles and claims, and creating new users.
- *
- * Implement this by extending {@link AbstractFirebaseServerAuthService}, which provides default
- * implementations for most methods and only requires `readRoles`, `claimsForRoles`,
- * `userContext`, and `_context` to be defined.
+ * Default throttle duration (1 hour) between reset content sends to prevent spam.
  *
- * @example
- * ```typescript
- * class MyAuthService extends AbstractFirebaseServerAuthService<MyUserContext, MyAuthContext> {
- *   readRoles(claims: AuthClaims): AuthRoleSet { ... }
- *   claimsForRoles(roles: AuthRoleSet): AuthClaimsUpdate { ... }
- *   userContext(uid: string): MyUserContext { ... }
- *   protected _context(ctx: CallableContextWithAuthData): MyAuthContext { ... }
- * }
- * ```
- */ var FirebaseServerAuthService = function FirebaseServerAuthService() {
-    _class_call_check$q(this, FirebaseServerAuthService);
-};
+ * Used by {@link AbstractFirebaseServerUserPasswordResetService.sendResetContent} to rate-limit delivery.
+ */ var DEFAULT_RESET_COM_THROTTLE_TIME = hoursToMs(1);
 /**
- * Base implementation of {@link FirebaseServerAuthService} providing standard admin/ToS checks,
- * auth context creation with assertion, and a default no-op new user service.
+ * Base implementation of {@link FirebaseServerUserPasswordResetService} that handles reset initiation,
+ * claims management, throttled reset content delivery, and reset completion.
  *
- * Subclasses must implement:
- * - {@link _context} - to create the concrete auth context type.
- * - {@link userContext} - to create the concrete user context type.
- * - {@link readRoles} - to define the claims-to-roles mapping.
- * - {@link claimsForRoles} - to define the roles-to-claims mapping.
+ * Subclasses must implement {@link sendPasswordResetContentToUser} to define how reset content
+ * (e.g., reset email, SMS) is delivered to the user.
  *
  * @example
  * ```typescript
- * export class MyAuthService extends AbstractFirebaseServerAuthService<MyUserContext, MyAuthContext> {
- *   protected _context(context: CallableContextWithAuthData): MyAuthContext {
- *     return new MyAuthContext(this, context);
- *   }
- *   userContext(uid: string): MyUserContext {
- *     return new MyUserContext(this, uid);
- *   }
- *   readRoles(claims: AuthClaims): AuthRoleSet {
- *     return MY_CLAIMS_SERVICE.toRoles(claims);
- *   }
- *   claimsForRoles(roles: AuthRoleSet): AuthClaimsUpdate {
- *     return MY_CLAIMS_SERVICE.toClaims(roles);
+ * export class MyPasswordResetService extends AbstractFirebaseServerUserPasswordResetService<MyUserContext> {
+ *   protected async sendPasswordResetContentToUser(details: FirebaseServerAuthPasswordResetDetails<MyUserContext>): Promise<void> {
+ *     await this.emailService.sendResetEmail(details.userContext.uid, details.claims.resetPassword);
  *   }
  * }
  * ```
- */ var AbstractFirebaseServerAuthService = /*#__PURE__*/ function() {
-    function AbstractFirebaseServerAuthService(auth) {
-        _class_call_check$q(this, AbstractFirebaseServerAuthService);
-        _define_property$x(this, "_auth", void 0);
-        this._auth = auth;
+ */ var AbstractFirebaseServerUserPasswordResetService = /*#__PURE__*/ function() {
+    function AbstractFirebaseServerUserPasswordResetService(authService) {
+        _class_call_check$q(this, AbstractFirebaseServerUserPasswordResetService);
+        _define_property$x(this, "_authService", void 0);
+        /**
+     * Minimum time between reset content sends. Defaults to {@link DEFAULT_RESET_COM_THROTTLE_TIME} (1 hour).
+     * Override in subclasses to customize the throttle window.
+     */ _define_property$x(this, "resetThrottleTime", DEFAULT_RESET_COM_THROTTLE_TIME);
+        this._authService = authService;
     }
-    _create_class$g(AbstractFirebaseServerAuthService, [
+    _create_class$g(AbstractFirebaseServerUserPasswordResetService, [
         {
-            key: "auth",
+            key: "authService",
             get: function get() {
-                return this._auth;
-            }
-        },
-        {
-            key: "context",
-            value: function context(context) {
-                assertIsContextWithAuthData(context);
-                return this._context(context);
-            }
-        },
-        {
-            key: "isAdmin",
-            value: function isAdmin(claims) {
-                return this.isAdminInRoles(this.readRoles(claims));
-            }
-        },
-        {
-            key: "isAdminInRoles",
-            value: function isAdminInRoles(roles) {
-                return roles.has(AUTH_ADMIN_ROLE);
+                return this._authService;
             }
         },
         {
-            key: "hasSignedTos",
-            value: function hasSignedTos(claims) {
-                return this.hasSignedTosInRoles(this.readRoles(claims));
+            key: "beginPasswordReset",
+            value: function beginPasswordReset(input) {
+                return _async_to_generator$g(function() {
+                    var uid, email, sendResetContent, sendResetDetailsOnce, sendResetIgnoreThrottle, sendResetThrowErrors, data, sendDetailsInTestEnvironment, resolvedUid, userRecord, userContext, claims;
+                    return _ts_generator$g(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                uid = input.uid, email = input.email, sendResetContent = input.sendResetContent, sendResetDetailsOnce = input.sendResetDetailsOnce, sendResetIgnoreThrottle = input.sendResetIgnoreThrottle, sendResetThrowErrors = input.sendResetThrowErrors, data = input.data, sendDetailsInTestEnvironment = input.sendDetailsInTestEnvironment;
+                                if (!uid) return [
+                                    3,
+                                    1
+                                ];
+                                resolvedUid = uid;
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 1:
+                                if (!email) return [
+                                    3,
+                                    3
+                                ];
+                                return [
+                                    4,
+                                    this.authService.auth.getUserByEmail(email)
+                                ];
+                            case 2:
+                                userRecord = _state.sent();
+                                resolvedUid = userRecord.uid;
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 3:
+                                throw new Error('uid or email is required to initiate a password reset.');
+                            case 4:
+                                userContext = this.authService.userContext(resolvedUid);
+                                return [
+                                    4,
+                                    userContext.beginResetPassword()
+                                ];
+                            case 5:
+                                claims = _state.sent();
+                                if (!sendResetContent) return [
+                                    3,
+                                    7
+                                ];
+                                return [
+                                    4,
+                                    this.sendResetContent(resolvedUid, {
+                                        data: data,
+                                        sendResetDetailsOnce: sendResetDetailsOnce,
+                                        ignoreSendThrottleTime: sendResetIgnoreThrottle,
+                                        throwErrors: sendResetThrowErrors,
+                                        sendDetailsInTestEnvironment: sendDetailsInTestEnvironment
+                                    })
+                                ];
+                            case 6:
+                                _state.sent();
+                                _state.label = 7;
+                            case 7:
+                                return [
+                                    2,
+                                    claims
+                                ];
+                        }
+                    });
+                }).call(this);
             }
         },
         {
-            key: "hasSignedTosInRoles",
-            value: function hasSignedTosInRoles(roles) {
-                return roles.has(AUTH_TOS_SIGNED_ROLE);
+            key: "sendResetContent",
+            value: function sendResetContent(uid, config) {
+                return _async_to_generator$g(function() {
+                    var resetDetails, sentContent, resetCommunicationAt, hasSentCommunication, lastSentAt, sendIsThrottled;
+                    return _ts_generator$g(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    this.loadResetDetails(uid, config)
+                                ];
+                            case 1:
+                                resetDetails = _state.sent();
+                                sentContent = false;
+                                if (!resetDetails) return [
+                                    3,
+                                    7
+                                ];
+                                resetCommunicationAt = resetDetails.claims.resetCommunicationAt;
+                                hasSentCommunication = Boolean(resetCommunicationAt);
+                                if (!((config === null || config === void 0 ? void 0 : config.sendResetDetailsOnce) && hasSentCommunication)) return [
+                                    3,
+                                    2
+                                ];
+                                if (config.throwErrors) {
+                                    throw new FirebaseServerAuthPasswordResetSendOnceError();
+                                }
+                                return [
+                                    3,
+                                    6
+                                ];
+                            case 2:
+                                lastSentAt = resetCommunicationAt ? new Date(resetCommunicationAt) : undefined;
+                                sendIsThrottled = hasSentCommunication && !(config === null || config === void 0 ? void 0 : config.ignoreSendThrottleTime) && isThrottled(this.resetThrottleTime, lastSentAt);
+                                if (!!sendIsThrottled) return [
+                                    3,
+                                    5
+                                ];
+                                return [
+                                    4,
+                                    this.sendPasswordResetContentToUser(resetDetails)
+                                ];
+                            case 3:
+                                _state.sent();
+                                return [
+                                    4,
+                                    this.updateResetContentSentTime(resetDetails)
+                                ];
+                            case 4:
+                                _state.sent();
+                                sentContent = true;
+                                return [
+                                    3,
+                                    6
+                                ];
+                            case 5:
+                                if (config === null || config === void 0 ? void 0 : config.throwErrors) {
+                                    throw new FirebaseServerAuthPasswordResetThrottleError(lastSentAt);
+                                }
+                                _state.label = 6;
+                            case 6:
+                                return [
+                                    3,
+                                    8
+                                ];
+                            case 7:
+                                if (config === null || config === void 0 ? void 0 : config.throwErrors) {
+                                    throw new FirebaseServerAuthPasswordResetNoResetConfigError();
+                                }
+                                _state.label = 8;
+                            case 8:
+                                return [
+                                    2,
+                                    sentContent
+                                ];
+                        }
+                    });
+                }).call(this);
             }
         },
         {
-            key: "newUser",
-            value: function newUser() {
-                return new NoSetupContentFirebaseServerNewUserService(this);
+            key: "loadResetDetails",
+            value: function loadResetDetails(uid, config) {
+                return _async_to_generator$g(function() {
+                    var userContext, userExists, details;
+                    return _ts_generator$g(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                userContext = this.authService.userContext(uid);
+                                return [
+                                    4,
+                                    userContext.exists()
+                                ];
+                            case 1:
+                                userExists = _state.sent();
+                                if (!userExists) return [
+                                    3,
+                                    3
+                                ];
+                                return [
+                                    4,
+                                    this.loadResetDetailsForUserContext(userContext, config)
+                                ];
+                            case 2:
+                                details = _state.sent();
+                                _state.label = 3;
+                            case 3:
+                                return [
+                                    2,
+                                    details
+                                ];
+                        }
+                    });
+                }).call(this);
             }
         },
         {
-            key: "authContextInfo",
-            value: function authContextInfo(context) {
-                var _this = this;
-                var auth = context.auth;
-                var result;
-                if (auth) {
+            key: "loadResetDetailsForUserContext",
+            value: function loadResetDetailsForUserContext(userContext, config) {
+                return _async_to_generator$g(function() {
+                    var details, claims;
+                    return _ts_generator$g(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    userContext.loadResetPasswordClaims()
+                                ];
+                            case 1:
+                                claims = _state.sent();
+                                if (claims) {
+                                    details = {
+                                        userContext: userContext,
+                                        claims: {
+                                            resetPassword: claims.resetPassword,
+                                            resetCommunicationAt: claims.resetCommunicationAt
+                                        },
+                                        data: config === null || config === void 0 ? void 0 : config.data,
+                                        sendDetailsInTestEnvironment: config === null || config === void 0 ? void 0 : config.sendDetailsInTestEnvironment
+                                    };
+                                }
+                                return [
+                                    2,
+                                    details
+                                ];
+                        }
+                    });
+                })();
+            }
+        },
+        {
+            key: "updateResetContentSentTime",
+            value: /**
+     * Records the current timestamp as the last reset content communication date in the user's claims.
+     *
+     * @param details - The user's reset details containing the user context.
+     */ function updateResetContentSentTime(details) {
+                return _async_to_generator$g(function() {
+                    var resetCommunicationAt;
+                    return _ts_generator$g(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                resetCommunicationAt = toISODateString(new Date());
+                                return [
+                                    4,
+                                    details.userContext.updateClaims(_define_property$x({}, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, resetCommunicationAt))
+                                ];
+                            case 1:
+                                _state.sent();
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                })();
+            }
+        },
+        {
+            key: "completePasswordReset",
+            value: function completePasswordReset(uid, input) {
+                return _async_to_generator$g(function() {
+                    var userContext, claims;
+                    return _ts_generator$g(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                userContext = this.authService.userContext(uid);
+                                return [
+                                    4,
+                                    userContext.loadResetPasswordClaims()
+                                ];
+                            case 1:
+                                claims = _state.sent();
+                                if ((claims === null || claims === void 0 ? void 0 : claims.resetPassword) !== input.resetPassword) {
+                                    throw new FirebaseServerAuthPasswordResetInvalidCodeError();
+                                }
+                                return [
+                                    2,
+                                    userContext.setPassword(input.newPassword)
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return AbstractFirebaseServerUserPasswordResetService;
+}();
+/**
+ * No-op implementation of {@link AbstractFirebaseServerUserPasswordResetService} that skips sending reset content.
+ *
+ * Used as the default {@link FirebaseServerUserPasswordResetService} when no custom delivery mechanism is configured.
+ */ var NoContentFirebaseServerUserPasswordResetService = /*#__PURE__*/ function(AbstractFirebaseServerUserPasswordResetService) {
+    _inherits$4(NoContentFirebaseServerUserPasswordResetService, AbstractFirebaseServerUserPasswordResetService);
+    function NoContentFirebaseServerUserPasswordResetService() {
+        _class_call_check$q(this, NoContentFirebaseServerUserPasswordResetService);
+        return _call_super$4(this, NoContentFirebaseServerUserPasswordResetService, arguments);
+    }
+    _create_class$g(NoContentFirebaseServerUserPasswordResetService, [
+        {
+            key: "sendPasswordResetContentToUser",
+            value: function sendPasswordResetContentToUser(_details) {
+                return _async_to_generator$g(function() {
+                    return _ts_generator$g(this, function(_state) {
+                        return [
+                            2
+                        ];
+                    });
+                // send nothing.
+                })();
+            }
+        }
+    ]);
+    return NoContentFirebaseServerUserPasswordResetService;
+}(AbstractFirebaseServerUserPasswordResetService);
+/**
+ * Abstract contract for a Firebase Server authentication service.
+ *
+ * Provides the core API for creating auth contexts from callable requests, managing user contexts,
+ * checking admin/ToS status, converting between roles and claims, and creating new users.
