@dereekb/firebase 13.30.0 → 13.31.0

package/eslint/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase/eslint",
-  "version": "13.30.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/util": "13.30.0",
+    "@dereekb/util": "13.31.0",
     "@marcbachmann/cel-js": "^7.6.1",
     "@typescript-eslint/parser": "8.59.3",
     "@typescript-eslint/utils": "8.59.3",
     "typescript": "5.9.3"
   },
   "devDependencies": {
-    "@dereekb/firebase": "13.30.0",
+    "@dereekb/firebase": "13.31.0",
     "eslint": "10.4.0",
     "firebase": "^12.12.1"
   },

package/index.cjs.js

@@ -12016,6 +12016,10 @@ function _class_call_check$c(instance, Constructor) {
     return x.value;
 });
 
+/**
+ * Suffix appended to a default profile's description in {@link oidcProviderProfileDetails}, so an
+ * admin viewing the picker sees that leaving the field empty still grants that profile's scopes.
+ */ var OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX = 'Applied by default when no profiles are assigned.';
 // MARK: Utility
 /**
  * Filters the provider-profile registry to the profiles matching the given assigned keys.
@@ -12029,6 +12033,35 @@ function _class_call_check$c(instance, Constructor) {
         return keySet.has(profile.key);
     });
 }
+/**
+ * Filters the provider-profile registry to the profiles marked {@link OidcProviderProfile.isDefault}.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The registry profiles that apply to a client with no assigned profiles.
+ */ function defaultOidcProviderProfiles(profiles) {
+    return profiles.filter(function(profile) {
+        return profile.isDefault === true;
+    });
+}
+/**
+ * Resolves the profiles that apply to a client: its assigned profiles, or — when it has NO profiles
+ * assigned — the registry's default profiles.
+ *
+ * The fallback is exclusive: a client with any assigned key resolves to exactly
+ * {@link oidcProviderProfilesForKeys}, so a non-default assignment never additionally confers the
+ * default profiles' scopes. A registry declaring no default behaves identically to
+ * {@link oidcProviderProfilesForKeys}.
+ *
+ * The fallback keys off the assigned key list being empty/absent rather than off the resolved set
+ * being empty, so a client whose assigned profile was later removed from the registry resolves to no
+ * profiles (fail-closed) rather than silently picking up the default.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @param keys - The profile keys assigned to the client (its `dbx_provider_profiles`).
+ * @returns The client's assigned profiles, or the default profiles when none are assigned.
+ */ function oidcProviderProfilesForClient(profiles, keys) {
+    return (keys === null || keys === void 0 ? void 0 : keys.length) ? oidcProviderProfilesForKeys(profiles, keys) : defaultOidcProviderProfiles(profiles);
+}
 /**
  * Collects every scope referenced by the given profiles.
  *
@@ -12036,6 +12069,11 @@ function _class_call_check$c(instance, Constructor) {
  * obtain via a profile. Passed a client's assigned profiles, this is the set of scopes those
  * profiles unlock for that client.
  *
+ * Note a gated scope is not necessarily unavailable to an unassigned client: a scope unlocked by a
+ * default profile is gated yet reachable by every client. Use
+ * {@link assignmentOnlyScopesForOidcProviderProfiles} for the "requires an explicit assignment"
+ * subset (e.g. to exclude scopes from a general picker or from advertised scope metadata).
+ *
  * @param profiles - The profiles to collect scopes from.
  * @returns The union of every profile's scopes.
  */ function scopesForOidcProviderProfiles(profiles) {
@@ -12063,9 +12101,59 @@ function _class_call_check$c(instance, Constructor) {
     });
     return result;
 }
+/**
+ * Collects the scopes unlocked by the registry's default profiles — the scopes every client can
+ * obtain, including one with no profiles assigned.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The union of every default profile's scopes. Empty when no profile is marked default.
+ */ function defaultUnlockedScopesForOidcProviderProfiles(profiles) {
+    return scopesForOidcProviderProfiles(defaultOidcProviderProfiles(profiles));
+}
+/**
+ * Collects the gated scopes that are NOT unlocked by default — the scopes a client can only obtain
+ * via an explicit profile assignment.
+ *
+ * This is the set to exclude from a general scope picker or from advertised scope metadata (e.g. an
+ * MCP protected-resource document's `scopes_supported`). Prefer it over
+ * {@link scopesForOidcProviderProfiles} for that job: the full gated set would wrongly drop a
+ * default-unlocked scope that every client can in fact obtain. With no default declared the two are
+ * identical.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns Every profile-gated scope minus the default-unlocked ones.
+ */ function assignmentOnlyScopesForOidcProviderProfiles(profiles) {
+    var defaultUnlockedScopes = defaultUnlockedScopesForOidcProviderProfiles(profiles);
+    var result = new Set();
+    scopesForOidcProviderProfiles(profiles).forEach(function(scope) {
+        if (!defaultUnlockedScopes.has(scope)) {
+            result.add(scope);
+        }
+    });
+    return result;
+}
+/**
+ * Collects the scopes of every profile marked {@link OidcProviderProfile.adminOnly}.
+ *
+ * Unioned with `OidcProviderConfig.adminOnlyScopes` by the consent admin-only gate: a consent
+ * requesting one of these scopes is hard-rejected with `access_denied` when the resolving user is
+ * not an admin.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The union of every admin-only profile's scopes. Empty when no profile is marked admin-only.
+ */ function adminOnlyScopesForOidcProviderProfiles(profiles) {
+    return scopesForOidcProviderProfiles(profiles.filter(function(profile) {
+        return profile.adminOnly === true;
+    }));
+}
 /**
  * Builds picker entries for the given provider profiles, suitable for an admin profile-selection field.
  *
+ * A default profile's description carries {@link OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX} so
+ * an admin isn't surprised that an empty selection still grants scopes. Default profiles are
+ * deliberately not pre-selected — persisting the default as an explicit assignment would opt the
+ * client out of the fallback, so it would stop tracking the registry if the default later changed.
+ *
  * @param profiles - The provider-profile registry.
  * @returns One {@link OidcProviderProfileDetails} per profile.
