@dereekb/firebase-server 13.7.0 → 13.8.0

package/mailgun/index.cjs.js

@@ -337,7 +337,97 @@ function _ts_generator(thisArg, body) {
         }
     ]);
     return AbstractMailgunContentFirebaseServerNewUserService;
+}(firebaseServer.AbstractFirebaseServerNewUserService);
+/**
+ * Abstract {@link FirebaseServerUserPasswordResetService} implementation that sends a password reset
+ * email to users via Mailgun templates.
+ *
+ * Subclasses implement `buildPasswordResetMailgunContentRequest` to define the template, subject,
+ * and any custom variables. The user's email, display name, UID, and reset password are
+ * automatically injected as Mailgun user variables.
+ *
+ * @example
+ * ```ts
+ * class PasswordResetEmailService extends AbstractMailgunContentFirebaseServerUserPasswordResetService {
+ *   protected async buildPasswordResetMailgunContentRequest(details) {
+ *     return {
+ *       template: 'password-reset',
+ *       subject: 'Reset Your Password',
+ *       from: 'noreply@example.com'
+ *     };
+ *   }
+ * }
+ * ```
+ */ var AbstractMailgunContentFirebaseServerUserPasswordResetService = /*#__PURE__*/ function(AbstractFirebaseServerUserPasswordResetService) {
+    _inherits(AbstractMailgunContentFirebaseServerUserPasswordResetService, AbstractFirebaseServerUserPasswordResetService);
+    function AbstractMailgunContentFirebaseServerUserPasswordResetService(authService, mailgunService) {
+        _class_call_check(this, AbstractMailgunContentFirebaseServerUserPasswordResetService);
+        var _this;
+        _this = _call_super(this, AbstractMailgunContentFirebaseServerUserPasswordResetService, [
+            authService
+        ]), _define_property(_this, "mailgunService", void 0);
+        _this.mailgunService = mailgunService;
+        return _this;
+    }
+    _create_class(AbstractMailgunContentFirebaseServerUserPasswordResetService, [
+        {
+            key: "sendPasswordResetContentToUser",
+            value: function sendPasswordResetContentToUser(details) {
+                return _async_to_generator(function() {
+                    var userRecord, resetPassword, uid, displayName, email, baseRequest, baseRequestTo;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    details.userContext.loadRecord()
+                                ];
+                            case 1:
+                                userRecord = _state.sent();
+                                resetPassword = details.claims.resetPassword;
+                                uid = userRecord.uid, displayName = userRecord.displayName, email = userRecord.email;
+                                if (!email) {
+                                    throw new Error('Email is not present/available for the user record "'.concat(userRecord.uid, '"'));
+                                }
+                                return [
+                                    4,
+                                    this.buildPasswordResetMailgunContentRequest(details)
+                                ];
+                            case 2:
+                                baseRequest = _state.sent();
+                                baseRequestTo = baseRequest.to;
+                                return [
+                                    4,
+                                    this.mailgunService.sendTemplateEmail(_object_spread_props(_object_spread({
+                                        batchSend: false
+                                    }, baseRequest), {
+                                        to: {
+                                            name: baseRequestTo === null || baseRequestTo === void 0 ? void 0 : baseRequestTo.name,
+                                            email: email,
+                                            userVariables: _object_spread_props(_object_spread({
+                                                resetPassword: resetPassword
+                                            }, baseRequestTo === null || baseRequestTo === void 0 ? void 0 : baseRequestTo.userVariables), {
+                                                displayName: displayName,
+                                                uid: uid
+                                            })
+                                        },
+                                        sendTestEmails: baseRequest.sendTestEmails || details.sendDetailsInTestEnvironment || undefined
+                                    }))
+                                ];
+                            case 3:
+                                _state.sent();
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return AbstractMailgunContentFirebaseServerUserPasswordResetService;
 } 
-(firebaseServer.AbstractFirebaseServerNewUserService);
+(firebaseServer.AbstractFirebaseServerUserPasswordResetService);
 
 exports.AbstractMailgunContentFirebaseServerNewUserService = AbstractMailgunContentFirebaseServerNewUserService;
+exports.AbstractMailgunContentFirebaseServerUserPasswordResetService = AbstractMailgunContentFirebaseServerUserPasswordResetService;

package/mailgun/index.esm.js

@@ -1,4 +1,4 @@
-import { AbstractFirebaseServerNewUserService } from '@dereekb/firebase-server';
+import { AbstractFirebaseServerNewUserService, AbstractFirebaseServerUserPasswordResetService } from '@dereekb/firebase-server';
 