+ *
+ * Implement this by extending {@link AbstractFirebaseServerAuthService}, which provides default
+ * implementations for most methods and only requires `readRoles`, `claimsForRoles`,
+ * `userContext`, and `_context` to be defined.
+ *
+ * @example
+ * ```typescript
+ * class MyAuthService extends AbstractFirebaseServerAuthService<MyUserContext, MyAuthContext> {
+ *   readRoles(claims: AuthClaims): AuthRoleSet { ... }
+ *   claimsForRoles(roles: AuthRoleSet): AuthClaimsUpdate { ... }
+ *   userContext(uid: string): MyUserContext { ... }
+ *   protected _context(ctx: CallableContextWithAuthData): MyAuthContext { ... }
+ * }
+ * ```
+ */ var FirebaseServerAuthService = function FirebaseServerAuthService() {
+    _class_call_check$q(this, FirebaseServerAuthService);
+};
+/**
+ * Base implementation of {@link FirebaseServerAuthService} providing standard admin/ToS checks,
+ * auth context creation with assertion, and a default no-op new user service.
+ *
+ * Subclasses must implement:
+ * - {@link _context} - to create the concrete auth context type.
+ * - {@link userContext} - to create the concrete user context type.
+ * - {@link readRoles} - to define the claims-to-roles mapping.
+ * - {@link claimsForRoles} - to define the roles-to-claims mapping.
+ *
+ * @example
+ * ```typescript
+ * export class MyAuthService extends AbstractFirebaseServerAuthService<MyUserContext, MyAuthContext> {
+ *   protected _context(context: CallableContextWithAuthData): MyAuthContext {
+ *     return new MyAuthContext(this, context);
+ *   }
+ *   userContext(uid: string): MyUserContext {
+ *     return new MyUserContext(this, uid);
+ *   }
+ *   readRoles(claims: AuthClaims): AuthRoleSet {
+ *     return MY_CLAIMS_SERVICE.toRoles(claims);
+ *   }
+ *   claimsForRoles(roles: AuthRoleSet): AuthClaimsUpdate {
+ *     return MY_CLAIMS_SERVICE.toClaims(roles);
+ *   }
+ * }
+ * ```
+ */ var AbstractFirebaseServerAuthService = /*#__PURE__*/ function() {
+    function AbstractFirebaseServerAuthService(auth) {
+        _class_call_check$q(this, AbstractFirebaseServerAuthService);
+        _define_property$x(this, "_auth", void 0);
+        this._auth = auth;
+    }
+    _create_class$g(AbstractFirebaseServerAuthService, [
+        {
+            key: "auth",
+            get: function get() {
+                return this._auth;
+            }
+        },
+        {
+            key: "context",
+            value: function context(context) {
+                assertIsContextWithAuthData(context);
+                return this._context(context);
+            }
+        },
+        {
+            key: "isAdmin",
+            value: function isAdmin(claims) {
+                return this.isAdminInRoles(this.readRoles(claims));
+            }
+        },
+        {
+            key: "isAdminInRoles",
+            value: function isAdminInRoles(roles) {
+                return roles.has(AUTH_ADMIN_ROLE);
+            }
+        },
+        {
+            key: "hasSignedTos",
+            value: function hasSignedTos(claims) {
+                return this.hasSignedTosInRoles(this.readRoles(claims));
+            }
+        },
+        {
+            key: "hasSignedTosInRoles",
+            value: function hasSignedTosInRoles(roles) {
+                return roles.has(AUTH_TOS_SIGNED_ROLE);
+            }
+        },
+        {
+            key: "newUser",
+            value: function newUser() {
+                return new NoSetupContentFirebaseServerNewUserService(this);
+            }
+        },
+        {
+            key: "passwordReset",
+            value: function passwordReset() {
+                return new NoContentFirebaseServerUserPasswordResetService(this);
+            }
+        },
+        {
+            key: "authContextInfo",
+            value: function authContextInfo(context) {
+                var _this = this;
+                var auth = context.auth;
+                var result;
+                if (auth) {
                     var _roles = cachedGetter(function() {
                         return _this.readRoles(auth.token);
                     });
@@ -2185,781 +2589,333 @@ function _ts_generator$f(thisArg, body) {
 } 
 ();
 
-// MARK: Tokens
-/**
- * Token to access a configured FirebaseServerEnvironmentServiceConfig for the app.
- */ var FIREBASE_SERVER_ENV_TOKEN = 'FIREBASE_SERVER_ENV_TOKEN';
-/**
- * Creates a NestJS provider that binds the given config to the {@link FIREBASE_SERVER_ENV_TOKEN} injection token.
- *
- * @param env - The Firebase server environment configuration.
- * @returns A NestJS provider binding the config to the {@link FIREBASE_SERVER_ENV_TOKEN} token.
- *
- * @example
- * ```typescript
- * const provider = firebaseServerEnvTokenProvider({ appUrl: 'https://myapp.com', ... });
- * ```
- */ function firebaseServerEnvTokenProvider(env) {
-    return {
-        provide: FIREBASE_SERVER_ENV_TOKEN,
-        useValue: env
-    };
-}
-/**
- * Creates NestJS providers that bind the given config to both {@link FIREBASE_SERVER_ENV_TOKEN}
- * and the base {@link SERVER_ENV_TOKEN} from `@dereekb/nestjs`.
- *
- * Use this when the NestJS app needs the config accessible via either token.
- *
- * @param env - The Firebase server environment configuration.
- * @returns An array of providers binding the config to both Firebase and base server env tokens.
- *
- * @example
- * ```typescript
- * @Module({
- *   providers: [...firebaseServerEnvTokenProviders(myEnvConfig)]
- * })
- * export class AppModule {}
- * ```
- */ function firebaseServerEnvTokenProviders(env) {
-    return [
-        firebaseServerEnvTokenProvider(env),
-        {
-            provide: SERVER_ENV_TOKEN,
-            useExisting: FIREBASE_SERVER_ENV_TOKEN
-        }
-    ];
-}
-
-function _class_call_check$p(instance, Constructor) {
-    if (!(instance instanceof Constructor)) {
-        throw new TypeError("Cannot call a class as a function");
+function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
     }
 }
-/**
- * Abstract service providing Firebase server environment information such as deployment stage,
- * feature flags, and app URL.
- *
- * Implementations are typically injected via {@link FIREBASE_SERVER_ENV_TOKEN} and
- * backed by a {@link FirebaseServerEnvironmentConfig}.
- */ var FirebaseServerEnvService = function FirebaseServerEnvService() {
-    _class_call_check$p(this, FirebaseServerEnvService);
-} 
-;
-
-/**
- * Converts a {@link FirestoreAccessorIncrementUpdate} into Firestore {@link UpdateData} using
- * Google Cloud Firestore's {@link FieldValue.increment}.
- *
- * Each field in the input maps to an atomic increment operation. Null/undefined values default to 0.
- *
- * @param input - The increment specification mapping field names to numeric deltas.
- * @returns Firestore {@link UpdateData} with atomic increment operations.
- *
- * @example
- * ```typescript
- * const updateData = firestoreServerIncrementUpdateToUpdateData<Stats>({
- *   viewCount: 1,
- *   likeCount: -1
- * });
- * ```
- */ function firestoreServerIncrementUpdateToUpdateData(input) {
-    return mapObjectMap(input, function(incrementValue) {
-        return FieldValue.increment(incrementValue !== null && incrementValue !== void 0 ? incrementValue : 0);
-    });
-}
-
-function _array_like_to_array$d(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_without_holes$9(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$d(arr);
-}
-function _define_property$w(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
+function _async_to_generator$f(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
         });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _iterable_to_array$9(iter) {
-    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
-}
-function _non_iterable_spread$9() {
-    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+    };
 }
-function _object_spread$h(target) {
-    for(var i = 1; i < arguments.length; i++){
-        var source = arguments[i] != null ? arguments[i] : {};
-        var ownKeys = Object.keys(source);
-        if (typeof Object.getOwnPropertySymbols === "function") {
-            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
-            }));
+function _ts_generator$f(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
         }
-        ownKeys.forEach(function(key) {
-            _define_property$w(target, key, source[key]);
-        });
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
     }
-    return target;
-}
-function _to_consumable_array$9(arr) {
-    return _array_without_holes$9(arr) || _iterable_to_array$9(arr) || _unsupported_iterable_to_array$d(arr) || _non_iterable_spread$9();
-}
-function _unsupported_iterable_to_array$d(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$d(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$d(o, minLen);
 }
 /**
- * Converts a {@link FirestoreAccessorArrayUpdate} into Firestore {@link UpdateData} using
- * Google Cloud Firestore's {@link FieldValue.arrayUnion} and {@link FieldValue.arrayRemove}.
+ * Asserts that the callable context contains auth data with a valid UID.
  *
- * @param input - The array update specification with `union` and/or `remove` field maps.
- * @returns Firestore {@link UpdateData} with array union/remove operations.
+ * @param context - The callable context to check for auth data.
+ * @throws {HttpsError} Throws unauthenticated error if no auth data is present.
  *
  * @example
  * ```typescript
- * const updateData = firestoreServerArrayUpdateToUpdateData<User>({
- *   union: { tags: ['new-tag'] },
- *   remove: { tags: ['old-tag'] }
- * });
+ * assertContextHasAuth(context);
+ * // Safe to access context.auth.uid
  * ```
- */ function firestoreServerArrayUpdateToUpdateData(input) {
-    var union = input.union;
-    var remove = input.remove;
-    function createUpdatesWithArrayFunction(fieldUpdate, arrayUpdateFunction) {
-        var result;
-        if (fieldUpdate) {
-            result = mapObjectMap(fieldUpdate, function(arrayUpdate) {
-                var result;
-                if (arrayUpdate) {
-                    result = arrayUpdateFunction.apply(void 0, _to_consumable_array$9(arrayUpdate)); // use spread operator to insert each value as an argument, as "nested arrays" are not allowed in the Firestore
-                }
-                return result;
-            });
-        }
-        return result;
-    }
-    var updateData = _object_spread$h({}, createUpdatesWithArrayFunction(union, FieldValue.arrayUnion), createUpdatesWithArrayFunction(remove, FieldValue.arrayRemove));
-    return updateData;
-}
-
-function _class_call_check$o(instance, Constructor) {
-    if (!(instance instanceof Constructor)) {
-        throw new TypeError("Cannot call a class as a function");
-    }
-}
-function _defineProperties$f(target, props) {
-    for(var i = 0; i < props.length; i++){
-        var descriptor = props[i];
-        descriptor.enumerable = descriptor.enumerable || false;
-        descriptor.configurable = true;
-        if ("value" in descriptor) descriptor.writable = true;
-        Object.defineProperty(target, descriptor.key, descriptor);
-    }
-}
-function _create_class$f(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$f(Constructor.prototype, protoProps);
-    return Constructor;
-}
-function _define_property$v(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
+ */ function assertContextHasAuth(context) {
+    if (!isContextWithAuthData(context)) {
+        throw unauthenticatedContextHasNoUidError();
     }
-    return obj;
 }
-// MARK: Accessor
 /**
- * Google Cloud Firestore implementation of {@link FirestoreDocumentDataAccessor} that queues
- * all write operations (create, set, update, delete) into a {@link WriteBatch}.
+ * Loads the snapshot data from a Firestore document, throwing if the document does not exist.
  *
- * Writes are not committed until the batch is explicitly committed. Read operations
- * (get, exists) bypass the batch and read directly from Firestore.
- */ var WriteBatchFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
-    function WriteBatchFirestoreDocumentDataAccessor(batch, documentRef) {
-        _class_call_check$o(this, WriteBatchFirestoreDocumentDataAccessor);
-        _define_property$v(this, "documentRef", void 0);
-        _define_property$v(this, "_batch", void 0);
-        this.documentRef = documentRef;
-        this._batch = batch;
-    }
-    _create_class$f(WriteBatchFirestoreDocumentDataAccessor, [
-        {
-            key: "batch",
-            get: function get() {
-                return this._batch;
-            }
-        },
-        {
-            key: "stream",
-            value: function stream() {
-                return from(this.get()); // todo
-            }
-        },
-        {
-            key: "create",
-            value: function create(data) {
-                this.batch.create(this.documentRef, data);
-                return Promise.resolve();
-            }
-        },
-        {
-            key: "exists",
-            value: function exists() {
-                return this.get().then(function(x) {
-                    return x.exists;
-                });
-            }
-        },
-        {
-            key: "get",
-            value: function get() {
-                return this.documentRef.get();
-            }
-        },
-        {
-            key: "getWithConverter",
-            value: function getWithConverter(converter) {
-                return this.documentRef.withConverter(converter).get();
-            }
-        },
-        {
-            key: "delete",
-            value: function _delete(params) {
-                this.batch.delete(this.documentRef, params === null || params === void 0 ? void 0 : params.precondition);
-                return Promise.resolve();
-            }
-        },
-        {
-            key: "set",
-            value: function set(data) {
-                this.batch.set(this.documentRef, data);
-                return Promise.resolve();
-            }
-        },
-        {
-            key: "increment",
-            value: function increment(data, params) {
-                return this.update(firestoreServerIncrementUpdateToUpdateData(data), params);
-            }
-        },
-        {
-            key: "arrayUpdate",
-            value: function arrayUpdate(data, params) {
-                return this.update(firestoreServerArrayUpdateToUpdateData(data), params);
-            }
-        },
-        {
-            key: "update",
-            value: function update(data, params) {
-                if ((params === null || params === void 0 ? void 0 : params.precondition) != null) {
-                    this.batch.update(this.documentRef, data, params.precondition);
-                } else {
-                    this.batch.update(this.documentRef, data);
-                }
-                return Promise.resolve();
-            }
-        }
-    ]);
-    return WriteBatchFirestoreDocumentDataAccessor;
-}();
-/**
- * Creates a {@link FirestoreDocumentDataAccessorFactory} that produces batch-backed accessors.
- *
- * All accessors created from this factory share the same {@link WriteBatch}, so committing
- * the batch applies all queued writes atomically.
- *
- * @param writeBatch - The Google Cloud WriteBatch to queue operations into.
- * @returns A factory that creates batch-backed accessors sharing the given WriteBatch.
+ * @param document - The Firestore document to load data from.
+ * @param message - Optional custom error message.
+ * @returns The document's snapshot data.
+ * @throws {HttpsError} Throws a {@link modelNotAvailableError} (404) if the document has no data.