  */ function oidcProviderProfileDetails(profiles) {
@@ -12073,7 +12161,10 @@ function _class_call_check$c(instance, Constructor) {
         return {
             value: profile.key,
             label: profile.label,
-            description: profile.description
+            description: profile.isDefault ? [
+                profile.description,
+                OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX
+            ].filter(Boolean).join(' ') : profile.description
         };
     });
 }
@@ -21833,6 +21924,7 @@ exports.OFFLINE_ACCESS_OIDC_SCOPE_DETAILS = OFFLINE_ACCESS_OIDC_SCOPE_DETAILS;
 exports.OIDC_ENTRY_CLIENT_TYPE = OIDC_ENTRY_CLIENT_TYPE;
 exports.OIDC_FUNCTION_TYPE_CONFIG_MAP = OIDC_FUNCTION_TYPE_CONFIG_MAP;
 exports.OIDC_MODEL_CRUD_FUNCTIONS_CONFIG = OIDC_MODEL_CRUD_FUNCTIONS_CONFIG;
+exports.OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX = OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX;
 exports.OPENID_OIDC_SCOPE = OPENID_OIDC_SCOPE;
 exports.OPENID_OIDC_SCOPE_DETAILS = OPENID_OIDC_SCOPE_DETAILS;
 exports.OidcEntryDocument = OidcEntryDocument;
@@ -21896,6 +21988,7 @@ exports.abstractSubscribeOrUnsubscribeToNotificationBoxParamsType = abstractSubs
 exports.abstractSubscribeToNotificationBoxParamsType = abstractSubscribeToNotificationBoxParamsType;
 exports.addConstraintToBuilder = addConstraintToBuilder;
 exports.addOrReplaceLimitInConstraints = addOrReplaceLimitInConstraints;
+exports.adminOnlyScopesForOidcProviderProfiles = adminOnlyScopesForOidcProviderProfiles;
 exports.allChildDocumentsUnderParent = allChildDocumentsUnderParent;
 exports.allChildDocumentsUnderParentPath = allChildDocumentsUnderParentPath;
 exports.allChildDocumentsUnderRelativePath = allChildDocumentsUnderRelativePath;
@@ -21913,6 +22006,7 @@ exports.assignDateCellScheduleFunction = assignDateCellScheduleFunction;
 exports.assignUnitedStatesAddressFunction = assignUnitedStatesAddressFunction;
 exports.assignWebsiteFileLinkFunction = assignWebsiteFileLinkFunction;
 exports.assignWebsiteLinkFunction = assignWebsiteLinkFunction;
+exports.assignmentOnlyScopesForOidcProviderProfiles = assignmentOnlyScopesForOidcProviderProfiles;
 exports.buildFirebaseCollectionTypeModelTypeMap = buildFirebaseCollectionTypeModelTypeMap;
 exports.calculateNsForNotificationUserNotificationBoxRecipientConfigs = calculateNsForNotificationUserNotificationBoxRecipientConfigs;
 exports.calculateStorageFileGroupEmbeddedFileUpdate = calculateStorageFileGroupEmbeddedFileUpdate;
@@ -21957,7 +22051,9 @@ exports.createStorageFileSignedUploadUrlParamsType = createStorageFileSignedUplo
 exports.dataFromDocumentSnapshots = dataFromDocumentSnapshots;
 exports.dataFromSnapshotStream = dataFromSnapshotStream;
 exports.decodeFirebaseAuthOobCode = decodeFirebaseAuthOobCode;
+exports.defaultOidcProviderProfiles = defaultOidcProviderProfiles;
 exports.defaultPagedItemPageDataConverter = defaultPagedItemPageDataConverter;
+exports.defaultUnlockedScopesForOidcProviderProfiles = defaultUnlockedScopesForOidcProviderProfiles;
 exports.delayCompletion = delayCompletion;
 exports.deleteAllQueuedStorageFilesParamsType = deleteAllQueuedStorageFilesParamsType;
 exports.deleteOidcClientParamsType = targetModelParamsType;
@@ -22316,6 +22412,7 @@ exports.oidcEntryIdentity = oidcEntryIdentity;
 exports.oidcGrantEntriesByUidQuery = oidcGrantEntriesByUidQuery;
 exports.oidcModelFunctionMap = oidcModelFunctionMap;
 exports.oidcProviderProfileDetails = oidcProviderProfileDetails;
+exports.oidcProviderProfilesForClient = oidcProviderProfilesForClient;
 exports.oidcProviderProfilesForKeys = oidcProviderProfilesForKeys;
 exports.oidcScopeTermSatisfied = oidcScopeTermSatisfied;
 exports.oidcScopeTermsSatisfied = oidcScopeTermsSatisfied;

package/index.esm.js

@@ -12014,6 +12014,10 @@ function _class_call_check$c(instance, Constructor) {
     return x.value;
 });
 
+/**
+ * Suffix appended to a default profile's description in {@link oidcProviderProfileDetails}, so an
+ * admin viewing the picker sees that leaving the field empty still grants that profile's scopes.
+ */ var OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX = 'Applied by default when no profiles are assigned.';
 // MARK: Utility
 /**
  * Filters the provider-profile registry to the profiles matching the given assigned keys.
@@ -12027,6 +12031,35 @@ function _class_call_check$c(instance, Constructor) {
         return keySet.has(profile.key);
     });
 }
+/**
+ * Filters the provider-profile registry to the profiles marked {@link OidcProviderProfile.isDefault}.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The registry profiles that apply to a client with no assigned profiles.
+ */ function defaultOidcProviderProfiles(profiles) {
+    return profiles.filter(function(profile) {
+        return profile.isDefault === true;
+    });
+}
+/**
+ * Resolves the profiles that apply to a client: its assigned profiles, or — when it has NO profiles
+ * assigned — the registry's default profiles.
+ *
+ * The fallback is exclusive: a client with any assigned key resolves to exactly
+ * {@link oidcProviderProfilesForKeys}, so a non-default assignment never additionally confers the
+ * default profiles' scopes. A registry declaring no default behaves identically to
+ * {@link oidcProviderProfilesForKeys}.
+ *
+ * The fallback keys off the assigned key list being empty/absent rather than off the resolved set
+ * being empty, so a client whose assigned profile was later removed from the registry resolves to no
+ * profiles (fail-closed) rather than silently picking up the default.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @param keys - The profile keys assigned to the client (its `dbx_provider_profiles`).
+ * @returns The client's assigned profiles, or the default profiles when none are assigned.
+ */ function oidcProviderProfilesForClient(profiles, keys) {
+    return (keys === null || keys === void 0 ? void 0 : keys.length) ? oidcProviderProfilesForKeys(profiles, keys) : defaultOidcProviderProfiles(profiles);
+}
 /**
  * Collects every scope referenced by the given profiles.
  *
@@ -12034,6 +12067,11 @@ function _class_call_check$c(instance, Constructor) {
  * obtain via a profile. Passed a client's assigned profiles, this is the set of scopes those
  * profiles unlock for that client.
  *
+ * Note a gated scope is not necessarily unavailable to an unassigned client: a scope unlocked by a
+ * default profile is gated yet reachable by every client. Use
+ * {@link assignmentOnlyScopesForOidcProviderProfiles} for the "requires an explicit assignment"
+ * subset (e.g. to exclude scopes from a general picker or from advertised scope metadata).
+ *
  * @param profiles - The profiles to collect scopes from.
  * @returns The union of every profile's scopes.
  */ function scopesForOidcProviderProfiles(profiles) {
@@ -12061,9 +12099,59 @@ function _class_call_check$c(instance, Constructor) {
     });
     return result;
 }
+/**
+ * Collects the scopes unlocked by the registry's default profiles — the scopes every client can
+ * obtain, including one with no profiles assigned.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The union of every default profile's scopes. Empty when no profile is marked default.
+ */ function defaultUnlockedScopesForOidcProviderProfiles(profiles) {
+    return scopesForOidcProviderProfiles(defaultOidcProviderProfiles(profiles));
+}
+/**
+ * Collects the gated scopes that are NOT unlocked by default — the scopes a client can only obtain
+ * via an explicit profile assignment.