 function _assert_this_initialized(self) {
     if (self === void 0) {
@@ -335,7 +335,96 @@ function _ts_generator(thisArg, body) {
         }
     ]);
     return AbstractMailgunContentFirebaseServerNewUserService;
+}(AbstractFirebaseServerNewUserService);
+/**
+ * Abstract {@link FirebaseServerUserPasswordResetService} implementation that sends a password reset
+ * email to users via Mailgun templates.
+ *
+ * Subclasses implement `buildPasswordResetMailgunContentRequest` to define the template, subject,
+ * and any custom variables. The user's email, display name, UID, and reset password are
+ * automatically injected as Mailgun user variables.
+ *
+ * @example
+ * ```ts
+ * class PasswordResetEmailService extends AbstractMailgunContentFirebaseServerUserPasswordResetService {
+ *   protected async buildPasswordResetMailgunContentRequest(details) {
+ *     return {
+ *       template: 'password-reset',
+ *       subject: 'Reset Your Password',
+ *       from: 'noreply@example.com'
+ *     };
+ *   }
+ * }
+ * ```
+ */ var AbstractMailgunContentFirebaseServerUserPasswordResetService = /*#__PURE__*/ function(AbstractFirebaseServerUserPasswordResetService) {
+    _inherits(AbstractMailgunContentFirebaseServerUserPasswordResetService, AbstractFirebaseServerUserPasswordResetService);
+    function AbstractMailgunContentFirebaseServerUserPasswordResetService(authService, mailgunService) {
+        _class_call_check(this, AbstractMailgunContentFirebaseServerUserPasswordResetService);
+        var _this;
+        _this = _call_super(this, AbstractMailgunContentFirebaseServerUserPasswordResetService, [
+            authService
+        ]), _define_property(_this, "mailgunService", void 0);
+        _this.mailgunService = mailgunService;
+        return _this;
+    }
+    _create_class(AbstractMailgunContentFirebaseServerUserPasswordResetService, [
+        {
+            key: "sendPasswordResetContentToUser",
+            value: function sendPasswordResetContentToUser(details) {
+                return _async_to_generator(function() {
+                    var userRecord, resetPassword, uid, displayName, email, baseRequest, baseRequestTo;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    details.userContext.loadRecord()
+                                ];
+                            case 1:
+                                userRecord = _state.sent();
+                                resetPassword = details.claims.resetPassword;
+                                uid = userRecord.uid, displayName = userRecord.displayName, email = userRecord.email;
+                                if (!email) {
+                                    throw new Error('Email is not present/available for the user record "'.concat(userRecord.uid, '"'));
+                                }
+                                return [
+                                    4,
+                                    this.buildPasswordResetMailgunContentRequest(details)
+                                ];
+                            case 2:
+                                baseRequest = _state.sent();
+                                baseRequestTo = baseRequest.to;
+                                return [
+                                    4,
+                                    this.mailgunService.sendTemplateEmail(_object_spread_props(_object_spread({
+                                        batchSend: false
+                                    }, baseRequest), {
+                                        to: {
+                                            name: baseRequestTo === null || baseRequestTo === void 0 ? void 0 : baseRequestTo.name,
+                                            email: email,
+                                            userVariables: _object_spread_props(_object_spread({
+                                                resetPassword: resetPassword
+                                            }, baseRequestTo === null || baseRequestTo === void 0 ? void 0 : baseRequestTo.userVariables), {
+                                                displayName: displayName,
+                                                uid: uid
+                                            })
+                                        },
+                                        sendTestEmails: baseRequest.sendTestEmails || details.sendDetailsInTestEnvironment || undefined
+                                    }))
+                                ];
+                            case 3:
+                                _state.sent();
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return AbstractMailgunContentFirebaseServerUserPasswordResetService;
 } 
-(AbstractFirebaseServerNewUserService);
+(AbstractFirebaseServerUserPasswordResetService);
 