  *
  * @example
  * ```typescript
- * const batch = firestore.batch();
- * const factory = writeBatchAccessorFactory<User>(batch);
- * const accessor = factory.accessorFor(userDocRef);
- * await accessor.set({ name: 'Alice' });
- * await batch.commit();
+ * const userData = await assertSnapshotData(userDocument);
  * ```
- */ function writeBatchAccessorFactory(writeBatch) {
-    return {
-        accessorFor: function accessorFor(ref) {
-            return new WriteBatchFirestoreDocumentDataAccessor(writeBatch, ref);
-        }
-    };
+ */ function assertSnapshotData(document, message) {
+    return _async_to_generator$f(function() {
+        var data;
+        return _ts_generator$f(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        document.snapshotData()
+                    ];
+                case 1:
+                    data = _state.sent();
+                    if (data == null) {
+                        throw modelNotAvailableError({
+                            message: message !== null && message !== void 0 ? message : "The ".concat(document.modelType, " was unavailable.")
+                        });
+                    }
+                    return [
+                        2,
+                        data
+                    ];
+            }
+        });
+    })();
 }
-// MARK: Context
 /**
- * A {@link FirestoreDocumentContext} backed by a Google Cloud {@link WriteBatch}.
+ * Loads snapshot data and attaches the document's `id` and `key` to the result.
  *
- * All document accessors created from this context queue writes into the same batch.
- */ var WriteBatchFirestoreDocumentContext = /*#__PURE__*/ function() {
-    function WriteBatchFirestoreDocumentContext(batch) {
-        _class_call_check$o(this, WriteBatchFirestoreDocumentContext);
-        _define_property$v(this, "_batch", void 0);
-        _define_property$v(this, "contextType", FirestoreDocumentContextType.BATCH);
-        _define_property$v(this, "accessorFactory", void 0);
-        this._batch = batch;
-        this.accessorFactory = writeBatchAccessorFactory(batch);
-    }
-    _create_class$f(WriteBatchFirestoreDocumentContext, [
-        {
-            key: "batch",
-            get: function get() {
-                return this._batch;
+ * Combines {@link assertSnapshotData} with {@link setIdAndKeyFromKeyIdRefOnDocumentData}.
+ *
+ * @param document - The Firestore document to load data from.
+ * @param message - Optional custom error message.
+ * @returns The document's snapshot data with `id` and `key` attached.
+ * @throws {HttpsError} Throws a {@link modelNotAvailableError} (404) if the document has no data.
+ */ function assertSnapshotDataWithKey(document, message) {
+    return _async_to_generator$f(function() {
+        var data;
+        return _ts_generator$f(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        assertSnapshotData(document, message)
+                    ];
+                case 1:
+                    data = _state.sent();
+                    return [
+                        2,
+                        setIdAndKeyFromKeyIdRefOnDocumentData(data, document)
+                    ];
             }
-        }
-    ]);
-    return WriteBatchFirestoreDocumentContext;
-}();
+        });
+    })();
+}
 /**
- * Creates a {@link WriteBatchFirestoreDocumentContext} wrapping the given batch.
+ * Asserts that the Firestore document exists without loading its data.
  *
- * @param batch - The Google Cloud WriteBatch to use.
- * @returns A new {@link WriteBatchFirestoreDocumentContext} for the given batch.
- */ function writeBatchDocumentContext(batch) {
-    return new WriteBatchFirestoreDocumentContext(batch);
-}
-
-function _class_call_check$n(instance, Constructor) {
-    if (!(instance instanceof Constructor)) {
-        throw new TypeError("Cannot call a class as a function");
-    }
-}
-function _defineProperties$e(target, props) {
-    for(var i = 0; i < props.length; i++){
-        var descriptor = props[i];
-        descriptor.enumerable = descriptor.enumerable || false;
-        descriptor.configurable = true;
-        if ("value" in descriptor) descriptor.writable = true;
-        Object.defineProperty(target, descriptor.key, descriptor);
-    }
-}
-function _create_class$e(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$e(Constructor.prototype, protoProps);
-    return Constructor;
-}
-function _define_property$u(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
+ * @param document - The Firestore document to check.
+ * @param message - Optional custom error message.
+ * @throws {HttpsError} Throws a {@link modelNotAvailableError} (404) if the document does not exist.
+ */ function assertDocumentExists(document, message) {
+    return _async_to_generator$f(function() {
+        var exists;
+        return _ts_generator$f(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        document.exists()
+                    ];
+                case 1:
+                    exists = _state.sent();
+                    if (!exists) {
+                        throw documentModelNotAvailableError(document, message);
+                    }
+                    return [
+                        2
+                    ];
+            }
         });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
+    })();
 }
-// MARK: Accessor
 /**
- * Default Google Cloud Firestore implementation of {@link FirestoreDocumentDataAccessor}.
+ * Creates a {@link modelNotAvailableError} for the given document's model type.
  *
- * Performs all operations directly against the Firestore document reference without
- * batching or transactional context. Supports real-time streaming via `onSnapshot`.
- */ var DefaultFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
-    function DefaultFirestoreDocumentDataAccessor(documentRef) {
-        _class_call_check$n(this, DefaultFirestoreDocumentDataAccessor);
-        _define_property$u(this, "_documentRef", void 0);
-        this._documentRef = documentRef;
-    }
-    _create_class$e(DefaultFirestoreDocumentDataAccessor, [
-        {
-            key: "documentRef",
-            get: function get() {
-                return this._documentRef;
-            }
-        },
-        {
-            key: "stream",
-            value: function stream() {
-                var _this = this;
-                return streamFromOnSnapshot(function(param) {
-                    var next = param.next, error = param.error;
-                    return _this.documentRef.onSnapshot(next, error);
-                });
-            }
-        },
-        {
-            key: "create",
-            value: function create(data) {
-                return this.documentRef.create(data);
-            }
-        },
-        {
-            key: "exists",
-            value: function exists() {
-                return this.get().then(function(x) {
-                    return x.exists;
-                });
-            }
-        },
-        {
-            key: "get",
-            value: function get() {
-                return this.documentRef.get();
-            }
-        },
-        {
-            key: "getWithConverter",
-            value: function getWithConverter(converter) {
-                return this.documentRef.withConverter(converter).get();
-            }
-        },
-        {
-            key: "delete",
-            value: function _delete(params) {
-                return this.documentRef.delete(params === null || params === void 0 ? void 0 : params.precondition);
-            }
-        },
-        {
-            key: "set",
-            value: function set(data, options) {
-                return options ? this.documentRef.set(data, options) : this.documentRef.set(data);
-            }
-        },
-        {
-            key: "increment",
-            value: function increment(data, params) {
-                return this.update(firestoreServerIncrementUpdateToUpdateData(data), params);
-            }
-        },
-        {
-            key: "arrayUpdate",
-            value: function arrayUpdate(data, params) {
-                return this.update(firestoreServerArrayUpdateToUpdateData(data), params);
-            }
-        },
-        {
-            key: "update",
-            value: function update(data, params) {
-                return (params === null || params === void 0 ? void 0 : params.precondition) ? this.documentRef.update(data, params.precondition) : this.documentRef.update(data);
-            }
-        }
-    ]);
-    return DefaultFirestoreDocumentDataAccessor;
-}();
-/**
- * Creates a {@link FirestoreDocumentDataAccessorFactory} that produces default (non-batched, non-transactional) accessors.
+ * Used by {@link assertDocumentExists} and other assertion functions.
  *
- * @returns A factory that creates default (non-batched, non-transactional) accessors.
+ * @param document - The document (or object with `modelType`) to generate the error for.
+ * @param message - Optional custom error message.
+ * @returns A {@link modelNotAvailableError} with the document's model type in the message.
+ */ function documentModelNotAvailableError(document, message) {
+    return modelNotAvailableError({
+        message: message !== null && message !== void 0 ? message : "The ".concat(document.modelType, " was unavailable.")
+    });
+}
+
+/**
+ * Error code for when a phone number is already registered in Firebase Auth.
+ */ var PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE = 'PHONE_NUMBER_ALREADY_EXISTS';
+/**
+ * Creates a precondition conflict (409) error indicating the phone number already exists.
  *
- * @example
- * ```typescript
- * const factory = defaultFirestoreAccessorFactory<User>();
- * const accessor = factory.accessorFor(userDocRef);
- * ```
- */ function defaultFirestoreAccessorFactory() {
-    return {
-        accessorFor: function accessorFor(ref) {
-            return new DefaultFirestoreDocumentDataAccessor(ref);
-        }
-    };
+ * @returns A new precondition-conflict (409) {@link HttpsError} with the phone-number-exists code.
+ */ function phoneNumberAlreadyExistsError() {
+    return preconditionConflictError({
+        code: PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE,
+        message: 'This phone number already exists in the system.'
+    });
 }
-// MARK: Context
 /**
- * Creates a {@link FirestoreDocumentContext} with no special execution context (no batch, no transaction).
+ * Handles Firebase Auth errors by mapping known error codes to typed HTTP errors.
  *
- * Operations performed through this context execute immediately against Firestore.
+ * Currently maps `auth/phone-number-already-exists` to a 409 conflict error.
+ * Unknown error codes are forwarded to the optional handler.
  *
- * @returns A {@link FirestoreDocumentContext} for direct Firestore operations.
- */ function defaultFirestoreDocumentContext() {
-    return {
-        contextType: FirestoreDocumentContextType.NONE,
-        accessorFactory: defaultFirestoreAccessorFactory()
-    };
+ * @param e - The caught error.
+ * @param handleUnknownCode - Optional handler for Firebase errors with unrecognized codes.
+ */ function handleFirebaseAuthError(e, handleUnknownCode) {
+    handleFirebaseError(e, function(firebaseError) {
+        switch(firebaseError.code){
+            case FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR:
+                throw phoneNumberAlreadyExistsError();
+            default:
+                handleUnknownCode === null || handleUnknownCode === void 0 ? void 0 : handleUnknownCode(firebaseError);
+                break;
+        }
+    });
 }
 
-function _class_call_check$m(instance, Constructor) {
-    if (!(instance instanceof Constructor)) {
-        throw new TypeError("Cannot call a class as a function");
+function asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
     }
-}
-function _defineProperties$d(target, props) {
-    for(var i = 0; i < props.length; i++){
-        var descriptor = props[i];
-        descriptor.enumerable = descriptor.enumerable || false;
-        descriptor.configurable = true;
-        if ("value" in descriptor) descriptor.writable = true;
-        Object.defineProperty(target, descriptor.key, descriptor);
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
     }
 }
-function _create_class$d(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$d(Constructor.prototype, protoProps);
-    return Constructor;
-}
-function _define_property$t(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
+function _async_to_generator$e(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
         });
+    };
+}
+function _instanceof$2(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
     } else {
-        obj[key] = value;
+        return left instanceof right;
     }
-    return obj;
 }
-// MARK: Accessor
-/**
- * Google Cloud Firestore implementation of {@link FirestoreDocumentDataAccessor} that executes
- * all operations within a Firestore {@link Transaction}.
- *
- * Reads performed through this accessor are included in the transaction's read set, ensuring
- * consistency. Writes are committed atomically when the transaction completes.
- */ var TransactionFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
-    function TransactionFirestoreDocumentDataAccessor(transaction, documentRef) {
-        _class_call_check$m(this, TransactionFirestoreDocumentDataAccessor);
-        _define_property$t(this, "_transaction", void 0);
-        _define_property$t(this, "_documentRef", void 0);
-        this._transaction = transaction;
-        this._documentRef = documentRef;
-    }
-    _create_class$d(TransactionFirestoreDocumentDataAccessor, [
-        {
-            key: "transaction",
-            get: function get() {
-                return this._transaction;
-            }
-        },
-        {
-            key: "documentRef",
-            get: function get() {
-                return this._documentRef;
-            }
-        },
-        {
-            key: "stream",
-            value: function stream() {
-                return from(this.get());
-            }
-        },
-        {
-            key: "create",
-            value: function create(data) {
-                this.transaction.create(this.documentRef, data);
-                return Promise.resolve();
-            }
-        },
-        {
-            key: "exists",
-            value: function exists() {
-                return this.get().then(function(x) {
-                    return x.exists;
-                });
-            }
-        },
-        {
-            key: "get",
-            value: function get() {
-                return this.transaction.get(this.documentRef);
-            }
-        },
-        {
-            key: "getWithConverter",
-            value: function getWithConverter(converter) {
-                return this.transaction.get(this.documentRef.withConverter(converter));
-            }
-        },
-        {
-            key: "delete",
-            value: function _delete() {
-                this.transaction.delete(this.documentRef);
-                return Promise.resolve();
-            }
-        },
-        {
-            key: "set",
-            value: function set(data, options) {
-                this.transaction.set(this.documentRef, data, options);
-                return Promise.resolve();
-            }
-        },
-        {
-            key: "increment",
-            value: function increment(data, params) {
-                return this.update(firestoreServerIncrementUpdateToUpdateData(data), params);
-            }
-        },
-        {
-            key: "arrayUpdate",
-            value: function arrayUpdate(data, params) {
-                return this.update(firestoreServerArrayUpdateToUpdateData(data), params);
-            }
-        },
-        {
-            key: "update",
-            value: function update(data, params) {
-                if (params === null || params === void 0 ? void 0 : params.precondition) {
-                    this.transaction.update(this.documentRef, data, params.precondition);
-                } else {
-                    this.transaction.update(this.documentRef, data);
-                }
-                return Promise.resolve();
-            }
-        }
-    ]);
-    return TransactionFirestoreDocumentDataAccessor;
-}();
-/**
- * Creates a {@link FirestoreDocumentDataAccessorFactory} that produces transaction-backed accessors.
- *
- * All accessors share the same transaction, so reads and writes participate in the same
- * atomic operation.
- *
- * @param transaction - The Google Cloud Transaction to execute operations within.
- * @returns A factory that creates transaction-backed accessors sharing the given transaction.
- *
- * @example
- * ```typescript
- * await firestore.runTransaction(async (transaction) => {
- *   const factory = transactionAccessorFactory<User>(transaction);
- *   const accessor = factory.accessorFor(userDocRef);
- *   const snapshot = await accessor.get();
- *   await accessor.update({ name: 'Updated' });
- * });
- * ```
- */ function transactionAccessorFactory(transaction) {
-    return {
-        accessorFor: function accessorFor(ref) {
-            return new TransactionFirestoreDocumentDataAccessor(transaction, ref);
-        }
-    };
-}
-// MARK: Context
-/**
- * A {@link FirestoreDocumentContext} backed by a Google Cloud {@link Transaction}.
- *
- * All document accessors created from this context operate within the same transaction.