+ *
+ * This is the set to exclude from a general scope picker or from advertised scope metadata (e.g. an
+ * MCP protected-resource document's `scopes_supported`). Prefer it over
+ * {@link scopesForOidcProviderProfiles} for that job: the full gated set would wrongly drop a
+ * default-unlocked scope that every client can in fact obtain. With no default declared the two are
+ * identical.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns Every profile-gated scope minus the default-unlocked ones.
+ */ function assignmentOnlyScopesForOidcProviderProfiles(profiles) {
+    var defaultUnlockedScopes = defaultUnlockedScopesForOidcProviderProfiles(profiles);
+    var result = new Set();
+    scopesForOidcProviderProfiles(profiles).forEach(function(scope) {
+        if (!defaultUnlockedScopes.has(scope)) {
+            result.add(scope);
+        }
+    });
+    return result;
+}
+/**
+ * Collects the scopes of every profile marked {@link OidcProviderProfile.adminOnly}.
+ *
+ * Unioned with `OidcProviderConfig.adminOnlyScopes` by the consent admin-only gate: a consent
+ * requesting one of these scopes is hard-rejected with `access_denied` when the resolving user is
+ * not an admin.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The union of every admin-only profile's scopes. Empty when no profile is marked admin-only.
+ */ function adminOnlyScopesForOidcProviderProfiles(profiles) {
+    return scopesForOidcProviderProfiles(profiles.filter(function(profile) {
+        return profile.adminOnly === true;
+    }));
+}
 /**
  * Builds picker entries for the given provider profiles, suitable for an admin profile-selection field.
  *
+ * A default profile's description carries {@link OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX} so
+ * an admin isn't surprised that an empty selection still grants scopes. Default profiles are
+ * deliberately not pre-selected — persisting the default as an explicit assignment would opt the
+ * client out of the fallback, so it would stop tracking the registry if the default later changed.
+ *
  * @param profiles - The provider-profile registry.
  * @returns One {@link OidcProviderProfileDetails} per profile.
  */ function oidcProviderProfileDetails(profiles) {
@@ -12071,7 +12159,10 @@ function _class_call_check$c(instance, Constructor) {
         return {
             value: profile.key,
             label: profile.label,
-            description: profile.description
+            description: profile.isDefault ? [
+                profile.description,
+                OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX
+            ].filter(Boolean).join(' ') : profile.description
         };
     });
 }
@@ -21669,4 +21760,4 @@ function _is_native_reflect_construct() {
     });
 }
 
-export { ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS, ALL_STORAGE_FILE_NOTIFICATION_TASK_TYPES, ALL_USER_UPLOADS_FOLDER_NAME, ALL_USER_UPLOADS_FOLDER_PATH, ALREADY_EXISTS_ERROR_CODE, AbstractFirestoreDocument, AbstractFirestoreDocumentDataAccessorWrapper, AbstractFirestoreDocumentWithParent, AppNotificationTemplateTypeInfoRecordService, BAD_DOCUMENT_QUERY_CURSOR_ERROR_CODE, BAD_REQUEST_ERROR_CODE, BASE_MODEL_STORAGE_FILE_PATH, CALL_MODEL_APP_FUNCTION_KEY, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, CALL_MODEL_OIDC_SCOPES, CALL_MODEL_OIDC_SCOPE_DETAILS, CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE, CALL_MODEL_OIDC_SCOPE_PREFIX, CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD, CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD, CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD, CONFLICT_ERROR_CODE, COPY_USER_RELATED_DATA_ACCESSOR_FACTORY_FUNCTION, CREATE_MODEL_OIDC_SCOPE, CREATE_NOTIFICATION_ID_REQUIRED_ERROR_CODE, CREATE_STORAGE_FILE_SIGNED_UPLOAD_URL_MAX_EXPIRES_IN_MS, CREATE_STORAGE_FILE_SIGNED_UPLOAD_URL_MAX_FILENAME_LENGTH, CREATE_STORAGE_FILE_SIGNED_UPLOAD_URL_MIN_EXPIRES_IN_MS, ContextGrantedModelRolesReaderInstance, DBX_FIREBASE_SERVER_NO_AUTH_ERROR_CODE, DBX_FIREBASE_SERVER_NO_UID_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_INVALID_CODE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_NO_CONFIG_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_SEND_ONCE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_THROTTLE_ERROR_CODE, DEFAULT_CREATE_STORAGE_FILE_SIGNED_UPLOAD_URL_EXPIRES_IN_MS, DEFAULT_DATE_CELL_RANGE_VALUE, DEFAULT_FIRESTORE_DATE_CELL_SCHEDULE_VALUE, DEFAULT_FIRESTORE_ITEM_PAGE_ITERATOR_ITEMS_PER_PAGE, DEFAULT_FIRESTORE_STRING_FIELD_VALUE, DEFAULT_FIRESTORE_UNITED_STATES_ADDRESS_VALUE, DEFAULT_FIRESTORE_WEBSITE_FILE_LINK_VALUE, DEFAULT_IN_MEMORY_CACHE_TTL, DEFAULT_ITERATE_FIRESTORE_DOCUMENT_SNAPSHOT_BATCHES_BATCH_SIZE, DEFAULT_MODEL_FUNCTION_FIREBASE_CRUD_FUNCTION_SPECIFIER, DEFAULT_NOTIFICATION_TASK_NOTIFICATION_MODEL_KEY, DEFAULT_NOTIFICATION_TASK_SUBTASK_CLEANUP_RETRY_ATTEMPTS, DEFAULT_NOTIFICATION_TASK_SUBTASK_CLEANUP_RETRY_DELAY, DEFAULT_NOTIFICATION_TEMPLATE_TYPE, DEFAULT_ON_CALL_QUERY_MODEL_LIMIT, DEFAULT_PAGED_ITEM_INDEX_DOCUMENT_ID, DEFAULT_PAGED_ITEM_MAX_ITEMS_PER_PAGE, DEFAULT_QUERY_CHANGE_WATCHER_DELAY, DEFAULT_SINGLE_ITEM_FIRESTORE_COLLECTION_DOCUMENT_IDENTIFIER, DEFAULT_UPLOADED_FILE_TYPE_DETERMINATION_LEVEL, DEFAULT_WEBSITE_LINK, DELETE_MODEL_OIDC_SCOPE, DOWNLOAD_MULTIPLE_STORAGE_FILES_MAX_FILES, DOWNLOAD_MULTIPLE_STORAGE_FILES_MIN_FILES, EMAIL_OIDC_SCOPE, EMAIL_OIDC_SCOPE_DETAILS, EMPTY_STORAGE_FILE_PURPOSE_SUBGROUP, EXACT_UPLOADED_FILE_TYPE_DETERMINATION_LEVEL, FIREBASE_AUTH_CREDENTIAL_ALREADY_IN_USE_ERROR, FIREBASE_AUTH_EMAIL_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_EMAIL_ALREADY_IN_USE_ERROR, FIREBASE_AUTH_INVALID_PHONE_NUMBER_ERROR, FIREBASE_AUTH_NETWORK_REQUEST_ERROR, FIREBASE_AUTH_NETWORK_REQUEST_FAILED, FIREBASE_AUTH_OOB_CODE_DATA_PAIR_DELIMITER, FIREBASE_AUTH_PASSWORD_MAX_LENGTH, FIREBASE_AUTH_PASSWORD_MIN_LENGTH, FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_PROVIDER_ALREADY_LINKED_ERROR, FIREBASE_AUTH_QUOTA_EXCEEDED_ERROR, FIREBASE_AUTH_USER_NOT_FOUND_ERROR, FIREBASE_AUTH_WRONG_PASSWORD, FIREBASE_DEVELOPMENT_FUNCTIONS_MAP_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FIRESTORE_COLLECTION_NAME_SEPARATOR, FIRESTORE_DUMMY_MODEL_KEY, FIRESTORE_EMPTY_VALUE, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, FIRESTORE_ITEM_PAGE_ITERATOR, FIRESTORE_ITEM_PAGE_ITERATOR_DELEGATE, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, FIRESTORE_MAX_WHERE_IN_FILTER_ARGS_COUNT, FIRESTORE_MODEL_ID_REGEX, FIRESTORE_MODEL_KEY_REGEX, FIRESTORE_MODEL_KEY_REGEX_STRICT, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, FIRESTORE_PASSTHROUGH_FIELD, FIRESTORE_PERMISSION_DENIED_ERROR_CODE, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, FORBIDDEN_ERROR_CODE, FirebaseDevelopmentFunctions, FirebaseModelPermissionServiceInstance, FirebaseServerError, FirestoreAccessorStreamMode, FirestoreDocumentContextType, HIGH_UPLOADED_FILE_TYPE_DETERMINATION_LEVEL, INTERNAL_SERVER_ERROR_CODE, INVOKE_MODEL_OIDC_SCOPE, LOW_UPLOADED_FILE_TYPE_DETERMINATION_LEVEL, MAX_FIRESTORE_MAP_ZOOM_LEVEL_VALUE, MAX_ON_CALL_QUERY_MODEL_LIMIT, MIN_FIRESTORE_MAP_ZOOM_LEVEL_VALUE, MODEL_FUNCTION_FIREBASE_CRUD_FUNCTION_SPECIFIER_SPLITTER, MODEL_NOT_AVAILABLE_ERROR_CODE, MODEL_STORAGE_FILE_SLASH_PATH_FACTORY, ModifyBeforeSetFirestoreDocumentDataAccessorWrapper, NOTIFICATION_BOX_DOES_NOT_EXIST_ERROR_CODE, NOTIFICATION_BOX_EXCLUSION_TARGET_INVALID_ERROR_CODE, NOTIFICATION_BOX_EXISTS_FOR_MODEL_ERROR_CODE, NOTIFICATION_BOX_MODEL_CRUD_FUNCTIONS_CONFIG, NOTIFICATION_BOX_RECIPIENT_DOES_NOT_EXIST_ERROR_CODE, NOTIFICATION_FUNCTION_TYPE_CONFIG_MAP, NOTIFICATION_LOGGED_EVENT_DAY_ITEM_CONVERTER, NOTIFICATION_MESSAGE_MAX_LENGTH, NOTIFICATION_MESSAGE_MIN_LENGTH, NOTIFICATION_MODEL_ALREADY_INITIALIZED_ERROR_CODE, NOTIFICATION_RECIPIENT_NAME_MAX_LENGTH, NOTIFICATION_RECIPIENT_NAME_MIN_LENGTH, NOTIFICATION_SUBJECT_MAX_LENGTH, NOTIFICATION_SUBJECT_MIN_LENGTH, NOTIFICATION_SUMMARY_EMBEDDED_NOTIFICATION_ITEM_MESSAGE_MAX_LENGTH, NOTIFICATION_SUMMARY_EMBEDDED_NOTIFICATION_ITEM_SUBJECT_MAX_LENGTH, NOTIFICATION_SUMMARY_ITEM_LIMIT, NOTIFICATION_TASK_SUBTASK_CHECKPOINT_CLEANUP, NOTIFICATION_TASK_SUBTASK_CHECKPOINT_PROCESSING, NOTIFICATION_USER_BLOCKED_FROM_BEING_ADD_TO_RECIPIENTS_ERROR_CODE, NOTIFICATION_USER_INVALID_UID_FOR_CREATE_ERROR_CODE, NOTIFICATION_USER_LOCKED_CONFIG_FROM_BEING_UPDATED_ERROR_CODE, NOTIFICATION_WEEK_NOTIFICATION_ITEM_LIMIT, NOT_FOUND_ERROR_CODE, NotificationBoxDocument, NotificationBoxRecipientFlag, NotificationBoxRecipientTemplateConfigBoolean, NotificationDocument, NotificationFirestoreCollections, NotificationFunctions, NotificationLoggedEventDayDocument, NotificationLoggedEventDayPageDocument, NotificationMessageFlag, NotificationRecipientSendFlag, NotificationSendState, NotificationSendType, NotificationSummaryDocument, NotificationUserDocument, NotificationWeekDocument, OFFLINE_ACCESS_OIDC_SCOPE, OFFLINE_ACCESS_OIDC_SCOPE_DETAILS, OIDC_ENTRY_CLIENT_TYPE, OIDC_FUNCTION_TYPE_CONFIG_MAP, OIDC_MODEL_CRUD_FUNCTIONS_CONFIG, OPENID_OIDC_SCOPE, OPENID_OIDC_SCOPE_DETAILS, OidcEntryDocument, OidcModelFirestoreCollections, OidcModelFunctions, PERMISSION_DENIED_ERROR_CODE, PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD, PROFILE_OIDC_SCOPE, PROFILE_OIDC_SCOPE_DETAILS, PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD, QUERY_MODEL_OIDC_SCOPE, READ_MODEL_OIDC_SCOPE, RUN_DEV_FUNCTION_APP_FUNCTION_KEY, SCHEDULED_FUNCTION_DEV_FUNCTION_SPECIFIER, SERVICE_TOKEN_OIDC_SCOPE, SERVICE_TOKEN_OIDC_SCOPE_DETAILS, STANDARD_OIDC_SCOPES, STANDARD_OIDC_SCOPE_DETAILS, STORAGEFILE_RELATED_FILE_METADATA_KEY, STORAGE_FILE_ALREADY_PROCESSED_ERROR_CODE, STORAGE_FILE_CANNOT_BE_DELETED_YET_ERROR_CODE, STORAGE_FILE_FUNCTION_TYPE_CONFIG_MAP, STORAGE_FILE_GROUP_CREATE_INPUT_ERROR_CODE, STORAGE_FILE_GROUP_QUEUED_FOR_INITIALIZATION_ERROR_CODE, STORAGE_FILE_GROUP_ROOT_FOLDER_PATH, STORAGE_FILE_GROUP_ZIP_FILE_PATH, STORAGE_FILE_GROUP_ZIP_INFO_JSON_FILE_NAME, STORAGE_FILE_GROUP_ZIP_STORAGE_FILE_PURPOSE, STORAGE_FILE_GROUP_ZIP_STORAGE_FILE_PURPOSE_CREATE_ZIP_SUBTASK, STORAGE_FILE_MODEL_ALREADY_INITIALIZED_ERROR_CODE, STORAGE_FILE_MODEL_CRUD_FUNCTIONS_CONFIG, STORAGE_FILE_NOT_FLAGGED_FOR_DELETION_ERROR_CODE, STORAGE_FILE_NOT_FLAGGED_FOR_GROUPS_SYNC_ERROR_CODE, STORAGE_FILE_PROCESSING_NOTIFICATION_TASK_TYPE, STORAGE_FILE_PROCESSING_NOT_ALLOWED_FOR_INVALID_STATE_ERROR_CODE, STORAGE_FILE_PROCESSING_NOT_AVAILABLE_FOR_TYPE_ERROR_CODE, STORAGE_FILE_PROCESSING_NOT_QUEUED_FOR_PROCESSING_ERROR_CODE, STORAGE_FILE_PROCESSING_STUCK_THROTTLE_CHECK_MS, STORAGE_FILE_UPLOAD_USER_ROLE, STORAGE_FILE_UPLOAD_USER_SIMPLE_CLAIMS_CONFIGURATION, ScheduledFunctionDevelopmentFirebaseFunctionListEntry, ScheduledFunctionDevelopmentFunctionTypeEnum, StorageFileCreationType, StorageFileDocument, StorageFileFirestoreCollections, StorageFileFunctions, StorageFileGroupDocument, StorageFileProcessingState, StorageFileState, StorageFileUploadStreamUnsupportedError, SystemStateDocument, SystemStateFirestoreCollections, UNAUTHENTICATED_ERROR_CODE, UNAVAILABLE_ERROR_CODE, UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE, UNKNOWN_MODEL_TYPE_ERROR_CODE, UPDATE_MODEL_OIDC_SCOPE, UPLOADED_FILE_DOES_NOT_EXIST_ERROR_CODE, UPLOADED_FILE_INITIALIZATION_DISCARDED_ERROR_CODE, UPLOADED_FILE_INITIALIZATION_FAILED_ERROR_CODE, UPLOADED_FILE_NOT_ALLOWED_TO_BE_INITIALIZED_ERROR_CODE, UPLOADS_FOLDER_PATH, _createNotificationDocumentFromPair, abstractSubscribeOrUnsubscribeToNotificationBoxParamsType, abstractSubscribeToNotificationBoxParamsType, addConstraintToBuilder, addOrReplaceLimitInConstraints, allChildDocumentsUnderParent, allChildDocumentsUnderParentPath, allChildDocumentsUnderRelativePath, allowDocumentSnapshotWithPathOnceFilter, allowedNotificationRecipients, appNotificationTemplateTypeInfoRecordService, applyExclusionsToNotificationUserNotificationBoxRecipientConfigs, arrayUpdateWithAccessorFunction, asTopLevelFieldPath, asTopLevelFieldPaths, assertFirestoreUpdateHasData, assertStorageUploadOptionsStringFormat, assignDateCellRangeFunction, assignDateCellScheduleFunction, assignUnitedStatesAddressFunction, assignWebsiteFileLinkFunction, assignWebsiteLinkFunction, buildFirebaseCollectionTypeModelTypeMap, calculateNsForNotificationUserNotificationBoxRecipientConfigs, calculateStorageFileGroupEmbeddedFileUpdate, calculateStorageFileGroupRegeneration, callModelFirebaseFunctionMapFactory, callModelOidcScopeForCallType, canQueueStorageFileForProcessing, childFirestoreModelKey, childFirestoreModelKeyPath, childFirestoreModelKeys, cleanupOldNotificationLoggedEventDaysParamsType, cleanupSentNotificationsParamsType, clientFirebaseFirestoreContextFactory, clientFirebaseStorageContextFactory, combineUploadFileTypeDeterminers, completeSubtaskProcessingAndScheduleCleanupTaskResult, contextGrantedModelRolesReader, contextGrantedModelRolesReaderDoesNotExistErrorMessage, contextGrantedModelRolesReaderPermissionErrorMessage, convertHttpsCallableErrorToReadableError, copyDocumentIdForUserRelatedModifierFunction, copyDocumentIdToFieldModifierFunction, copyStoragePath, copyUserRelatedDataAccessorFactoryFunction, copyUserRelatedDataModifierConfig, createNotificationBoxParamsType, createNotificationDocument, createNotificationDocumentIfSending, createNotificationDocumentPair, createNotificationLoggedEventTemplate, createNotificationSummaryParamsType, createNotificationTaskTemplate, createNotificationTemplate, createNotificationUserParamsType, createOidcClientFieldParamsType, createOidcClientParamsType, createStorageFileDocumentPair, createStorageFileDocumentPairFactory, createStorageFileGroupParamsType, createStorageFileParamsType, createStorageFileSignedUploadUrlParamsType, dataFromDocumentSnapshots, dataFromSnapshotStream, decodeFirebaseAuthOobCode, defaultPagedItemPageDataConverter, delayCompletion, deleteAllQueuedStorageFilesParamsType, targetModelParamsType as deleteOidcClientParamsType, targetModelParamsType as deleteOidcTokenParamsType, deleteStorageFileParamsType, determineByFileName, determineByFilePath, determineByFolderName, determineUserByFolder, determineUserByFolderWrapperFunction, determineUserByUserUploadsFolderWrapperFunction, developmentFirebaseFunctionMapFactory, directDataHttpsCallable, documentData, documentDataFunction, documentDataWithIdAndKey, documentReferenceFromDocument, documentReferencesFromDocuments, documentReferencesFromSnapshot, downloadMultipleStorageFilesFileParamsType, downloadMultipleStorageFilesParamsType, downloadStorageFileParamsType, effectiveNotificationBoxRecipientConfig, effectiveNotificationBoxRecipientTemplateConfig, encodeFirebaseAuthOobCode, endAt, endAtValue, endBefore, extendFirestoreCollectionWithPagedItemAccessor, extendFirestoreCollectionWithSingleDocumentAccessor, filterConstraintsOfType, filterDisallowedFirestoreItemPageIteratorInputConstraints, filterRepeatCheckpointSnapshots, filterWithDateRange, firebaseAuthErrorToReadableError, firebaseFirestoreClientDrivers, firebaseFirestoreQueryConstraintFunctionsDriver, firebaseFirestoreQueryDriver, firebaseFunctionMapFactory, firebaseModelLoader, firebaseModelPermissionService, firebaseModelService, firebaseModelServiceFactory, firebaseModelsService, firebaseQueryItemAccumulator, firebaseQuerySnapshotAccumulator, firebaseStorageBucketFolderPath, firebaseStorageClientAccessorDriver, firebaseStorageClientAccessorFile, firebaseStorageClientAccessorFolder, firebaseStorageClientDrivers, firebaseStorageClientListFilesResultFactory, firebaseStorageContextFactory, firebaseStorageFileExists, firebaseStorageFilePathFromStorageFilePath, firebaseStorageRefForStorageFilePath, firestoreArray, firestoreArrayMap, firestoreBitwiseObjectMap, firestoreBitwiseSet, firestoreBitwiseSetMap, firestoreBoolean, firestoreClientAccessorDriver, firestoreClientArrayUpdateToUpdateData, firestoreClientIncrementUpdateToUpdateData, firestoreCollectionDocumentCache, firestoreCollectionQueryFactory, firestoreContextFactory, firestoreDate, firestoreDateCellRange, firestoreDateCellRangeArray, firestoreDateCellRangeAssignFn, firestoreDateCellSchedule, firestoreDateCellScheduleAssignFn, firestoreDateNumber, firestoreDencoderArray, firestoreDencoderMap, firestoreDencoderStringArray, firestoreDocumentAccessorContextExtension, firestoreDocumentAccessorFactory, firestoreDocumentLoader, firestoreDocumentSnapshotPairsLoader, firestoreDocumentSnapshotPairsLoaderInstance, firestoreDummyKey, firestoreEncodedArray, firestoreEncodedObjectMap, firestoreEnum, firestoreEnumArray, firestoreField, firestoreFieldConfigToModelMapFunctionsRef, firestoreFixedItemPageIteration, firestoreFixedItemPageIterationFactory, firestoreIdBatchVerifierFactory, firestoreIdentityTypeArray, firestoreIdentityTypeArrayName, firestoreItemPageIteration, firestoreItemPageIterationFactory, firestoreLatLngString, firestoreMap, firestoreMapZoomLevel, firestoreModelId, firestoreModelIdArrayField, firestoreModelIdFromDocument, firestoreModelIdFromEmail, firestoreModelIdGrantedRoleArrayMap, firestoreModelIdGrantedRoleMap, firestoreModelIdOrKeyType, firestoreModelIdString, firestoreModelIdType, firestoreModelIdentity, firestoreModelIdentityTypeMap, firestoreModelIdsFromDocuments, firestoreModelIdsFromKey, firestoreModelKey, firestoreModelKeyArrayField, firestoreModelKeyCollectionName, firestoreModelKeyCollectionType, firestoreModelKeyCollectionTypeArray, firestoreModelKeyCollectionTypeArrayName, firestoreModelKeyCollectionTypePair, firestoreModelKeyEncodedGrantedRoleMap, firestoreModelKeyFactory, firestoreModelKeyFromDocument, firestoreModelKeyGrantedRoleArrayMap, firestoreModelKeyGrantedRoleMap, firestoreModelKeyPairObject, firestoreModelKeyParentKey, firestoreModelKeyParentKeyPartPairs, firestoreModelKeyPart, firestoreModelKeyPartPairs, firestoreModelKeyPartPairsKeyPath, firestoreModelKeyPartPairsPaths, firestoreModelKeyPath, firestoreModelKeyString, firestoreModelKeyType, firestoreModelKeyTypePair, firestoreModelKeys, firestoreModelKeysFromDocuments, firestoreModelType, firestoreNotificationBoxRecipient, firestoreNotificationBoxRecipientTemplateConfigRecord, firestoreNotificationItem, firestoreNotificationRecipientWithConfig, firestoreNotificationUserDefaultNotificationBoxRecipientConfig, firestoreNotificationUserNotificationBoxRecipientConfig, firestoreNumber, firestoreObjectArray, firestorePassThroughField, firestoreQueryConstraint, firestoreQueryConstraintFactory, firestoreQueryDocumentSnapshotPairsLoader, firestoreQueryFactory, firestoreSingleDocumentAccessor, firestoreString, firestoreSubObject, firestoreTimezoneString, firestoreUID, firestoreUniqueArray, firestoreUniqueKeyedArray, firestoreUniqueNumberArray, firestoreUniqueStringArray, firestoreUnitedStatesAddress, firestoreUnitedStatesAddressAssignFn, firestoreUnixDateTimeSecondsNumber, firestoreUpdateWithNoDataError, firestoreWebsiteFileLink, firestoreWebsiteFileLinkAssignFn, firestoreWebsiteFileLinkEncodedArray, firestoreWebsiteFileLinkObjectArray, firestoreWebsiteLink, firestoreWebsiteLinkArray, firestoreWebsiteLinkAssignFn, flatFirestoreModelKey, getDataFromDocumentSnapshots, getDocumentSnapshotData, getDocumentSnapshotDataPair, getDocumentSnapshotDataPairs, getDocumentSnapshotDataPairsWithData, getDocumentSnapshotDataTuples, getDocumentSnapshotPair, getDocumentSnapshotPairs, getDocumentSnapshots, getDocumentSnapshotsData, grantFullAccessIfAdmin, grantFullAccessIfAuthUserRelated, grantModelRolesIfAdmin, grantModelRolesIfAdminFunction, grantModelRolesIfAuthUserRelatedModelFunction, grantModelRolesIfFunction, grantModelRolesIfHasAuthRolesFactory, grantModelRolesIfHasAuthRolesFunction, grantModelRolesOnlyIfFunction, grantStorageFileRolesForUserAuthFunction, inContextFirebaseModelServiceFactory, inContextFirebaseModelsServiceFactory, inMemoryFirestoreCollectionCacheDelegate, inMemoryFirestoreContextCache, inMemoryFirestoreContextCacheFactory, incrementUpdateWithAccessorFunction, inferKeyFromTwoWayFlatFirestoreModelKey, inferNotificationBoxRelatedModelKey, inferStorageFileGroupRelatedModelKey, inferredTargetModelIdParamsType, inferredTargetModelParamsType, initializeAllApplicableNotificationBoxesParamsType, initializeAllApplicableNotificationSummariesParamsType, initializeAllApplicableStorageFileGroupsParamsType, initializeAllStorageFilesFromUploadsParamsType, initializeNotificationModelParamsType, initializeStorageFileFromUploadParamsType, initializeStorageFileModelParamsType, interceptAccessorFactoryFunction, isAdminInFirebaseModelContext, isClientFirebaseError, isCompleteNotificationSendState, isFirebaseStorageObjectNotFoundError, isFirestoreModelId, isFirestoreModelIdOrKey, isFirestoreModelKey, isLoggedEventNotification, isOwnerOfUserRelatedModelInFirebaseModelContext, iterateFirestoreDocumentSnapshotBatches, iterateFirestoreDocumentSnapshotCheckpoints, iterateFirestoreDocumentSnapshotPairBatches, iterateFirestoreDocumentSnapshotPairs, iterateFirestoreDocumentSnapshots, iterateStorageListFiles, iterateStorageListFilesByEachFile, iterateStorageListFilesFactory, iterationQueryDocChangeWatcher, iterationQueryDocChangeWatcherChangeTypeForGroup, latestDataFromDocuments, latestSnapshotsFromDocuments, lazyFirebaseFunctionsFactory, limit, limitToLast, limitUploadFileTypeDeterminer, limitedFirestoreDocumentAccessorFactory, limitedFirestoreDocumentAccessorSnapshotCache, loadAllFirestoreDocumentSnapshot, loadAllFirestoreDocumentSnapshotPairs, loadDocumentsForDocumentReferences, loadDocumentsForDocumentReferencesFromValues, loadDocumentsForIds, loadDocumentsForIdsFromValues, loadDocumentsForKeys, loadDocumentsForKeysFromValues, loadDocumentsForSnapshots, loadDocumentsForValues, loadNotificationBoxDocumentForReferencePair, loadStorageFileGroupDocumentForReferencePair, makeDocuments, makeFirestoreCollection, makeFirestoreCollectionGroup, makeFirestoreCollectionWithParent, makeFirestoreContextCache, makeFirestoreItemPageIteratorDelegate, makeFirestoreQueryConstraintFunctionsDriver, makePagedItemFirestoreCollection, makeRootSingleItemFirestoreCollection, makeSingleItemFirestoreCollection, mapDataFromSnapshot, mapHttpsCallable, mapLatestSnapshotsFromDocuments, mergeNotificationBoxRecipientTemplateConfigRecords, mergeNotificationBoxRecipientTemplateConfigs, mergeNotificationBoxRecipients, mergeNotificationSendMessagesResult, mergeNotificationUserDefaultNotificationBoxRecipientConfig, mergeNotificationUserNotificationBoxRecipientConfigs, modelStorageSlashPathFactory, modifyBeforeSetInterceptAccessorFactoryFunction, newDocuments, newNotificationBoxRecipientForUid, noContentNotificationMessageFunctionFactory, noStringFormatInStorageUploadOptionsError, noopFirestoreCollectionCache, noopFirestoreCollectionCacheDelegate, noopFirestoreCollectionDocumentCache, noopFirestoreContextCache, notificationBoxCollectionReference, notificationBoxConverter, notificationBoxFirestoreCollection, notificationBoxIdForModel, notificationBoxIdentity, notificationBoxRecipientTemplateConfigArrayEntryParamType, notificationBoxRecipientTemplateConfigArrayToRecord, notificationBoxRecipientTemplateConfigRecordToArray, notificationBoxesFlaggedForNeedsInitializationQuery, notificationBoxesFlaggedInvalidQuery, notificationCollectionReference, notificationCollectionReferenceFactory, notificationConverter, notificationFirestoreCollectionFactory, notificationFirestoreCollectionGroup, notificationFunctionMap, notificationIdentity, notificationLoggedEventDayCollectionReference, notificationLoggedEventDayCollectionReferenceFactory, notificationLoggedEventDayConverter, notificationLoggedEventDayFirestoreCollectionFactory, notificationLoggedEventDayFirestoreCollectionGroup, notificationLoggedEventDayId, notificationLoggedEventDayIdentity, notificationLoggedEventDayPageCollectionReference, notificationLoggedEventDayPageFirestoreCollectionGroup, notificationLoggedEventDayPageIdentity, notificationLoggedEventDayPagedItemsCollectionFactory, notificationLoggedEventDayPagedItemsCollectionReferenceFactory, notificationLoggedEventDaysOlderThanQuery, notificationLoggedEventLoader, notificationMessageFunction, notificationRecipientParamsType, notificationSendExclusionCanSendFunction, notificationSendFlagsImplyIsComplete, notificationSubtaskComplete, notificationSummariesFlaggedForNeedsInitializationQuery, notificationSummaryCollectionReference, notificationSummaryConverter, notificationSummaryFirestoreCollection, notificationSummaryIdForModel, notificationSummaryIdForUidFunctionForRootFirestoreModelIdentity, notificationSummaryIdentity, notificationTaskCanRunNextCheckpoint, notificationTaskComplete, notificationTaskDelayRetry, notificationTaskFailed, notificationTaskPartiallyComplete, notificationTaskUniqueId, notificationTemplateTypeInfoRecord, notificationUserCollectionReference, notificationUserConverter, notificationUserFirestoreCollection, notificationUserHasExclusionQuery, notificationUserIdentity, notificationUsersFlaggedForNeedsSyncQuery, notificationWeekCollectionReference, notificationWeekCollectionReferenceFactory, notificationWeekConverter, notificationWeekFirestoreCollectionFactory, notificationWeekFirestoreCollectionGroup, notificationWeekIdentity, notificationsPastSendAtTimeQuery, notificationsReadyForCleanupQuery, offset, oidcClientEntriesByOwnerQuery, oidcEntriesByClientIdQuery, oidcEntriesByGrantIdQuery, oidcEntriesByUidQuery, oidcEntriesByUserCodeQuery, oidcEntriesWithTypeQuery, oidcEntryCollectionReference, oidcEntryConverter, oidcEntryFirestoreCollection, oidcEntryIdentity, oidcGrantEntriesByUidQuery, oidcModelFunctionMap, oidcProviderProfileDetails, oidcProviderProfilesForKeys, oidcScopeTermSatisfied, oidcScopeTermsSatisfied, oidcScopesFromScopeClaim, onCallCreateModelParams, onCallCreateModelResult, onCallCreateModelResultWithDocs, onCallDeleteModelParams, onCallDevelopmentParams, onCallInvokeModelParams, onCallQueryModelParams, onCallReadModelParams, onCallTypedModelParams, onCallTypedModelParamsFunction, onCallUpdateModelParams, optionalFirestoreArray, optionalFirestoreBoolean, optionalFirestoreDate, optionalFirestoreDateNumber, optionalFirestoreEnum, optionalFirestoreField, optionalFirestoreNumber, optionalFirestoreString, optionalFirestoreUID, optionalFirestoreUnitedStatesAddress, optionalFirestoreUnixDateTimeSecondsNumber, orderBy, orderByDocumentId, processAllQueuedStorageFilesParamsType, processStorageFileParamsType, readFirestoreModelKey, readFirestoreModelKeyFromDocumentSnapshot, readLoggingFirestoreContextCache, readLoggingFirestoreContextCacheFactory, readMultipleStorageFilesMetadataFileParamsType, readMultipleStorageFilesMetadataParamsType, readStorageFileMetadataParamsType, regenerateAllFlaggedStorageFileGroupsContentParamsType, regenerateStorageFileGroupContentParamsType, replaceConstraints, requiredScopesForOidcProviderProfiles, resolveEffectiveOidcScopeTerms, resolveOidcModelScopeRequirement, resyncAllNotificationUserParamsType, targetModelParamsType as resyncNotificationUserParamsType, targetModelParamsType as