-export { AbstractMailgunContentFirebaseServerNewUserService };
+export { AbstractMailgunContentFirebaseServerNewUserService, AbstractMailgunContentFirebaseServerUserPasswordResetService };

package/mailgun/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/mailgun",
-  "version": "13.7.0",
+  "version": "13.8.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.7.0",
-    "@dereekb/firebase": "13.7.0",
-    "@dereekb/firebase-server": "13.7.0",
-    "@dereekb/date": "13.7.0",
-    "@dereekb/nestjs": "13.7.0",
-    "@dereekb/model": "13.7.0",
-    "@dereekb/rxjs": "13.7.0",
-    "@dereekb/util": "13.7.0"
+    "@dereekb/analytics": "13.8.0",
+    "@dereekb/firebase": "13.8.0",
+    "@dereekb/firebase-server": "13.8.0",
+    "@dereekb/date": "13.8.0",
+    "@dereekb/nestjs": "13.8.0",
+    "@dereekb/model": "13.8.0",
+    "@dereekb/rxjs": "13.8.0",
+    "@dereekb/util": "13.8.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/mailgun/src/lib/auth.mailgun.d.ts

@@ -1,5 +1,5 @@
 import { type MailgunRecipient, type MailgunService, type MailgunTemplateEmailRequest } from '@dereekb/nestjs/mailgun';
-import { AbstractFirebaseServerNewUserService, type FirebaseServerAuthContext, type FirebaseServerAuthNewUserSetupDetails, type FirebaseServerAuthService, type FirebaseServerAuthUserContext } from '@dereekb/firebase-server';
+import { AbstractFirebaseServerNewUserService, AbstractFirebaseServerUserPasswordResetService, type FirebaseServerAuthContext, type FirebaseServerAuthNewUserSetupDetails, type FirebaseServerAuthPasswordResetDetails, type FirebaseServerAuthService, type FirebaseServerAuthUserContext } from '@dereekb/firebase-server';
 /**
  * Partial {@link MailgunTemplateEmailRequest} for {@link AbstractMailgunContentFirebaseServerNewUserService}.
  *
@@ -36,3 +36,39 @@ export declare abstract class AbstractMailgunContentFirebaseServerNewUserService
     protected sendSetupContentToUser(user: FirebaseServerAuthNewUserSetupDetails<U, D>): Promise<void>;
     protected abstract buildNewUserMailgunContentRequest(user: FirebaseServerAuthNewUserSetupDetails<U, D>): Promise<NewUserMailgunContentRequest>;
 }
+/**
+ * Partial {@link MailgunTemplateEmailRequest} for {@link AbstractMailgunContentFirebaseServerUserPasswordResetService}.
+ *
+ * The `to` field is omitted because the user's email and details are automatically
+ * configured from the Firebase Auth user record during `sendPasswordResetContentToUser`.
+ */
+export interface ResetPasswordMailgunContentRequest extends Omit<MailgunTemplateEmailRequest, 'to'> {
+    to?: Partial<Omit<MailgunRecipient, 'email'>>;
+}
+/**
+ * Abstract {@link FirebaseServerUserPasswordResetService} implementation that sends a password reset
+ * email to users via Mailgun templates.
+ *
+ * Subclasses implement `buildPasswordResetMailgunContentRequest` to define the template, subject,
+ * and any custom variables. The user's email, display name, UID, and reset password are
+ * automatically injected as Mailgun user variables.
+ *
+ * @example
+ * ```ts
+ * class PasswordResetEmailService extends AbstractMailgunContentFirebaseServerUserPasswordResetService {
+ *   protected async buildPasswordResetMailgunContentRequest(details) {
+ *     return {
+ *       template: 'password-reset',
+ *       subject: 'Reset Your Password',
+ *       from: 'noreply@example.com'
+ *     };
+ *   }
+ * }
+ * ```
+ */
+export declare abstract class AbstractMailgunContentFirebaseServerUserPasswordResetService<U extends FirebaseServerAuthUserContext = FirebaseServerAuthUserContext, C extends FirebaseServerAuthContext = FirebaseServerAuthContext, D = unknown> extends AbstractFirebaseServerUserPasswordResetService<U, C, D> {
+    readonly mailgunService: MailgunService;
+    constructor(authService: FirebaseServerAuthService<U, C>, mailgunService: MailgunService);
+    protected sendPasswordResetContentToUser(details: FirebaseServerAuthPasswordResetDetails<U, D>): Promise<void>;
+    protected abstract buildPasswordResetMailgunContentRequest(details: FirebaseServerAuthPasswordResetDetails<U, D>): Promise<ResetPasswordMailgunContentRequest>;
+}