- */ var TransactionFirestoreDocumentContext = /*#__PURE__*/ function() {
-    function TransactionFirestoreDocumentContext(transaction) {
-        _class_call_check$m(this, TransactionFirestoreDocumentContext);
-        _define_property$t(this, "_transaction", void 0);
-        _define_property$t(this, "contextType", FirestoreDocumentContextType.TRANSACTION);
-        _define_property$t(this, "accessorFactory", void 0);
-        this._transaction = transaction;
-        this.accessorFactory = transactionAccessorFactory(transaction);
-    }
-    _create_class$d(TransactionFirestoreDocumentContext, [
-        {
-            key: "transaction",
-            get: function get() {
-                return this._transaction;
-            }
-        }
-    ]);
-    return TransactionFirestoreDocumentContext;
-}();
-/**
- * Creates a {@link TransactionFirestoreDocumentContext} wrapping the given transaction.
- *
- * @param transaction - The Google Cloud Transaction to use.
- * @returns A new {@link TransactionFirestoreDocumentContext} for the given transaction.
- */ function transactionDocumentContext(transaction) {
-    return new TransactionFirestoreDocumentContext(transaction);
-}
-
-function _array_like_to_array$c(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_with_holes$3(arr) {
-    if (Array.isArray(arr)) return arr;
-}
-function asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, key, arg) {
-    try {
-        var info = gen[key](arg);
-        var value = info.value;
-    } catch (error) {
-        reject(error);
-        return;
-    }
-    if (info.done) {
-        resolve(value);
-    } else {
-        Promise.resolve(value).then(_next, _throw);
-    }
-}
-function _async_to_generator$e(fn) {
-    return function() {
-        var self = this, args = arguments;
-        return new Promise(function(resolve, reject) {
-            var gen = fn.apply(self, args);
-            function _next(value) {
-                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "next", value);
-            }
-            function _throw(err) {
-                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "throw", err);
-            }
-            _next(undefined);
-        });
-    };
-}
-function _iterable_to_array_limit$3(arr, i) {
-    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
-    if (_i == null) return;
-    var _arr = [];
-    var _n = true;
-    var _d = false;
-    var _s, _e;
-    try {
-        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
-            _arr.push(_s.value);
-            if (i && _arr.length === i) break;
-        }
-    } catch (err) {
-        _d = true;
-        _e = err;
-    } finally{
-        try {
-            if (!_n && _i["return"] != null) _i["return"]();
-        } finally{
-            if (_d) throw _e;
-        }
-    }
-    return _arr;
-}
-function _non_iterable_rest$3() {
-    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _sliced_to_array$3(arr, i) {
-    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$c(arr, i) || _non_iterable_rest$3();
-}
-function _unsupported_iterable_to_array$c(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$c(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$c(o, minLen);
-}
-function _ts_generator$e(thisArg, body) {
-    var f, y, t, _ = {
-        label: 0,
-        sent: function() {
-            if (t[0] & 1) throw t[1];
-            return t[1];
+function _ts_generator$e(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
         },
         trys: [],
         ops: []
@@ -3054,133 +3010,626 @@ function _ts_generator$e(thisArg, body) {
     }
 }
 /**
- * Resolves a Firestore {@link CollectionReference} from a starting point and optional additional path segments.
+ * Wraps an async function that uses {@link FirebaseServerUserPasswordResetService} methods,
+ * catching password-reset-specific errors and re-throwing them as appropriate {@link HttpsError} instances
+ * suitable for returning to clients.
  *
- * Supports nested subcollection paths by processing segments in pairs (doc ID, collection name).
+ * Error mapping:
+ * - {@link FirebaseServerAuthPasswordResetInvalidCodeError} → permission-denied (403)
+ * - {@link FirebaseServerAuthPasswordResetNoResetConfigError} → bad-request (400)
+ * - {@link FirebaseServerAuthPasswordResetThrottleError} → unavailable (503)
+ * - {@link FirebaseServerAuthPasswordResetSendOnceError} → bad-request (400)
  *
- * @param start - A Firestore object that can resolve collection paths (e.g., Firestore instance, DocumentReference).
- * @param path - The initial collection path.
- * @param pathSegments - Optional pairs of [docId, collectionName] for subcollection traversal.
- * @returns The resolved {@link CollectionReference} at the given path.
- * @throws Error if pathSegments length is odd (segments must come in pairs).
+ * @param fn - The async function to execute.
+ * @returns The result of the function.
+ */ function catchAndThrowPasswordResetServerErrors(fn) {
+    return _async_to_generator$e(function() {
+        var result, error;
+        return _ts_generator$e(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    _state.trys.push([
+                        0,
+                        2,
+                        ,
+                        3
+                    ]);
+                    return [
+                        4,
+                        fn()
+                    ];
+                case 1:
+                    result = _state.sent();
+                    return [
+                        3,
+                        3
+                    ];
+                case 2:
+                    error = _state.sent();
+                    if (_instanceof$2(error, FirebaseServerAuthPasswordResetInvalidCodeError)) {
+                        throw authServicePasswordResetInvalidCodeError();
+                    } else if (_instanceof$2(error, FirebaseServerAuthPasswordResetNoResetConfigError)) {
+                        throw authServicePasswordResetNoConfigError();
+                    } else if (_instanceof$2(error, FirebaseServerAuthPasswordResetThrottleError)) {
+                        throw authServicePasswordResetThrottleError();
+                    } else if (_instanceof$2(error, FirebaseServerAuthPasswordResetSendOnceError)) {
+                        throw authServicePasswordResetSendOnceError();
+                    }
+                    throw error;
+                case 3:
+                    return [
+                        2,
+                        result
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Creates a permission-denied (403) server error for an invalid or expired password reset code.
+ *
+ * @returns An {@link HttpsError} with code `permission-denied`.
+ */ function authServicePasswordResetInvalidCodeError() {
+    return permissionDeniedError({
+        code: DBX_FIREBASE_SERVER_PASSWORD_RESET_INVALID_CODE_ERROR_CODE,
+        message: 'Invalid or expired reset password code.'
+    });
+}
+/**
+ * Creates a bad-request (400) server error when no active password reset exists for the user.
+ *
+ * @returns An {@link HttpsError} with code `invalid-argument`.
+ */ function authServicePasswordResetNoConfigError() {
+    return badRequestError({
+        code: DBX_FIREBASE_SERVER_PASSWORD_RESET_NO_CONFIG_ERROR_CODE,
+        message: 'No active password reset for this user.'
+    });
+}
+/**
+ * Creates an unavailable (503) server error when password reset email sending is throttled.
+ *
+ * @returns An {@link HttpsError} with code `unavailable`.
+ */ function authServicePasswordResetThrottleError() {
+    return unavailableError({
+        code: DBX_FIREBASE_SERVER_PASSWORD_RESET_THROTTLE_ERROR_CODE,
+        message: 'Password reset email was recently sent. Try again later.'
+    });
+}
+/**
+ * Creates a bad-request (400) server error when the password reset email has already been sent
+ * and the send-once constraint is active.
+ *
+ * @returns An {@link HttpsError} with code `invalid-argument`.
+ */ function authServicePasswordResetSendOnceError() {
+    return badRequestError({
+        code: DBX_FIREBASE_SERVER_PASSWORD_RESET_SEND_ONCE_ERROR_CODE,
+        message: 'Password reset email has already been sent.'
+    });
+}
+
+// MARK: Tokens
+/**
+ * Token to access a configured FirebaseServerEnvironmentServiceConfig for the app.
+ */ var FIREBASE_SERVER_ENV_TOKEN = 'FIREBASE_SERVER_ENV_TOKEN';
+/**
+ * Creates a NestJS provider that binds the given config to the {@link FIREBASE_SERVER_ENV_TOKEN} injection token.
+ *
+ * @param env - The Firebase server environment configuration.
+ * @returns A NestJS provider binding the config to the {@link FIREBASE_SERVER_ENV_TOKEN} token.
  *
  * @example
  * ```typescript
- * const ref = collectionRefForPath<User>(firestore, 'users');
- * const subRef = collectionRefForPath<Comment>(firestore, 'users', ['user123', 'comments']);
+ * const provider = firebaseServerEnvTokenProvider({ appUrl: 'https://myapp.com', ... });
  * ```
- */ function collectionRefForPath(start, path, pathSegments) {
-    var ref = start.collection(path);
-    if (pathSegments === null || pathSegments === void 0 ? void 0 : pathSegments.length) {
-        if (pathSegments.length % 2 !== 0) {
-            throw new Error('Invalid number of path segments provided for collection. Path: "'.concat(path, '" + "').concat(pathSegments, '"'));
+ */ function firebaseServerEnvTokenProvider(env) {
+    return {
+        provide: FIREBASE_SERVER_ENV_TOKEN,
+        useValue: env
+    };
+}
+/**
+ * Creates NestJS providers that bind the given config to both {@link FIREBASE_SERVER_ENV_TOKEN}
+ * and the base {@link SERVER_ENV_TOKEN} from `@dereekb/nestjs`.
+ *
+ * Use this when the NestJS app needs the config accessible via either token.
+ *
+ * @param env - The Firebase server environment configuration.
+ * @returns An array of providers binding the config to both Firebase and base server env tokens.
+ *
+ * @example
+ * ```typescript
+ * @Module({
+ *   providers: [...firebaseServerEnvTokenProviders(myEnvConfig)]
+ * })
+ * export class AppModule {}
+ * ```
+ */ function firebaseServerEnvTokenProviders(env) {
+    return [
+        firebaseServerEnvTokenProvider(env),
+        {
+            provide: SERVER_ENV_TOKEN,
+            useExisting: FIREBASE_SERVER_ENV_TOKEN
+        }
+    ];
+}
+
+function _class_call_check$p(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+/**
+ * Abstract service providing Firebase server environment information such as deployment stage,
+ * feature flags, and app URL.
+ *
+ * Implementations are typically injected via {@link FIREBASE_SERVER_ENV_TOKEN} and
+ * backed by a {@link FirebaseServerEnvironmentConfig}.
+ */ var FirebaseServerEnvService = function FirebaseServerEnvService() {
+    _class_call_check$p(this, FirebaseServerEnvService);
+} 
+;
+
+/**
+ * Converts a {@link FirestoreAccessorIncrementUpdate} into Firestore {@link UpdateData} using
+ * Google Cloud Firestore's {@link FieldValue.increment}.
+ *
+ * Each field in the input maps to an atomic increment operation. Null/undefined values default to 0.
+ *
+ * @param input - The increment specification mapping field names to numeric deltas.
+ * @returns Firestore {@link UpdateData} with atomic increment operations.
+ *
+ * @example
+ * ```typescript
+ * const updateData = firestoreServerIncrementUpdateToUpdateData<Stats>({
+ *   viewCount: 1,
+ *   likeCount: -1
+ * });
+ * ```
+ */ function firestoreServerIncrementUpdateToUpdateData(input) {
+    return mapObjectMap(input, function(incrementValue) {
+        return FieldValue.increment(incrementValue !== null && incrementValue !== void 0 ? incrementValue : 0);
+    });
+}
+
+function _array_like_to_array$d(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$9(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$d(arr);
+}
+function _define_property$w(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _iterable_to_array$9(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$9() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread$h(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$w(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function _to_consumable_array$9(arr) {
+    return _array_without_holes$9(arr) || _iterable_to_array$9(arr) || _unsupported_iterable_to_array$d(arr) || _non_iterable_spread$9();
+}
+function _unsupported_iterable_to_array$d(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$d(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$d(o, minLen);
+}
+/**
+ * Converts a {@link FirestoreAccessorArrayUpdate} into Firestore {@link UpdateData} using
+ * Google Cloud Firestore's {@link FieldValue.arrayUnion} and {@link FieldValue.arrayRemove}.
+ *
+ * @param input - The array update specification with `union` and/or `remove` field maps.
+ * @returns Firestore {@link UpdateData} with array union/remove operations.
+ *
+ * @example
+ * ```typescript
+ * const updateData = firestoreServerArrayUpdateToUpdateData<User>({
+ *   union: { tags: ['new-tag'] },
+ *   remove: { tags: ['old-tag'] }
+ * });
+ * ```
+ */ function firestoreServerArrayUpdateToUpdateData(input) {
+    var union = input.union;
+    var remove = input.remove;
+    function createUpdatesWithArrayFunction(fieldUpdate, arrayUpdateFunction) {
+        var result;
+        if (fieldUpdate) {
+            result = mapObjectMap(fieldUpdate, function(arrayUpdate) {
+                var result;
+                if (arrayUpdate) {
+                    result = arrayUpdateFunction.apply(void 0, _to_consumable_array$9(arrayUpdate)); // use spread operator to insert each value as an argument, as "nested arrays" are not allowed in the Firestore
+                }
+                return result;
+            });
+        }
+        return result;
+    }
+    var updateData = _object_spread$h({}, createUpdatesWithArrayFunction(union, FieldValue.arrayUnion), createUpdatesWithArrayFunction(remove, FieldValue.arrayRemove));
+    return updateData;
+}
+
+function _class_call_check$o(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties$f(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class$f(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$f(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$v(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+// MARK: Accessor
+/**
+ * Google Cloud Firestore implementation of {@link FirestoreDocumentDataAccessor} that queues
+ * all write operations (create, set, update, delete) into a {@link WriteBatch}.
+ *
+ * Writes are not committed until the batch is explicitly committed. Read operations
+ * (get, exists) bypass the batch and read directly from Firestore.
+ */ var WriteBatchFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
+    function WriteBatchFirestoreDocumentDataAccessor(batch, documentRef) {
+        _class_call_check$o(this, WriteBatchFirestoreDocumentDataAccessor);
+        _define_property$v(this, "documentRef", void 0);
+        _define_property$v(this, "_batch", void 0);
+        this.documentRef = documentRef;
+        this._batch = batch;
+    }
+    _create_class$f(WriteBatchFirestoreDocumentDataAccessor, [
+        {
+            key: "batch",
+            get: function get() {
+                return this._batch;
+            }
+        },
+        {
+            key: "stream",
+            value: function stream() {
+                return from(this.get()); // todo
+            }
+        },
+        {
+            key: "create",
+            value: function create(data) {
+                this.batch.create(this.documentRef, data);
+                return Promise.resolve();
+            }
+        },
+        {
+            key: "exists",
+            value: function exists() {
+                return this.get().then(function(x) {
+                    return x.exists;
+                });
+            }
+        },
+        {
+            key: "get",
+            value: function get() {
+                return this.documentRef.get();
+            }
+        },
+        {
+            key: "getWithConverter",
+            value: function getWithConverter(converter) {
+                return this.documentRef.withConverter(converter).get();
+            }
+        },
+        {
+            key: "delete",
+            value: function _delete(params) {
+                this.batch.delete(this.documentRef, params === null || params === void 0 ? void 0 : params.precondition);
+                return Promise.resolve();
+            }
+        },
+        {
+            key: "set",
+            value: function set(data) {
+                this.batch.set(this.documentRef, data);
+                return Promise.resolve();
+            }
+        },
+        {
+            key: "increment",
+            value: function increment(data, params) {
+                return this.update(firestoreServerIncrementUpdateToUpdateData(data), params);
+            }
+        },
+        {
+            key: "arrayUpdate",
+            value: function arrayUpdate(data, params) {
+                return this.update(firestoreServerArrayUpdateToUpdateData(data), params);
+            }
+        },
+        {
+            key: "update",
+            value: function update(data, params) {
+                if ((params === null || params === void 0 ? void 0 : params.precondition) != null) {
+                    this.batch.update(this.documentRef, data, params.precondition);
+                } else {
+                    this.batch.update(this.documentRef, data);
+                }
+                return Promise.resolve();
+            }
+        }
+    ]);
+    return WriteBatchFirestoreDocumentDataAccessor;
+}();
+/**
+ * Creates a {@link FirestoreDocumentDataAccessorFactory} that produces batch-backed accessors.