package/model/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.7.0",
+  "version": "13.8.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.7.0",
-    "@dereekb/date": "13.7.0",
-    "@dereekb/firebase": "13.7.0",
-    "@dereekb/firebase-server": "13.7.0",
-    "@dereekb/model": "13.7.0",
-    "@dereekb/nestjs": "13.7.0",
-    "@dereekb/rxjs": "13.7.0",
-    "@dereekb/util": "13.7.0",
+    "@dereekb/analytics": "13.8.0",
+    "@dereekb/date": "13.8.0",
+    "@dereekb/firebase": "13.8.0",
+    "@dereekb/firebase-server": "13.8.0",
+    "@dereekb/model": "13.8.0",
+    "@dereekb/nestjs": "13.8.0",
+    "@dereekb/rxjs": "13.8.0",
+    "@dereekb/util": "13.8.0",
     "@nestjs/common": "^11.1.17",
-    "@nestjs/config": "^4.0.3",
+    "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.0",
     "date-fns": "^4.0.0",
     "firebase-functions": "^7.0.0",

package/oidc/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.7.0",
+  "version": "13.8.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.7.0",
-    "@dereekb/date": "13.7.0",
-    "@dereekb/firebase": "13.7.0",
-    "@dereekb/firebase-server": "13.7.0",
-    "@dereekb/model": "13.7.0",
-    "@dereekb/nestjs": "13.7.0",
-    "@dereekb/rxjs": "13.7.0",
-    "@dereekb/util": "13.7.0",
-    "@dereekb/zoho": "13.7.0",
+    "@dereekb/analytics": "13.8.0",
+    "@dereekb/date": "13.8.0",
+    "@dereekb/firebase": "13.8.0",
+    "@dereekb/firebase-server": "13.8.0",
+    "@dereekb/model": "13.8.0",
+    "@dereekb/nestjs": "13.8.0",
+    "@dereekb/rxjs": "13.8.0",
+    "@dereekb/util": "13.8.0",
+    "@dereekb/zoho": "13.8.0",
     "@nestjs/common": "^11.1.17",
-    "@nestjs/config": "^4.0.3",
+    "@nestjs/config": "^4.0.4",
     "express": "^5.0.0",
-    "firebase-admin": "^13.0.0",
+    "firebase-admin": "^13.8.0",
     "nanoid": "^5.1.7",
     "oidc-provider": "^9.7.0"
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.7.0",
+  "version": "13.8.0",
   "exports": {
     "./test": {
       "module": "./test/index.esm.js",
@@ -43,27 +43,27 @@
   "main": "./index.cjs.js",
   "types": "./src/index.d.ts",
   "peerDependencies": {
-    "@dereekb/analytics": "13.7.0",
-    "@dereekb/date": "13.7.0",
-    "@dereekb/dbx-core": "13.7.0",
-    "@dereekb/firebase": "13.7.0",
-    "@dereekb/model": "13.7.0",
-    "@dereekb/nestjs": "13.7.0",
-    "@dereekb/rxjs": "13.7.0",
-    "@dereekb/util": "13.7.0",
-    "@dereekb/zoho": "13.7.0",
+    "@dereekb/analytics": "13.8.0",
+    "@dereekb/date": "13.8.0",
+    "@dereekb/dbx-core": "13.8.0",
+    "@dereekb/firebase": "13.8.0",
+    "@dereekb/model": "13.8.0",
+    "@dereekb/nestjs": "13.8.0",
+    "@dereekb/rxjs": "13.8.0",
+    "@dereekb/util": "13.8.0",
+    "@dereekb/zoho": "13.8.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.17",
-    "@nestjs/config": "^4.0.3",
-    "@nestjs/core": "^11.1.17",
-    "@nestjs/platform-express": "^11.1.17",
+    "@nestjs/config": "^4.0.4",
+    "@nestjs/core": "^11.1.18",
+    "@nestjs/platform-express": "^11.1.18",
     "@nestjs/testing": "^11.1.14",
     "archiver": "^7.0.0",
     "arktype": "^2.2.0",
     "date-fns": "^4.0.0",
     "express": "^5.0.0",
-    "firebase-admin": "^13.0.0",
+    "firebase-admin": "^13.8.0",
     "firebase-functions": "^7.0.0",
     "firebase-functions-test": "3.4.1",
     "jsonwebtoken": "^9.0.0",

package/src/lib/auth/auth.service.d.ts

@@ -583,6 +583,234 @@ export declare abstract class AbstractFirebaseServerNewUserService<U extends Fir
 export declare class NoSetupContentFirebaseServerNewUserService<U extends FirebaseServerAuthUserContext = FirebaseServerAuthUserContext> extends AbstractFirebaseServerNewUserService<U> {
     protected sendSetupContentToUser(_details: FirebaseServerAuthNewUserSetupDetails<U>): Promise<void>;
 }
+/**
+ * Configuration for initiating a password reset flow for an existing Firebase Auth user.
+ *
+ * Supports identifying the user by UID or email, and optionally sending reset content
+ * (e.g., an email with the temporary password) immediately after initiation.
+ *
+ * @example
+ * ```typescript
+ * await passwordResetService.beginPasswordReset({
+ *   uid: 'some-uid',
+ *   sendResetContent: true,
+ *   sendResetThrowErrors: true
+ * });
+ * ```
+ */
+export interface FirebaseServerAuthInitiatePasswordReset<D = unknown> {
+    /**
+     * Specific user identifier to use.
+     */
+    readonly uid?: Maybe<FirebaseAuthUserId>;
+    /**
+     * Email for the user, if identifying by email.
+     */
+    readonly email?: Maybe<EmailAddress>;
+    /**
+     * Whether or not to send a reset email. Is false by default.
+     */
+    readonly sendResetContent?: Maybe<boolean>;
+    /**
+     * If true, and the reset content has been sent before, it will not be sent again.
+     */
+    readonly sendResetDetailsOnce?: Maybe<boolean>;
+    /**
+     * If true, will ignore throttling when sending reset content.
+     */
+    readonly sendResetIgnoreThrottle?: Maybe<boolean>;
+    /**
+     * Whether or not to throw an error if sending reset content fails. Is false by default.
+     */
+    readonly sendResetThrowErrors?: Maybe<boolean>;
+    /**
+     * Whether or not to force sending the test details.
+     */
+    readonly sendDetailsInTestEnvironment?: Maybe<boolean>;
+    /**
+     * Any additional reset context.
+     */
+    readonly data?: Maybe<D>;
+}
+/**
+ * Configuration options for sending password reset content (e.g., reset email) to a user.
+ *
+ * Controls throttling, send-once behavior, and error handling for the delivery process.
+ */
+export interface FirebaseServerAuthPasswordResetSendContentConfig<D = unknown> {
+    /**
+     * Whether or not to force sending the test details. Usage differs between providers.
+     */
+    readonly sendDetailsInTestEnvironment?: Maybe<boolean>;
+    /**
+     * Whether or not to skip sending again if the reset content has already been sent once.
+     */
+    readonly sendResetDetailsOnce?: Maybe<boolean>;
+    /**
+     * Whether or not to force sending again even if the send is being throttled.
+     */
+    readonly ignoreSendThrottleTime?: Maybe<boolean>;
+    /**
+     * Whether or not to throw errors if the send fails, instead of returning false.
+     *
+     * @see FirebaseServerAuthPasswordResetNoResetConfigError
+     * @see FirebaseServerAuthPasswordResetThrottleError
+     */
+    readonly throwErrors?: Maybe<boolean>;
+    /**
+     * Any additional reset context.
+     */
+    readonly data?: Maybe<D>;
+}
+/**
+ * Details about a user that is in the password reset phase, including their user context,
+ * reset claims data, and the send configuration that was used.
+ */
+export interface FirebaseServerAuthPasswordResetDetails<U extends FirebaseServerAuthUserContext = FirebaseServerAuthUserContext, D = unknown> extends FirebaseServerAuthPasswordResetSendContentConfig<D> {
+    readonly userContext: U;
+    readonly claims: FirebaseAuthResetUserPasswordClaimsData;
+}
+/**
+ * Input for completing a password reset, containing the temporary reset code
+ * and the desired new password.
+ */
+export interface FirebaseServerAuthCompletePasswordResetInput {
+    /**
+     * The temporary reset code from the reset email, to be verified against claims.
+     */
+    readonly resetPassword: string;
+    /**
+     * The new password to set after verification succeeds.
+     */
+    readonly newPassword: PasswordString;
+}
+/**
+ * Service for managing password reset flows for existing Firebase Auth users.
+ *
+ * Handles initiating password resets (generating temporary passwords), sending reset content
+ * (with throttling), loading reset state, and completing the reset by setting a new password.
+ *
+ * @example
+ * ```typescript
+ * const resetSvc = authService.passwordReset();
+ * const claims = await resetSvc.beginPasswordReset({ uid: 'some-uid', sendResetContent: true });
+ * // Later, after user verifies identity:
+ * await resetSvc.completePasswordReset('some-uid', { resetPassword: '123456', newPassword: 'newSecure' });
+ * ```
+ */
+export interface FirebaseServerUserPasswordResetService<D = unknown, U extends FirebaseServerAuthUserContext = FirebaseServerAuthUserContext> {
+    /**
+     * Initiates a password reset for the identified user, generating a temporary password
+     * and storing reset claims. Optionally sends reset content (e.g., email) immediately.
+     *
+     * When `sendResetContent` is true, this method delegates to {@link sendResetContent} and
+     * may throw the same errors (throttle, send-once, no-config) depending on the configuration.
+     *
+     * @param input - Configuration for the reset, including user identification and send options.
+     * @throws Throws if neither uid nor email is provided.
+     * @throws {FirebaseServerAuthPasswordResetThrottleError} When send is throttled and `sendResetThrowErrors` is true.
+     * @throws {FirebaseServerAuthPasswordResetSendOnceError} When already sent and `sendResetDetailsOnce` + `sendResetThrowErrors` are true.
+     * @throws {FirebaseServerAuthPasswordResetNoResetConfigError} When no reset claims exist and `sendResetThrowErrors` is true.
+     */
+    beginPasswordReset(input: FirebaseServerAuthInitiatePasswordReset<D>): Promise<FirebaseServerAuthResetUserPasswordClaims>;
+    /**
+     * Sends reset content (e.g., a reset email) to the user.
+     *
+     * Respects throttling and send-once constraints from the config. Returns `true` if
+     * content was actually sent, `false` if skipped due to throttling or send-once rules.
+     *
+     * @param uid - The target user's UID.
+     * @param config - Optional delivery configuration.
+     * @throws {FirebaseServerAuthPasswordResetThrottleError} When throttled and `throwErrors` is true.
+     * @throws {FirebaseServerAuthPasswordResetSendOnceError} When already sent and `sendResetDetailsOnce` + `throwErrors` are true.
+     * @throws {FirebaseServerAuthPasswordResetNoResetConfigError} When no reset claims exist and `throwErrors` is true.
+     */
+    sendResetContent(uid: FirebaseAuthUserId, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<boolean>;
+    /**
+     * Loads the reset details for the user if they are in the reset phase.
+     *
+     * @param uid - The target user's UID.
+     * @param config - Optional config to forward to the details.
+     * @returns The reset details, or `undefined` if the user does not exist or has no reset claims.
+     */
+    loadResetDetails(uid: FirebaseAuthUserId, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<Maybe<FirebaseServerAuthPasswordResetDetails<U, D>>>;
+    /**
+     * Loads the reset details for a user context that is already resolved.
+     *
+     * @param userContext - The resolved user context.
+     * @param config - Optional config to forward to the details.
+     * @returns The reset details, or `undefined` if the user has no reset claims.
+     */
+    loadResetDetailsForUserContext(userContext: U, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<Maybe<FirebaseServerAuthPasswordResetDetails<U, D>>>;
+    /**
+     * Completes the password reset by verifying the temporary reset code against the user's
+     * claims and setting the new password. Clears reset claims on success.
+     *
+     * @param uid - The target user's UID.
+     * @param input - The reset code and new password.
+     * @throws {FirebaseServerAuthPasswordResetInvalidCodeError} When the reset code is invalid or no reset is active.
+     */
+    completePasswordReset(uid: FirebaseAuthUserId, input: FirebaseServerAuthCompletePasswordResetInput): Promise<admin.auth.UserRecord>;
+}
+/**
+ * Default throttle duration (1 hour) between reset content sends to prevent spam.
+ *
+ * Used by {@link AbstractFirebaseServerUserPasswordResetService.sendResetContent} to rate-limit delivery.
+ */
+export declare const DEFAULT_RESET_COM_THROTTLE_TIME: number;
+/**
+ * Base implementation of {@link FirebaseServerUserPasswordResetService} that handles reset initiation,
+ * claims management, throttled reset content delivery, and reset completion.
+ *