+ *
+ * All accessors created from this factory share the same {@link WriteBatch}, so committing
+ * the batch applies all queued writes atomically.
+ *
+ * @param writeBatch - The Google Cloud WriteBatch to queue operations into.
+ * @returns A factory that creates batch-backed accessors sharing the given WriteBatch.
+ *
+ * @example
+ * ```typescript
+ * const batch = firestore.batch();
+ * const factory = writeBatchAccessorFactory<User>(batch);
+ * const accessor = factory.accessorFor(userDocRef);
+ * await accessor.set({ name: 'Alice' });
+ * await batch.commit();
+ * ```
+ */ function writeBatchAccessorFactory(writeBatch) {
+    return {
+        accessorFor: function accessorFor(ref) {
+            return new WriteBatchFirestoreDocumentDataAccessor(writeBatch, ref);
+        }
+    };
+}
+// MARK: Context
+/**
+ * A {@link FirestoreDocumentContext} backed by a Google Cloud {@link WriteBatch}.
+ *
+ * All document accessors created from this context queue writes into the same batch.
+ */ var WriteBatchFirestoreDocumentContext = /*#__PURE__*/ function() {
+    function WriteBatchFirestoreDocumentContext(batch) {
+        _class_call_check$o(this, WriteBatchFirestoreDocumentContext);
+        _define_property$v(this, "_batch", void 0);
+        _define_property$v(this, "contextType", FirestoreDocumentContextType.BATCH);
+        _define_property$v(this, "accessorFactory", void 0);
+        this._batch = batch;
+        this.accessorFactory = writeBatchAccessorFactory(batch);
+    }
+    _create_class$f(WriteBatchFirestoreDocumentContext, [
+        {
+            key: "batch",
+            get: function get() {
+                return this._batch;
+            }
+        }
+    ]);
+    return WriteBatchFirestoreDocumentContext;
+}();
+/**
+ * Creates a {@link WriteBatchFirestoreDocumentContext} wrapping the given batch.
+ *
+ * @param batch - The Google Cloud WriteBatch to use.
+ * @returns A new {@link WriteBatchFirestoreDocumentContext} for the given batch.
+ */ function writeBatchDocumentContext(batch) {
+    return new WriteBatchFirestoreDocumentContext(batch);
+}
+
+function _class_call_check$n(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties$e(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class$e(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$e(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$u(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+// MARK: Accessor
+/**
+ * Default Google Cloud Firestore implementation of {@link FirestoreDocumentDataAccessor}.
+ *
+ * Performs all operations directly against the Firestore document reference without
+ * batching or transactional context. Supports real-time streaming via `onSnapshot`.
+ */ var DefaultFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
+    function DefaultFirestoreDocumentDataAccessor(documentRef) {
+        _class_call_check$n(this, DefaultFirestoreDocumentDataAccessor);
+        _define_property$u(this, "_documentRef", void 0);
+        this._documentRef = documentRef;
+    }
+    _create_class$e(DefaultFirestoreDocumentDataAccessor, [
+        {
+            key: "documentRef",
+            get: function get() {
+                return this._documentRef;
+            }
+        },
+        {
+            key: "stream",
+            value: function stream() {
+                var _this = this;
+                return streamFromOnSnapshot(function(param) {
+                    var next = param.next, error = param.error;
+                    return _this.documentRef.onSnapshot(next, error);
+                });
+            }
+        },
+        {
+            key: "create",
+            value: function create(data) {
+                return this.documentRef.create(data);
+            }
+        },
+        {
+            key: "exists",
+            value: function exists() {
+                return this.get().then(function(x) {
+                    return x.exists;
+                });
+            }
+        },
+        {
+            key: "get",
+            value: function get() {
+                return this.documentRef.get();
+            }
+        },
+        {
+            key: "getWithConverter",
+            value: function getWithConverter(converter) {
+                return this.documentRef.withConverter(converter).get();
+            }
+        },
+        {
+            key: "delete",
+            value: function _delete(params) {
+                return this.documentRef.delete(params === null || params === void 0 ? void 0 : params.precondition);
+            }
+        },
+        {
+            key: "set",
+            value: function set(data, options) {
+                return options ? this.documentRef.set(data, options) : this.documentRef.set(data);
+            }
+        },
+        {
+            key: "increment",
+            value: function increment(data, params) {
+                return this.update(firestoreServerIncrementUpdateToUpdateData(data), params);
+            }
+        },
+        {
+            key: "arrayUpdate",
+            value: function arrayUpdate(data, params) {
+                return this.update(firestoreServerArrayUpdateToUpdateData(data), params);
+            }
+        },
+        {
+            key: "update",
+            value: function update(data, params) {
+                return (params === null || params === void 0 ? void 0 : params.precondition) ? this.documentRef.update(data, params.precondition) : this.documentRef.update(data);
+            }
         }
-        var batches = batch(pathSegments, 2); // batch to tuple [string, string]
-        batches.forEach(function(x) {
-            var _x = _sliced_to_array$3(x, 2), first = _x[0], second = _x[1];
-            ref = ref.doc(first).collection(second);
-        });
-    }
-    return ref;
-}
+    ]);
+    return DefaultFirestoreDocumentDataAccessor;
+}();
 /**
- * Resolves a Firestore {@link DocumentReference} from a starting point, optional document path, and additional path segments.
- *
- * If no path is provided, auto-generates a document ID. Supports nested subcollection
- * traversal via path segment pairs.
+ * Creates a {@link FirestoreDocumentDataAccessorFactory} that produces default (non-batched, non-transactional) accessors.
  *
- * @param start - A Firestore object that can resolve document paths (e.g., CollectionReference).
- * @param path - Optional document ID or path within the collection.
- * @param pathSegments - Optional pairs of [collectionName, docId] for subcollection traversal.
- * @returns The resolved {@link DocumentReference} at the given path.
+ * @returns A factory that creates default (non-batched, non-transactional) accessors.
  *
  * @example
  * ```typescript
- * const ref = docRefForPath<User>(usersCollection, 'user123');
- * const autoRef = docRefForPath<User>(usersCollection); // auto-generated ID
+ * const factory = defaultFirestoreAccessorFactory<User>();
+ * const accessor = factory.accessorFor(userDocRef);
  * ```
- */ function docRefForPath(start, path, pathSegments) {
-    var doc = path ? start.doc(path) : start.doc();
-    if (pathSegments === null || pathSegments === void 0 ? void 0 : pathSegments.length) {
-        var batches = batch(pathSegments, 2); // batch to tuple [string, string]
-        batches.forEach(function(x) {
-            var _x = _sliced_to_array$3(x, 2), first = _x[0], second = _x[1];
-            var collection = doc.collection(first);
-            doc = second ? collection.doc(second) : collection.doc();
-        });
-    }
-    return doc;
+ */ function defaultFirestoreAccessorFactory() {
+    return {
+        accessorFor: function accessorFor(ref) {
+            return new DefaultFirestoreDocumentDataAccessor(ref);
+        }
+    };
 }
+// MARK: Context
 /**
- * Creates a {@link FirestoreAccessorDriver} for Google Cloud Firestore (Admin SDK).
- *
- * Implements document/collection resolution, transaction/batch factories, and context factories
- * using the `@google-cloud/firestore` library.
+ * Creates a {@link FirestoreDocumentContext} with no special execution context (no batch, no transaction).
  *
- * @returns A {@link FirestoreAccessorDriver} for the Google Cloud Admin SDK.
+ * Operations performed through this context execute immediately against Firestore.
  *
- * @example
- * ```typescript
- * const accessorDriver = googleCloudFirestoreAccessorDriver();
- * ```
- */ function googleCloudFirestoreAccessorDriver() {
+ * @returns A {@link FirestoreDocumentContext} for direct Firestore operations.
+ */ function defaultFirestoreDocumentContext() {
     return {
-        doc: function doc(collection, path) {
-            for(var _len = arguments.length, pathSegments = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++){
-                pathSegments[_key - 2] = arguments[_key];
-            }
-            return docRefForPath(collection, path, pathSegments);
-        },
-        docAtPath: function docAtPath(firestore, fullPath) {
-            return firestore.doc(fullPath);
-        },
-        collectionGroup: function collectionGroup(firestore, collectionId) {
-            return firestore.collectionGroup(collectionId);
-        },
-        collection: function collection(firestore, path) {
-            for(var _len = arguments.length, pathSegments = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++){
-                pathSegments[_key - 2] = arguments[_key];
-            }
-            return collectionRefForPath(firestore, path, pathSegments);
-        },
-        subcollection: function subcollection(document, path) {
-            for(var _len = arguments.length, pathSegments = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++){
-                pathSegments[_key - 2] = arguments[_key];
-            }
-            return collectionRefForPath(document, path, pathSegments);
-        },
-        transactionFactoryForFirestore: function transactionFactoryForFirestore(firestore) {
-            return function(fn) {
-                return _async_to_generator$e(function() {
-                    return _ts_generator$e(this, function(_state) {
-                        return [
-                            2,
-                            firestore.runTransaction(fn)
-                        ];
-                    });
-                })();
-            };
-        },
-        writeBatchFactoryForFirestore: function writeBatchFactoryForFirestore(firestore) {
-            return function() {
-                return firestore.batch();
-            };
-        },
-        defaultContextFactory: defaultFirestoreDocumentContext,
-        transactionContextFactory: transactionDocumentContext,
-        writeBatchContextFactory: writeBatchDocumentContext
+        contextType: FirestoreDocumentContextType.NONE,
+        accessorFactory: defaultFirestoreAccessorFactory()
     };
 }
 
-function _array_like_to_array$b(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
+function _class_call_check$m(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
 }
-function _array_without_holes$8(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$b(arr);
+function _defineProperties$d(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
 }
-function _define_property$s(obj, key, value) {
+function _create_class$d(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$d(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$t(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3193,242 +3642,173 @@ function _define_property$s(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$8(iter) {
-    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
-}
-function _non_iterable_spread$8() {
-    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _object_spread$g(target) {
-    for(var i = 1; i < arguments.length; i++){
-        var source = arguments[i] != null ? arguments[i] : {};
-        var ownKeys = Object.keys(source);
-        if (typeof Object.getOwnPropertySymbols === "function") {
-            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
-            }));
-        }
-        ownKeys.forEach(function(key) {
-            _define_property$s(target, key, source[key]);
-        });
-    }
-    return target;
-}
-function ownKeys$d(object, enumerableOnly) {
-    var keys = Object.keys(object);
-    if (Object.getOwnPropertySymbols) {
-        var symbols = Object.getOwnPropertySymbols(object);
-        keys.push.apply(keys, symbols);
-    }
-    return keys;
-}
-function _object_spread_props$d(target, source) {
-    source = source != null ? source : {};
-    if (Object.getOwnPropertyDescriptors) {
-        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
-    } else {
-        ownKeys$d(Object(source)).forEach(function(key) {
-            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
-        });
-    }
-    return target;
-}
-function _to_consumable_array$8(arr) {
-    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$b(arr) || _non_iterable_spread$8();
-}
-function _unsupported_iterable_to_array$b(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$b(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$b(o, minLen);
-}
-var _builder, _builder1;
-var _obj;
-/**
- * Maps each abstract query constraint type to its Google Cloud Firestore implementation.
- *
- * Used by {@link firestoreClientQueryConstraintFunctionsDriver} to build the server-side query driver.
- */ var FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING = (_obj = {}, _define_property$s(_obj, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return builder.limit(data.limit);
-}), _define_property$s(_obj, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return builder.limitToLast(data.limit);
-}), _define_property$s(_obj, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return builder.orderBy(data.fieldPath, data.directionStr);
-}), _define_property$s(_obj, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return builder.orderBy(FieldPath.documentId(), data.directionStr);
-}), _define_property$s(_obj, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return builder.where(data.fieldPath, data.opStr, data.value);
-}), _define_property$s(_obj, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return builder.where(FieldPath.documentId(), data.opStr, data.value);
-}), _define_property$s(_obj, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return builder.offset(data.offset);
-}), _define_property$s(_obj, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return builder.startAt(data.snapshot);
-}), _define_property$s(_obj, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return (_builder = builder).startAt.apply(_builder, _to_consumable_array$8(data.fieldValues));
-}), _define_property$s(_obj, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return builder.startAfter(data.snapshot);
-}), _define_property$s(_obj, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return builder.endAt(data.snapshot);
-}), _define_property$s(_obj, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return (_builder1 = builder).endAt.apply(_builder1, _to_consumable_array$8(data.fieldValues));
-}), _define_property$s(_obj, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
-    return builder.endBefore(data.snapshot);
-}), _obj);
+// MARK: Accessor
 /**
- * Creates a {@link FirestoreQueryConstraintFunctionsDriver} for the Google Cloud Firestore server SDK.
- *
- * Translates abstract query constraints into Google Cloud Firestore query builder calls.
+ * Google Cloud Firestore implementation of {@link FirestoreDocumentDataAccessor} that executes
+ * all operations within a Firestore {@link Transaction}.
  *
- * @returns A {@link FirestoreQueryConstraintFunctionsDriver} for the server SDK.
- */ function firestoreClientQueryConstraintFunctionsDriver() {
-    return makeFirestoreQueryConstraintFunctionsDriver({
-        mapping: FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING,
-        init: function init(query) {
-            return query;
+ * Reads performed through this accessor are included in the transaction's read set, ensuring
+ * consistency. Writes are committed atomically when the transaction completes.