+ * Subclasses must implement {@link sendPasswordResetContentToUser} to define how reset content
+ * (e.g., reset email, SMS) is delivered to the user.
+ *
+ * @example
+ * ```typescript
+ * export class MyPasswordResetService extends AbstractFirebaseServerUserPasswordResetService<MyUserContext> {
+ *   protected async sendPasswordResetContentToUser(details: FirebaseServerAuthPasswordResetDetails<MyUserContext>): Promise<void> {
+ *     await this.emailService.sendResetEmail(details.userContext.uid, details.claims.resetPassword);
+ *   }
+ * }
+ * ```
+ */
+export declare abstract class AbstractFirebaseServerUserPasswordResetService<U extends FirebaseServerAuthUserContext = FirebaseServerAuthUserContext, C extends FirebaseServerAuthContext = FirebaseServerAuthContext, D = unknown> implements FirebaseServerUserPasswordResetService<D, U> {
+    private readonly _authService;
+    /**
+     * Minimum time between reset content sends. Defaults to {@link DEFAULT_RESET_COM_THROTTLE_TIME} (1 hour).
+     * Override in subclasses to customize the throttle window.
+     */
+    protected resetThrottleTime: Milliseconds;
+    constructor(authService: FirebaseServerAuthService<U, C>);
+    get authService(): FirebaseServerAuthService<U, C>;
+    beginPasswordReset(input: FirebaseServerAuthInitiatePasswordReset<D>): Promise<FirebaseServerAuthResetUserPasswordClaims>;
+    sendResetContent(uid: FirebaseAuthUserId, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<boolean>;
+    loadResetDetails(uid: FirebaseAuthUserId, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<Maybe<FirebaseServerAuthPasswordResetDetails<U, D>>>;
+    loadResetDetailsForUserContext(userContext: U, config?: FirebaseServerAuthPasswordResetSendContentConfig<D>): Promise<Maybe<FirebaseServerAuthPasswordResetDetails<U, D>>>;
+    /**
+     * Records the current timestamp as the last reset content communication date in the user's claims.
+     *
+     * @param details - The user's reset details containing the user context.
+     */
+    protected updateResetContentSentTime(details: FirebaseServerAuthPasswordResetDetails<U, D>): Promise<void>;
+    completePasswordReset(uid: FirebaseAuthUserId, input: FirebaseServerAuthCompletePasswordResetInput): Promise<admin.auth.UserRecord>;
+    /**
+     * Delivers reset content (e.g., reset email, SMS) to the user.
+     *
+     * Subclasses must implement this to define the actual delivery mechanism.
+     *
+     * @param details - The user's reset details, including their context and reset claims.
+     */
+    protected abstract sendPasswordResetContentToUser(details: FirebaseServerAuthPasswordResetDetails<U, D>): Promise<void>;
+}
+/**
+ * No-op implementation of {@link AbstractFirebaseServerUserPasswordResetService} that skips sending reset content.
+ *
+ * Used as the default {@link FirebaseServerUserPasswordResetService} when no custom delivery mechanism is configured.
+ */
+export declare class NoContentFirebaseServerUserPasswordResetService<U extends FirebaseServerAuthUserContext = FirebaseServerAuthUserContext> extends AbstractFirebaseServerUserPasswordResetService<U> {
+    protected sendPasswordResetContentToUser(_details: FirebaseServerAuthPasswordResetDetails<U>): Promise<void>;
+}
 /**
  * Reference to a FirebaseServerAuthService
  */
@@ -686,6 +914,10 @@ export declare abstract class FirebaseServerAuthService<U extends FirebaseServer
      * Returns a {@link FirebaseServerNewUserService} for programmatic user creation and setup management.
      */
     abstract newUser(): FirebaseServerNewUserService;
+    /**
+     * Returns a {@link FirebaseServerUserPasswordResetService} for managing password reset flows.
+     */
+    abstract passwordReset(): FirebaseServerUserPasswordResetService;
     /**
      * Converts a Firebase Admin {@link admin.auth.UserRecord} into a normalized {@link FirebaseAuthDetails} object.
      *
@@ -735,6 +967,7 @@ export declare abstract class AbstractFirebaseServerAuthService<U extends Fireba
     abstract readRoles(claims: AuthClaims): AuthRoleSet;
     abstract claimsForRoles(roles: AuthRoleSet): AuthClaimsUpdate;
     newUser(): FirebaseServerNewUserService;
+    passwordReset(): FirebaseServerUserPasswordResetService;
     authContextInfo(context: AuthDataRef): Maybe<FirebaseAuthContextInfo>;
     authDetailsForRecord(record: admin.auth.UserRecord): FirebaseAuthDetails;
 }