+ */ var TransactionFirestoreDocumentDataAccessor = /*#__PURE__*/ function() {
+    function TransactionFirestoreDocumentDataAccessor(transaction, documentRef) {
+        _class_call_check$m(this, TransactionFirestoreDocumentDataAccessor);
+        _define_property$t(this, "_transaction", void 0);
+        _define_property$t(this, "_documentRef", void 0);
+        this._transaction = transaction;
+        this._documentRef = documentRef;
+    }
+    _create_class$d(TransactionFirestoreDocumentDataAccessor, [
+        {
+            key: "transaction",
+            get: function get() {
+                return this._transaction;
+            }
+        },
+        {
+            key: "documentRef",
+            get: function get() {
+                return this._documentRef;
+            }
+        },
+        {
+            key: "stream",
+            value: function stream() {
+                return from(this.get());
+            }
+        },
+        {
+            key: "create",
+            value: function create(data) {
+                this.transaction.create(this.documentRef, data);
+                return Promise.resolve();
+            }
         },
-        build: function build(query) {
-            return query;
+        {
+            key: "exists",
+            value: function exists() {
+                return this.get().then(function(x) {
+                    return x.exists;
+                });
+            }
         },
-        documentIdFieldPath: function documentIdFieldPath() {
-            return FieldPath.documentId();
-        }
-    });
-}
-/**
- * Creates a complete {@link FirestoreQueryDriver} for Google Cloud Firestore (Admin SDK).
- *
- * Supports query execution (getDocs), document counting (countDocs), and real-time
- * streaming (streamDocs) via `onSnapshot`. Transaction-aware reads are supported
- * through the optional transaction parameter in `getDocs`.
- *
- * @returns A complete {@link FirestoreQueryDriver} for the Google Cloud Admin SDK.
- *
- * @example
- * ```typescript
- * const queryDriver = googleCloudFirestoreQueryDriver();
- * ```
- */ function googleCloudFirestoreQueryDriver() {
-    return _object_spread_props$d(_object_spread$g({}, firestoreClientQueryConstraintFunctionsDriver()), {
-        countDocs: function countDocs(query) {
-            return query.count().get().then(function(x) {
-                return x.data().count;
-            });
+        {
+            key: "get",
+            value: function get() {
+                return this.transaction.get(this.documentRef);
+            }
         },
-        getDocs: function getDocs(query, transaction) {
-            var result;
-            if (transaction) {
-                result = transaction.get(query);
-            } else {
-                result = query.get();
+        {
+            key: "getWithConverter",
+            value: function getWithConverter(converter) {
+                return this.transaction.get(this.documentRef.withConverter(converter));
             }
-            return result;
         },
-        streamDocs: function streamDocs(query) {
-            return streamFromOnSnapshot(function(param) {
-                var next = param.next, error = param.error;
-                return query.onSnapshot(next, error);
-            });
+        {
+            key: "delete",
+            value: function _delete() {
+                this.transaction.delete(this.documentRef);
+                return Promise.resolve();
+            }
+        },
+        {
+            key: "set",
+            value: function set(data, options) {
+                this.transaction.set(this.documentRef, data, options);
+                return Promise.resolve();
+            }
+        },
+        {
+            key: "increment",
+            value: function increment(data, params) {
+                return this.update(firestoreServerIncrementUpdateToUpdateData(data), params);
+            }
+        },
+        {
+            key: "arrayUpdate",
+            value: function arrayUpdate(data, params) {
+                return this.update(firestoreServerArrayUpdateToUpdateData(data), params);
+            }
+        },
+        {
+            key: "update",
+            value: function update(data, params) {
+                if (params === null || params === void 0 ? void 0 : params.precondition) {
+                    this.transaction.update(this.documentRef, data, params.precondition);
+                } else {
+                    this.transaction.update(this.documentRef, data);
+                }
+                return Promise.resolve();
+            }
         }
-    });
-}
-
+    ]);
+    return TransactionFirestoreDocumentDataAccessor;
+}();
 /**
- * Creates a complete set of {@link FirestoreDrivers} for Google Cloud Firestore (Admin SDK).
+ * Creates a {@link FirestoreDocumentDataAccessorFactory} that produces transaction-backed accessors.
  *
- * Bundles the server-side accessor driver and query driver, identified as `@google-cloud/firestore`.
+ * All accessors share the same transaction, so reads and writes participate in the same
+ * atomic operation.
  *
- * @returns A complete set of {@link FirestoreDrivers} for the Google Cloud Admin SDK.
+ * @param transaction - The Google Cloud Transaction to execute operations within.
+ * @returns A factory that creates transaction-backed accessors sharing the given transaction.
  *
  * @example
  * ```typescript
- * const drivers = googleCloudFirestoreDrivers();
- * const context = firestoreContextFactory(drivers);
+ * await firestore.runTransaction(async (transaction) => {
+ *   const factory = transactionAccessorFactory<User>(transaction);
+ *   const accessor = factory.accessorFor(userDocRef);
+ *   const snapshot = await accessor.get();
+ *   await accessor.update({ name: 'Updated' });
+ * });
  * ```
- */ function googleCloudFirestoreDrivers() {
+ */ function transactionAccessorFactory(transaction) {
     return {
-        firestoreDriverIdentifier: '@google-cloud/firestore',
-        firestoreDriverType: 'production',
-        firestoreAccessorDriver: googleCloudFirestoreAccessorDriver(),
-        firestoreQueryDriver: googleCloudFirestoreQueryDriver()
+        accessorFor: function accessorFor(ref) {
+            return new TransactionFirestoreDocumentDataAccessor(transaction, ref);
+        }
     };
 }
-
-/**
- * Pre-configured {@link FirestoreContextFactory} for Google Cloud Firestore (Admin SDK) usage.
- *
- * Wires the server-side Firestore drivers into the abstract {@link FirestoreContextFactory}
- * so that collections, documents, queries, and transactions all use the Admin SDK implementation.
- *
- * @example
- * ```ts
- * const context = googleCloudFirestoreContextFactory(firestore);
- * ```
- */ var googleCloudFirestoreContextFactory = firestoreContextFactory(googleCloudFirestoreDrivers());
-
-// MARK: Field Converters
+// MARK: Context
 /**
- * Creates a Firestore field mapping that encrypts/decrypts a JSON-serializable value
- * using AES-256-GCM. The value is stored in Firestore as a base64-encoded string.
- *
- * The encryption key is resolved from the configured secret source on each read/write,
- * allowing for key rotation via environment variable changes.
- *
- * @example
- * ```typescript
- * const jwksField = firestoreEncryptedField<JWKSet>({
- *   secret: process.env['FIRESTORE_ENCRYPTION_KEY']!,
- *   default: () => ({ keys: [] })
- * });
- * ```
+ * A {@link FirestoreDocumentContext} backed by a Google Cloud {@link Transaction}.
  *
- * @template T - The JSON-serializable value type.
- * @param config - Encryption field configuration.
- * @returns A field mapping configuration for encrypted values.
- */ function firestoreEncryptedField(config) {
-    var secret = config.secret, defaultValue = config.default;
-    var getKey = resolveEncryptionKey(secret);
-    return firestoreField({
-        default: defaultValue,
-        fromData: function fromData(data) {
-            return decryptValue(data, getKey());
-        },
-        toData: function toData(value) {
-            return encryptValue(value, getKey());
+ * All document accessors created from this context operate within the same transaction.
+ */ var TransactionFirestoreDocumentContext = /*#__PURE__*/ function() {
+    function TransactionFirestoreDocumentContext(transaction) {
+        _class_call_check$m(this, TransactionFirestoreDocumentContext);
+        _define_property$t(this, "_transaction", void 0);
+        _define_property$t(this, "contextType", FirestoreDocumentContextType.TRANSACTION);
+        _define_property$t(this, "accessorFactory", void 0);
+        this._transaction = transaction;
+        this.accessorFactory = transactionAccessorFactory(transaction);
+    }
+    _create_class$d(TransactionFirestoreDocumentContext, [
+        {
+            key: "transaction",
+            get: function get() {
+                return this._transaction;
+            }
         }
-    });
-}
+    ]);
+    return TransactionFirestoreDocumentContext;
+}();
 /**
- * Creates a Firestore field mapping for an optional encrypted field.
- *
- * When the value is null/undefined, it is stored/read as null. When present, it is
- * encrypted/decrypted using AES-256-GCM.
- *
- * @example
- * ```typescript
- * const optionalSecretField = optionalFirestoreEncryptedField<OAuthClientSecret>({
- *   secret: process.env['FIRESTORE_ENCRYPTION_KEY']!
- * });
- * ```
+ * Creates a {@link TransactionFirestoreDocumentContext} wrapping the given transaction.
  *
- * @template T - The JSON-serializable value type.
- * @param config - Encryption field configuration.
- * @returns A field mapping configuration for optional encrypted values.
- */ function optionalFirestoreEncryptedField(config) {
-    var secret = config.secret;
-    var getKey = resolveEncryptionKey(secret);
-    return optionalFirestoreField({
-        transformFromData: function transformFromData(data) {
-            return decryptValue(data, getKey());
-        },
-        transformToData: function transformToData(value) {
-            return encryptValue(value, getKey());
-        }
-    });
+ * @param transaction - The Google Cloud Transaction to use.
+ * @returns A new {@link TransactionFirestoreDocumentContext} for the given transaction.
+ */ function transactionDocumentContext(transaction) {
+    return new TransactionFirestoreDocumentContext(transaction);
 }
 
+function _array_like_to_array$c(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes$3(arr) {
+    if (Array.isArray(arr)) return arr;
+}
 function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -3443,20 +3823,58 @@ function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$d(fn) {
-    return function() {
-        var self = this, args = arguments;
-        return new Promise(function(resolve, reject) {
-            var gen = fn.apply(self, args);
-            function _next(value) {
-                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "next", value);
-            }
-            function _throw(err) {
-                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "throw", err);
-            }
-            _next(undefined);
-        });
-    };
+function _async_to_generator$d(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _iterable_to_array_limit$3(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest$3() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _sliced_to_array$3(arr, i) {
+    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$c(arr, i) || _non_iterable_rest$3();
+}
+function _unsupported_iterable_to_array$c(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$c(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$c(o, minLen);
 }
 function _ts_generator$d(thisArg, body) {
     var f, y, t, _ = {
@@ -3550,166 +3968,385 @@ function _ts_generator$d(thisArg, body) {
         } finally{
             f = t = 0;
         }
-        if (op[0] & 5) throw op[1];
-        return {
-            value: op[0] ? op[1] : void 0,
-            done: true
-        };
-    }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Resolves a Firestore {@link CollectionReference} from a starting point and optional additional path segments.
+ *
+ * Supports nested subcollection paths by processing segments in pairs (doc ID, collection name).
+ *
+ * @param start - A Firestore object that can resolve collection paths (e.g., Firestore instance, DocumentReference).
+ * @param path - The initial collection path.
+ * @param pathSegments - Optional pairs of [docId, collectionName] for subcollection traversal.
+ * @returns The resolved {@link CollectionReference} at the given path.
+ * @throws Error if pathSegments length is odd (segments must come in pairs).
+ *
+ * @example
+ * ```typescript
+ * const ref = collectionRefForPath<User>(firestore, 'users');
+ * const subRef = collectionRefForPath<Comment>(firestore, 'users', ['user123', 'comments']);
+ * ```
+ */ function collectionRefForPath(start, path, pathSegments) {
+    var ref = start.collection(path);
+    if (pathSegments === null || pathSegments === void 0 ? void 0 : pathSegments.length) {
+        if (pathSegments.length % 2 !== 0) {
+            throw new Error('Invalid number of path segments provided for collection. Path: "'.concat(path, '" + "').concat(pathSegments, '"'));
+        }
+        var batches = batch(pathSegments, 2); // batch to tuple [string, string]
+        batches.forEach(function(x) {
+            var _x = _sliced_to_array$3(x, 2), first = _x[0], second = _x[1];
+            ref = ref.doc(first).collection(second);
+        });
+    }
+    return ref;
+}
+/**
+ * Resolves a Firestore {@link DocumentReference} from a starting point, optional document path, and additional path segments.
+ *
+ * If no path is provided, auto-generates a document ID. Supports nested subcollection
+ * traversal via path segment pairs.
+ *
+ * @param start - A Firestore object that can resolve document paths (e.g., CollectionReference).
+ * @param path - Optional document ID or path within the collection.
+ * @param pathSegments - Optional pairs of [collectionName, docId] for subcollection traversal.
+ * @returns The resolved {@link DocumentReference} at the given path.
+ *
+ * @example
+ * ```typescript
+ * const ref = docRefForPath<User>(usersCollection, 'user123');
+ * const autoRef = docRefForPath<User>(usersCollection); // auto-generated ID
+ * ```
+ */ function docRefForPath(start, path, pathSegments) {
+    var doc = path ? start.doc(path) : start.doc();
+    if (pathSegments === null || pathSegments === void 0 ? void 0 : pathSegments.length) {
+        var batches = batch(pathSegments, 2); // batch to tuple [string, string]
+        batches.forEach(function(x) {
+            var _x = _sliced_to_array$3(x, 2), first = _x[0], second = _x[1];
+            var collection = doc.collection(first);
+            doc = second ? collection.doc(second) : collection.doc();
+        });
+    }
+    return doc;
+}
+/**
+ * Creates a {@link FirestoreAccessorDriver} for Google Cloud Firestore (Admin SDK).
+ *
+ * Implements document/collection resolution, transaction/batch factories, and context factories
+ * using the `@google-cloud/firestore` library.
+ *
+ * @returns A {@link FirestoreAccessorDriver} for the Google Cloud Admin SDK.
+ *
+ * @example
+ * ```typescript
+ * const accessorDriver = googleCloudFirestoreAccessorDriver();
+ * ```
+ */ function googleCloudFirestoreAccessorDriver() {
+    return {
+        doc: function doc(collection, path) {
+            for(var _len = arguments.length, pathSegments = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++){
+                pathSegments[_key - 2] = arguments[_key];
+            }
+            return docRefForPath(collection, path, pathSegments);
+        },
+        docAtPath: function docAtPath(firestore, fullPath) {
+            return firestore.doc(fullPath);
+        },
+        collectionGroup: function collectionGroup(firestore, collectionId) {
+            return firestore.collectionGroup(collectionId);
+        },
+        collection: function collection(firestore, path) {
+            for(var _len = arguments.length, pathSegments = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++){
+                pathSegments[_key - 2] = arguments[_key];
+            }
+            return collectionRefForPath(firestore, path, pathSegments);
+        },
+        subcollection: function subcollection(document, path) {
+            for(var _len = arguments.length, pathSegments = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++){
+                pathSegments[_key - 2] = arguments[_key];
+            }
+            return collectionRefForPath(document, path, pathSegments);
+        },
+        transactionFactoryForFirestore: function transactionFactoryForFirestore(firestore) {
+            return function(fn) {
+                return _async_to_generator$d(function() {
+                    return _ts_generator$d(this, function(_state) {
+                        return [
+                            2,
+                            firestore.runTransaction(fn)
+                        ];
+                    });
+                })();
+            };
+        },
+        writeBatchFactoryForFirestore: function writeBatchFactoryForFirestore(firestore) {
+            return function() {
+                return firestore.batch();
+            };
+        },
+        defaultContextFactory: defaultFirestoreDocumentContext,
+        transactionContextFactory: transactionDocumentContext,
+        writeBatchContextFactory: writeBatchDocumentContext
+    };
+}
+
+function _array_like_to_array$b(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$8(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$b(arr);
+}
+function _define_property$s(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _iterable_to_array$8(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$8() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread$g(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$s(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$d(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$d(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$d(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _to_consumable_array$8(arr) {
+    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$b(arr) || _non_iterable_spread$8();
+}
+function _unsupported_iterable_to_array$b(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$b(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$b(o, minLen);
+}
+var _builder, _builder1;
+var _obj;
+/**
+ * Maps each abstract query constraint type to its Google Cloud Firestore implementation.
+ *
+ * Used by {@link firestoreClientQueryConstraintFunctionsDriver} to build the server-side query driver.
+ */ var FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING = (_obj = {}, _define_property$s(_obj, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return builder.limit(data.limit);
+}), _define_property$s(_obj, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return builder.limitToLast(data.limit);
+}), _define_property$s(_obj, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return builder.orderBy(data.fieldPath, data.directionStr);
+}), _define_property$s(_obj, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return builder.orderBy(FieldPath.documentId(), data.directionStr);
+}), _define_property$s(_obj, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return builder.where(data.fieldPath, data.opStr, data.value);
+}), _define_property$s(_obj, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return builder.where(FieldPath.documentId(), data.opStr, data.value);
+}), _define_property$s(_obj, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return builder.offset(data.offset);
+}), _define_property$s(_obj, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return builder.startAt(data.snapshot);
+}), _define_property$s(_obj, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return (_builder = builder).startAt.apply(_builder, _to_consumable_array$8(data.fieldValues));
+}), _define_property$s(_obj, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return builder.startAfter(data.snapshot);
+}), _define_property$s(_obj, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return builder.endAt(data.snapshot);
+}), _define_property$s(_obj, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return (_builder1 = builder).endAt.apply(_builder1, _to_consumable_array$8(data.fieldValues));
+}), _define_property$s(_obj, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, function(builder, data) {
+    return builder.endBefore(data.snapshot);
+}), _obj);
+/**
+ * Creates a {@link FirestoreQueryConstraintFunctionsDriver} for the Google Cloud Firestore server SDK.
+ *
+ * Translates abstract query constraints into Google Cloud Firestore query builder calls.
+ *
+ * @returns A {@link FirestoreQueryConstraintFunctionsDriver} for the server SDK.
+ */ function firestoreClientQueryConstraintFunctionsDriver() {
+    return makeFirestoreQueryConstraintFunctionsDriver({
+        mapping: FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING,
+        init: function init(query) {
+            return query;
+        },
+        build: function build(query) {
+            return query;
+        },
+        documentIdFieldPath: function documentIdFieldPath() {
+            return FieldPath.documentId();
+        }
+    });
 }
 /**
- * Asserts that the callable context contains auth data with a valid UID.
+ * Creates a complete {@link FirestoreQueryDriver} for Google Cloud Firestore (Admin SDK).
  *
- * @param context - The callable context to check for auth data.
- * @throws {HttpsError} Throws unauthenticated error if no auth data is present.
+ * Supports query execution (getDocs), document counting (countDocs), and real-time
+ * streaming (streamDocs) via `onSnapshot`. Transaction-aware reads are supported
+ * through the optional transaction parameter in `getDocs`.
+ *
+ * @returns A complete {@link FirestoreQueryDriver} for the Google Cloud Admin SDK.
  *
  * @example
  * ```typescript
- * assertContextHasAuth(context);
- * // Safe to access context.auth.uid
+ * const queryDriver = googleCloudFirestoreQueryDriver();
  * ```
- */ function assertContextHasAuth(context) {
-    if (!isContextWithAuthData(context)) {
-        throw unauthenticatedContextHasNoUidError();
-    }
+ */ function googleCloudFirestoreQueryDriver() {
+    return _object_spread_props$d(_object_spread$g({}, firestoreClientQueryConstraintFunctionsDriver()), {
+        countDocs: function countDocs(query) {
+            return query.count().get().then(function(x) {
+                return x.data().count;
+            });
+        },
+        getDocs: function getDocs(query, transaction) {
+            var result;
+            if (transaction) {
+                result = transaction.get(query);
+            } else {
+                result = query.get();
+            }
+            return result;
+        },
+        streamDocs: function streamDocs(query) {
+            return streamFromOnSnapshot(function(param) {
+                var next = param.next, error = param.error;
+                return query.onSnapshot(next, error);
+            });
+        }
+    });
 }
+
 /**
- * Loads the snapshot data from a Firestore document, throwing if the document does not exist.
+ * Creates a complete set of {@link FirestoreDrivers} for Google Cloud Firestore (Admin SDK).
  *
- * @param document - The Firestore document to load data from.
- * @param message - Optional custom error message.
- * @returns The document's snapshot data.
- * @throws {HttpsError} Throws a {@link modelNotAvailableError} (404) if the document has no data.
+ * Bundles the server-side accessor driver and query driver, identified as `@google-cloud/firestore`.
+ *
+ * @returns A complete set of {@link FirestoreDrivers} for the Google Cloud Admin SDK.
  *
  * @example
  * ```typescript
- * const userData = await assertSnapshotData(userDocument);
+ * const drivers = googleCloudFirestoreDrivers();
+ * const context = firestoreContextFactory(drivers);
  * ```
- */ function assertSnapshotData(document, message) {
-    return _async_to_generator$d(function() {
-        var data;
-        return _ts_generator$d(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    return [
-                        4,
-                        document.snapshotData()
-                    ];
-                case 1:
-                    data = _state.sent();
-                    if (data == null) {
-                        throw modelNotAvailableError({
-                            message: message !== null && message !== void 0 ? message : "The ".concat(document.modelType, " was unavailable.")
-                        });
-                    }
-                    return [
-                        2,
-                        data
-                    ];
-            }
-        });
-    })();
+ */ function googleCloudFirestoreDrivers() {
+    return {
+        firestoreDriverIdentifier: '@google-cloud/firestore',
+        firestoreDriverType: 'production',
+        firestoreAccessorDriver: googleCloudFirestoreAccessorDriver(),
+        firestoreQueryDriver: googleCloudFirestoreQueryDriver()
+    };
 }
+
 /**
- * Loads snapshot data and attaches the document's `id` and `key` to the result.
+ * Pre-configured {@link FirestoreContextFactory} for Google Cloud Firestore (Admin SDK) usage.
  *
- * Combines {@link assertSnapshotData} with {@link setIdAndKeyFromKeyIdRefOnDocumentData}.
+ * Wires the server-side Firestore drivers into the abstract {@link FirestoreContextFactory}
+ * so that collections, documents, queries, and transactions all use the Admin SDK implementation.
  *
- * @param document - The Firestore document to load data from.
- * @param message - Optional custom error message.
- * @returns The document's snapshot data with `id` and `key` attached.
- * @throws {HttpsError} Throws a {@link modelNotAvailableError} (404) if the document has no data.
- */ function assertSnapshotDataWithKey(document, message) {
-    return _async_to_generator$d(function() {
-        var data;
-        return _ts_generator$d(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    return [
-                        4,
-                        assertSnapshotData(document, message)
-                    ];
-                case 1:
-                    data = _state.sent();
-                    return [
-                        2,
-                        setIdAndKeyFromKeyIdRefOnDocumentData(data, document)
-                    ];
-            }
-        });
-    })();
-}
+ * @example
+ * ```ts
+ * const context = googleCloudFirestoreContextFactory(firestore);
+ * ```
+ */ var googleCloudFirestoreContextFactory = firestoreContextFactory(googleCloudFirestoreDrivers());
+
+// MARK: Field Converters
 /**
- * Asserts that the Firestore document exists without loading its data.
+ * Creates a Firestore field mapping that encrypts/decrypts a JSON-serializable value
+ * using AES-256-GCM. The value is stored in Firestore as a base64-encoded string.
  *
- * @param document - The Firestore document to check.
- * @param message - Optional custom error message.
- * @throws {HttpsError} Throws a {@link modelNotAvailableError} (404) if the document does not exist.
- */ function assertDocumentExists(document, message) {
-    return _async_to_generator$d(function() {
-        var exists;
-        return _ts_generator$d(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    return [
-                        4,
-                        document.exists()
-                    ];
-                case 1:
-                    exists = _state.sent();
-                    if (!exists) {
-                        throw documentModelNotAvailableError(document, message);
-                    }
-                    return [
-                        2
-                    ];
-            }
-        });
-    })();
-}
-/**
- * Creates a {@link modelNotAvailableError} for the given document's model type.
+ * The encryption key is resolved from the configured secret source on each read/write,
+ * allowing for key rotation via environment variable changes.
  *
- * Used by {@link assertDocumentExists} and other assertion functions.
+ * @example
+ * ```typescript
+ * const jwksField = firestoreEncryptedField<JWKSet>({
+ *   secret: process.env['FIRESTORE_ENCRYPTION_KEY']!,
+ *   default: () => ({ keys: [] })
+ * });
+ * ```
  *
- * @param document - The document (or object with `modelType`) to generate the error for.
- * @param message - Optional custom error message.
- * @returns A {@link modelNotAvailableError} with the document's model type in the message.
- */ function documentModelNotAvailableError(document, message) {
-    return modelNotAvailableError({
-        message: message !== null && message !== void 0 ? message : "The ".concat(document.modelType, " was unavailable.")
+ * @template T - The JSON-serializable value type.
+ * @param config - Encryption field configuration.
+ * @returns A field mapping configuration for encrypted values.
+ */ function firestoreEncryptedField(config) {
+    var secret = config.secret, defaultValue = config.default;
+    var getKey = resolveEncryptionKey(secret);
+    return firestoreField({
+        default: defaultValue,
+        fromData: function fromData(data) {
+            return decryptValue(data, getKey());
+        },
+        toData: function toData(value) {
+            return encryptValue(value, getKey());
+        }
     });
 }
-
-/**
- * Error code for when a phone number is already registered in Firebase Auth.
- */ var PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE = 'PHONE_NUMBER_ALREADY_EXISTS';
 /**
- * Creates a precondition conflict (409) error indicating the phone number already exists.
+ * Creates a Firestore field mapping for an optional encrypted field.
  *
- * @returns A new precondition-conflict (409) {@link HttpsError} with the phone-number-exists code.
- */ function phoneNumberAlreadyExistsError() {
-    return preconditionConflictError({
-        code: PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE,
-        message: 'This phone number already exists in the system.'
-    });
-}
-/**
- * Handles Firebase Auth errors by mapping known error codes to typed HTTP errors.
+ * When the value is null/undefined, it is stored/read as null. When present, it is
+ * encrypted/decrypted using AES-256-GCM.
  *
- * Currently maps `auth/phone-number-already-exists` to a 409 conflict error.
- * Unknown error codes are forwarded to the optional handler.
+ * @example
+ * ```typescript
+ * const optionalSecretField = optionalFirestoreEncryptedField<OAuthClientSecret>({
+ *   secret: process.env['FIRESTORE_ENCRYPTION_KEY']!
+ * });
+ * ```
  *
- * @param e - The caught error.
- * @param handleUnknownCode - Optional handler for Firebase errors with unrecognized codes.
- */ function handleFirebaseAuthError(e, handleUnknownCode) {
-    handleFirebaseError(e, function(firebaseError) {
-        switch(firebaseError.code){
-            case FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR:
-                throw phoneNumberAlreadyExistsError();
-            default:
-                handleUnknownCode === null || handleUnknownCode === void 0 ? void 0 : handleUnknownCode(firebaseError);
-                break;
+ * @template T - The JSON-serializable value type.
+ * @param config - Encryption field configuration.
+ * @returns A field mapping configuration for optional encrypted values.
+ */ function optionalFirestoreEncryptedField(config) {
+    var secret = config.secret;
+    var getKey = resolveEncryptionKey(secret);
+    return optionalFirestoreField({
+        transformFromData: function transformFromData(data) {
+            return decryptValue(data, getKey());
+        },
+        transformToData: function transformToData(value) {
+            return encryptValue(value, getKey());
         }
     });
 }
@@ -4758,9 +5395,8 @@ function resolveAnalyticsFromApiDetails(apiDetails, call, modelType, specifier)
         if (handler != null) {
             assertRequestRequiresAuthForFunction(handler, request);
             return handler(request);
-        } else {
-            throw unknownModelCrudFunctionSpecifierError(specifier);
         }
+        throw unknownModelCrudFunctionSpecifierError(specifier);
     };
     fn._requireAuth = false;
     // Aggregate _apiDetails from handler functions in the config
@@ -4982,9 +5618,8 @@ function _object_spread_props$c(target, source) {
                 specifier: specifier,
                 data: request.data.data
             }));
-        } else {
-            throw throwOnUnknownModelType(modelType);
         }
+        throw throwOnUnknownModelType(modelType);
     };
     // Aggregate _apiDetails from model type handlers in the map
     var crudModelApiDetails = aggregateCrudModelApiDetails(map);
@@ -7489,9 +8124,8 @@ function _object_spread_props$8(target, source) {
                 specifier: specifier,
                 data: request.data.data
             }));
-        } else {
-            throw developmentUnknownSpecifierError(specifier);
         }
+        throw developmentUnknownSpecifierError(specifier);
     };
 }
 /**
@@ -11980,4 +12614,4 @@ function _define_property(obj, key, value) {
 } 
 ();
 
-export { AbstractFirebaseNestContext, AbstractFirebaseServerActionsContext, AbstractFirebaseServerAuthContext, AbstractFirebaseServerAuthService, AbstractFirebaseServerAuthUserContext, AbstractFirebaseServerNewUserService, AbstractNestContext, AbstractServerFirebaseNestContext, ConfigureFirebaseAppCheckMiddlewareModule, ConfigureFirebaseWebhookMiddlewareModule, DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR, DEFAULT_SERVER_ASSETS_BASE_PATH, DEFAULT_SETUP_COM_THROTTLE_TIME, DefaultFirebaseServerEnvService, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_SERVER_ENV_TOKEN, FIREBASE_SERVER_VALIDATION_ERROR_CODE, FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN, FIREBASE_STORAGE_CONTEXT_TOKEN, FIREBASE_STORAGE_TOKEN, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FirebaseAppCheckMiddleware, FirebaseAppCheckMiddlewareConfig, FirebaseNestServerRootModule, FirebaseRawBodyMiddleware, FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsSegmentModule, FirebaseServerAnalyticsService, FirebaseServerAnalyticsServiceListener, FirebaseServerAuthModule, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, FirebaseServerAuthService, FirebaseServerAuthUserBadInputError, FirebaseServerAuthUserExistsError, FirebaseServerEnvService, FirebaseServerFirestoreContextModule, FirebaseServerFirestoreModule, FirebaseServerStorageContextModule, FirebaseServerStorageModule, FirebaseServerStorageService, GlobalRoutePrefixConfig, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MODEL_API_NEST_APPLICATION_CONTEXT, ModelApiCallModelDispatchService, ModelApiController, ModelApiDispatchConfig, ModelApiGetService, NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE, NoSetupContentFirebaseServerNewUserService, ON_CALL_MODEL_ANALYTICS_HANDLER, ON_CALL_MODEL_ANALYTICS_SERVICE, OnCallModelAnalyticsService, PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE, SkipAppCheck, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE, _onCallWithCallTypeFunction, aggregateCrudModelApiDetails, aggregateModelApiDetails, aggregateSpecifierApiDetails, alreadyExistsError, appAnalyticsModuleMetadata, appFirestoreModuleMetadata, assertContextHasAuth, assertDocumentExists, assertHasRolesInRequest, assertHasSignedTosInRequest, assertIsAdminInRequest, assertIsAdminOrTargetUserInRequestData, assertIsContextWithAuthData, assertRequestRequiresAuthForFunction, assertSnapshotData, assertSnapshotDataWithKey, badRequestError, blockingFunctionHandlerWithNestContextFactory, buildNestServerRootModule, callWithAnalytics, cloudEventHandlerWithNestContextFactory, collectionRefForPath, createModelUnknownModelTypeError, defaultFirebaseServerActionsTransformFactoryLogErrorFunction, defaultProvideFirebaseServerStorageServiceSimple, deleteModelUnknownModelTypeError, developmentUnknownSpecifierError, docRefForPath, documentModelNotAvailableError, executeOnCallQuery, firebaseAuthTokenFromDecodedIdToken, firebaseServerActionsContext, firebaseServerActionsTransformContext, firebaseServerActionsTransformFactory, firebaseServerAppTokenProvider, firebaseServerAuthModuleMetadata, firebaseServerDevFunctions, firebaseServerEnvTokenProvider, firebaseServerEnvTokenProviders, firebaseServerErrorInfo, firebaseServerErrorInfoCodePair, firebaseServerErrorInfoServerErrorCodePair, firebaseServerErrorInfoServerErrorPair, firebaseServerFirestoreContextModuleMetadata, firebaseServerStorageDefaultBucketIdTokenProvider, firebaseServerStorageModuleMetadata, firebaseServerValidationError, firebaseServerValidationServerError, firestoreClientQueryConstraintFunctionsDriver, firestoreEncryptedField, firestoreServerIncrementUpdateToUpdateData, forbiddenError, getAuthUserOrUndefined, getModelApiDetails, googleCloudFileMetadataToStorageMetadata, googleCloudFirebaseStorageContextFactory, googleCloudFirebaseStorageDrivers, googleCloudFirestoreAccessorDriver, googleCloudFirestoreContextFactory, googleCloudFirestoreDrivers, googleCloudFirestoreQueryDriver, googleCloudStorageAccessorFile, googleCloudStorageAccessorFolder, googleCloudStorageBucketForStorageFilePath, googleCloudStorageFileForStorageFilePath, googleCloudStorageFirebaseStorageAccessorDriver, googleCloudStorageFromFirebaseAdminStorage, googleCloudStorageListFilesResultFactory, handleFirebaseAuthError, handleFirebaseError, hasAuthRolesInRequest, hasNewUserSetupPasswordInRequest, hasSignedTosInRequest, inAuthContext, injectNestApplicationContextIntoRequest, injectNestIntoRequest, internalServerError, isActualSpecifier, isAdminInRequest, isAdminOrTargetUserInRequestData, isContextWithAuthData, isFirebaseError, isFirebaseHttpsError, isOnCallCrudModelApiDetails, isOnCallHandlerApiDetails, isOnCallModelTypeApiDetails, isOnCallSpecifierApiDetails, makeBlockingFunctionWithHandler, makeOnScheduleHandlerWithNestApplicationRequest, makeScheduledFunctionDevelopmentFunction, modelApiModuleMetadata, modelNotAvailableError, nestAppHasDevelopmentSchedulerEnabled, nestAppIsProductionEnvironment, nestFirebaseDoesNotExistError, nestFirebaseForbiddenPermissionError, nestServerInstance, noRunNameSpecifiedForScheduledFunctionDevelopmentFunction, noopFirebaseServerAnalyticsServiceListener, noopOnCallModelAnalyticsService, notFoundError, onCallAnalyticsEmitterInstance, onCallCreateModel, onCallDeleteModel, onCallDevelopmentFunction, onCallHandlerWithNestApplicationFactory, onCallHandlerWithNestContextFactory, onCallModel, onCallModelMissingCallTypeError, onCallModelUnknownCallTypeError, onCallQueryModel, onCallReadModel, onCallSpecifierHandler, onCallUpdateModel, onScheduleHandlerWithNestApplicationFactory, onScheduleHandlerWithNestContextFactory, optionalAuthContext, optionalFirestoreEncryptedField, permissionDeniedError, phoneNumberAlreadyExistsError, preconditionConflictError, provideAppFirestoreCollections, provideFirebaseServerAuthService, provideFirebaseServerStorageService, queryModelBadCursorError, queryModelUnknownModelTypeError, readApiDetails, readModelUnknownModelTypeError, resolveAdminOnlyValue, resolveAnalyticsFromApiDetails, setNestContextOnRequest, setNestContextOnScheduleRequest, taskQueueFunctionHandlerWithNestContextFactory, unauthenticatedContextHasNoAuthData, unauthenticatedContextHasNoUidError, unauthenticatedError, unavailableError, unavailableOrDeactivatedFunctionError, unknownModelCrudFunctionSpecifierError, unknownScheduledFunctionDevelopmentFunctionName, unknownScheduledFunctionDevelopmentFunctionType, updateModelUnknownModelTypeError, userContextFromUid, verifyAppCheckInRequest, withApiDetails };
+export { AbstractFirebaseNestContext, AbstractFirebaseServerActionsContext, AbstractFirebaseServerAuthContext, AbstractFirebaseServerAuthService, AbstractFirebaseServerAuthUserContext, AbstractFirebaseServerNewUserService, AbstractFirebaseServerUserPasswordResetService, AbstractNestContext, AbstractServerFirebaseNestContext, ConfigureFirebaseAppCheckMiddlewareModule, ConfigureFirebaseWebhookMiddlewareModule, DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR, DEFAULT_RESET_COM_THROTTLE_TIME, DEFAULT_SERVER_ASSETS_BASE_PATH, DEFAULT_SETUP_COM_THROTTLE_TIME, DefaultFirebaseServerEnvService, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_SERVER_ENV_TOKEN, FIREBASE_SERVER_VALIDATION_ERROR_CODE, FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN, FIREBASE_STORAGE_CONTEXT_TOKEN, FIREBASE_STORAGE_TOKEN, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FirebaseAppCheckMiddleware, FirebaseAppCheckMiddlewareConfig, FirebaseNestServerRootModule, FirebaseRawBodyMiddleware, FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsSegmentModule, FirebaseServerAnalyticsService, FirebaseServerAnalyticsServiceListener, FirebaseServerAuthModule, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, FirebaseServerAuthPasswordResetInvalidCodeError, FirebaseServerAuthPasswordResetNoResetConfigError, FirebaseServerAuthPasswordResetSendOnceError, FirebaseServerAuthPasswordResetThrottleError, FirebaseServerAuthService, FirebaseServerAuthUserBadInputError, FirebaseServerAuthUserExistsError, FirebaseServerEnvService, FirebaseServerFirestoreContextModule, FirebaseServerFirestoreModule, FirebaseServerStorageContextModule, FirebaseServerStorageModule, FirebaseServerStorageService, GlobalRoutePrefixConfig, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MODEL_API_NEST_APPLICATION_CONTEXT, ModelApiCallModelDispatchService, ModelApiController, ModelApiDispatchConfig, ModelApiGetService, NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE, NoContentFirebaseServerUserPasswordResetService, NoSetupContentFirebaseServerNewUserService, ON_CALL_MODEL_ANALYTICS_HANDLER, ON_CALL_MODEL_ANALYTICS_SERVICE, OnCallModelAnalyticsService, PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE, SkipAppCheck, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE, _onCallWithCallTypeFunction, aggregateCrudModelApiDetails, aggregateModelApiDetails, aggregateSpecifierApiDetails, alreadyExistsError, appAnalyticsModuleMetadata, appFirestoreModuleMetadata, assertContextHasAuth, assertDocumentExists, assertHasRolesInRequest, assertHasSignedTosInRequest, assertIsAdminInRequest, assertIsAdminOrTargetUserInRequestData, assertIsContextWithAuthData, assertRequestRequiresAuthForFunction, assertSnapshotData, assertSnapshotDataWithKey, authServicePasswordResetInvalidCodeError, authServicePasswordResetNoConfigError, authServicePasswordResetSendOnceError, authServicePasswordResetThrottleError, badRequestError, blockingFunctionHandlerWithNestContextFactory, buildNestServerRootModule, callWithAnalytics, catchAndThrowPasswordResetServerErrors, cloudEventHandlerWithNestContextFactory, collectionRefForPath, createModelUnknownModelTypeError, defaultFirebaseServerActionsTransformFactoryLogErrorFunction, defaultProvideFirebaseServerStorageServiceSimple, deleteModelUnknownModelTypeError, developmentUnknownSpecifierError, docRefForPath, documentModelNotAvailableError, executeOnCallQuery, firebaseAuthTokenFromDecodedIdToken, firebaseServerActionsContext, firebaseServerActionsTransformContext, firebaseServerActionsTransformFactory, firebaseServerAppTokenProvider, firebaseServerAuthModuleMetadata, firebaseServerDevFunctions, firebaseServerEnvTokenProvider, firebaseServerEnvTokenProviders, firebaseServerErrorInfo, firebaseServerErrorInfoCodePair, firebaseServerErrorInfoServerErrorCodePair, firebaseServerErrorInfoServerErrorPair, firebaseServerFirestoreContextModuleMetadata, firebaseServerStorageDefaultBucketIdTokenProvider, firebaseServerStorageModuleMetadata, firebaseServerValidationError, firebaseServerValidationServerError, firestoreClientQueryConstraintFunctionsDriver, firestoreEncryptedField, firestoreServerIncrementUpdateToUpdateData, forbiddenError, getAuthUserOrUndefined, getModelApiDetails, googleCloudFileMetadataToStorageMetadata, googleCloudFirebaseStorageContextFactory, googleCloudFirebaseStorageDrivers, googleCloudFirestoreAccessorDriver, googleCloudFirestoreContextFactory, googleCloudFirestoreDrivers, googleCloudFirestoreQueryDriver, googleCloudStorageAccessorFile, googleCloudStorageAccessorFolder, googleCloudStorageBucketForStorageFilePath, googleCloudStorageFileForStorageFilePath, googleCloudStorageFirebaseStorageAccessorDriver, googleCloudStorageFromFirebaseAdminStorage, googleCloudStorageListFilesResultFactory, handleFirebaseAuthError, handleFirebaseError, hasAuthRolesInRequest, hasNewUserSetupPasswordInRequest, hasSignedTosInRequest, inAuthContext, injectNestApplicationContextIntoRequest, injectNestIntoRequest, internalServerError, isActualSpecifier, isAdminInRequest, isAdminOrTargetUserInRequestData, isContextWithAuthData, isFirebaseError, isFirebaseHttpsError, isOnCallCrudModelApiDetails, isOnCallHandlerApiDetails, isOnCallModelTypeApiDetails, isOnCallSpecifierApiDetails, makeBlockingFunctionWithHandler, makeOnScheduleHandlerWithNestApplicationRequest, makeScheduledFunctionDevelopmentFunction, modelApiModuleMetadata, modelNotAvailableError, nestAppHasDevelopmentSchedulerEnabled, nestAppIsProductionEnvironment, nestFirebaseDoesNotExistError, nestFirebaseForbiddenPermissionError, nestServerInstance, noRunNameSpecifiedForScheduledFunctionDevelopmentFunction, noopFirebaseServerAnalyticsServiceListener, noopOnCallModelAnalyticsService, notFoundError, onCallAnalyticsEmitterInstance, onCallCreateModel, onCallDeleteModel, onCallDevelopmentFunction, onCallHandlerWithNestApplicationFactory, onCallHandlerWithNestContextFactory, onCallModel, onCallModelMissingCallTypeError, onCallModelUnknownCallTypeError, onCallQueryModel, onCallReadModel, onCallSpecifierHandler, onCallUpdateModel, onScheduleHandlerWithNestApplicationFactory, onScheduleHandlerWithNestContextFactory, optionalAuthContext, optionalFirestoreEncryptedField, permissionDeniedError, phoneNumberAlreadyExistsError, preconditionConflictError, provideAppFirestoreCollections, provideFirebaseServerAuthService, provideFirebaseServerStorageService, queryModelBadCursorError, queryModelUnknownModelTypeError, readApiDetails, readModelUnknownModelTypeError, resolveAdminOnlyValue, resolveAnalyticsFromApiDetails, setNestContextOnRequest, setNestContextOnScheduleRequest, taskQueueFunctionHandlerWithNestContextFactory, unauthenticatedContextHasNoAuthData, unauthenticatedContextHasNoUidError, unauthenticatedError, unavailableError, unavailableOrDeactivatedFunctionError, unknownModelCrudFunctionSpecifierError, unknownScheduledFunctionDevelopmentFunctionName, unknownScheduledFunctionDevelopmentFunctionType, updateModelUnknownModelTypeError, userContextFromUid, verifyAppCheckInRequest, withApiDetails };