rotateOidcClientSecretParamsType, scheduledFunctionDevelopmentFirebaseFunctionParamsType, scopesForOidcProviderProfiles, selectFromFirebaseModelsService, sendNotificationParamsType, sendQueuedNotificationsParamsType, separateConstraints, setIdAndKeyFromKeyIdRefOnDocumentData, setIdAndKeyFromSnapshotOnDocumentData, shouldSaveNotificationToNotificationWeek, shouldSendCreatedNotificationInput, snapshotConverterFunctions, snapshotStreamDataForAccessor, snapshotStreamForAccessor, sortNotificationItemsFunction, startAfter, startAt, startAtValue, storageFileCollectionReference, storageFileConverter, storageFileFirestoreCollection, storageFileFlaggedForSyncWithGroupsQuery, storageFileFunctionMap, storageFileGroupCollectionReference, storageFileGroupConverter, storageFileGroupCreateStorageFileKeyFactory, storageFileGroupCreatedStorageFileKey, storageFileGroupEmbeddedFile, storageFileGroupFirestoreCollection, storageFileGroupFolderPath, storageFileGroupIdForModel, storageFileGroupIdentity, storageFileGroupZipFileStoragePath, storageFileGroupZipStorageFileKey, storageFileGroupsFlaggedForContentRegenerationQuery, storageFileGroupsFlaggedForNeedsInitializationQuery, storageFileGroupsFlaggedInvalidQuery, storageFileIdentity, storageFileProcessingNotificationTaskTemplate, storageFilePurposeAndUserQuery, storageFilesQueuedForDeleteQuery, storageFilesQueuedForProcessingQuery, storageListFilesResultFactory, storageListFilesResultHasNoNextError, storagePathFactory, storedFileReaderFactory, streamDocumentSnapshotDataPairs, streamDocumentSnapshotDataPairsWithData, streamDocumentSnapshotsData, streamFromOnSnapshot, syncAllFlaggedStorageFilesWithGroupsParamsType, syncStorageFileWithGroupsParamsType, systemStateCollectionReference, systemStateConverter, systemStateFirestoreCollection, systemStateIdentity, targetModelIdParamsType, targetModelParamsType, twoWayFlatFirestoreModelKey, unreadNotificationItems, unsupportedFirestoreDriverFunctionError, targetModelParamsType as updateNotificationBoxParamsType, updateNotificationBoxRecipientLikeParamsType, updateNotificationBoxRecipientParamsType, updateNotificationBoxRecipientTemplateConfigRecord, updateNotificationRecipient, updateNotificationSummaryParamsType, updateNotificationUserDefaultNotificationBoxRecipientConfig, updateNotificationUserDefaultNotificationBoxRecipientConfigParamsType, updateNotificationUserNotificationBoxRecipientConfigIfChanged, updateNotificationUserNotificationBoxRecipientConfigs, updateNotificationUserNotificationBoxRecipientParamsType, updateNotificationUserNotificationSendExclusions, updateNotificationUserParamsType, updateOidcClientFieldParamsType, updateOidcClientParamsType, updateStorageFileGroupEntryParamsType, updateStorageFileGroupParamsType, updateStorageFileParamsType, updateWithAccessorUpdateAndConverterFunction, uploadFileWithStream, useContextAuth, useContextAuthUid, useDocumentSnapshot, useDocumentSnapshotData, useFirebaseModelsService, userUploadsFolderSlashPathFactory, userUploadsFolderStoragePathFactory, where, whereDateIsAfter, whereDateIsAfterWithSort, whereDateIsBefore, whereDateIsBeforeWithSort, whereDateIsBetween, whereDateIsInRange, whereDateIsOnOrAfter, whereDateIsOnOrAfterWithSort, whereDateIsOnOrBefore, whereDateIsOnOrBeforeWithSort, whereDocumentId, whereStringHasRootIdentityModelKey, whereStringValueHasPrefix };
+export { ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS, ALL_STORAGE_FILE_NOTIFICATION_TASK_TYPES, ALL_USER_UPLOADS_FOLDER_NAME, ALL_USER_UPLOADS_FOLDER_PATH, ALREADY_EXISTS_ERROR_CODE, AbstractFirestoreDocument, AbstractFirestoreDocumentDataAccessorWrapper, AbstractFirestoreDocumentWithParent, AppNotificationTemplateTypeInfoRecordService, BAD_DOCUMENT_QUERY_CURSOR_ERROR_CODE, BAD_REQUEST_ERROR_CODE, BASE_MODEL_STORAGE_FILE_PATH, CALL_MODEL_APP_FUNCTION_KEY, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, CALL_MODEL_OIDC_SCOPES, CALL_MODEL_OIDC_SCOPE_DETAILS, CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE, CALL_MODEL_OIDC_SCOPE_PREFIX, CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD, CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD, CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD, CONFLICT_ERROR_CODE, COPY_USER_RELATED_DATA_ACCESSOR_FACTORY_FUNCTION, CREATE_MODEL_OIDC_SCOPE, CREATE_NOTIFICATION_ID_REQUIRED_ERROR_CODE, CREATE_STORAGE_FILE_SIGNED_UPLOAD_URL_MAX_EXPIRES_IN_MS, CREATE_STORAGE_FILE_SIGNED_UPLOAD_URL_MAX_FILENAME_LENGTH, CREATE_STORAGE_FILE_SIGNED_UPLOAD_URL_MIN_EXPIRES_IN_MS, ContextGrantedModelRolesReaderInstance, DBX_FIREBASE_SERVER_NO_AUTH_ERROR_CODE, DBX_FIREBASE_SERVER_NO_UID_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_INVALID_CODE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_NO_CONFIG_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_SEND_ONCE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_THROTTLE_ERROR_CODE, DEFAULT_CREATE_STORAGE_FILE_SIGNED_UPLOAD_URL_EXPIRES_IN_MS, DEFAULT_DATE_CELL_RANGE_VALUE, DEFAULT_FIRESTORE_DATE_CELL_SCHEDULE_VALUE, DEFAULT_FIRESTORE_ITEM_PAGE_ITERATOR_ITEMS_PER_PAGE, DEFAULT_FIRESTORE_STRING_FIELD_VALUE, DEFAULT_FIRESTORE_UNITED_STATES_ADDRESS_VALUE, DEFAULT_FIRESTORE_WEBSITE_FILE_LINK_VALUE, DEFAULT_IN_MEMORY_CACHE_TTL, DEFAULT_ITERATE_FIRESTORE_DOCUMENT_SNAPSHOT_BATCHES_BATCH_SIZE, DEFAULT_MODEL_FUNCTION_FIREBASE_CRUD_FUNCTION_SPECIFIER, DEFAULT_NOTIFICATION_TASK_NOTIFICATION_MODEL_KEY, DEFAULT_NOTIFICATION_TASK_SUBTASK_CLEANUP_RETRY_ATTEMPTS, DEFAULT_NOTIFICATION_TASK_SUBTASK_CLEANUP_RETRY_DELAY, DEFAULT_NOTIFICATION_TEMPLATE_TYPE, DEFAULT_ON_CALL_QUERY_MODEL_LIMIT, DEFAULT_PAGED_ITEM_INDEX_DOCUMENT_ID, DEFAULT_PAGED_ITEM_MAX_ITEMS_PER_PAGE, DEFAULT_QUERY_CHANGE_WATCHER_DELAY, DEFAULT_SINGLE_ITEM_FIRESTORE_COLLECTION_DOCUMENT_IDENTIFIER, DEFAULT_UPLOADED_FILE_TYPE_DETERMINATION_LEVEL, DEFAULT_WEBSITE_LINK, DELETE_MODEL_OIDC_SCOPE, DOWNLOAD_MULTIPLE_STORAGE_FILES_MAX_FILES, DOWNLOAD_MULTIPLE_STORAGE_FILES_MIN_FILES, EMAIL_OIDC_SCOPE, EMAIL_OIDC_SCOPE_DETAILS, EMPTY_STORAGE_FILE_PURPOSE_SUBGROUP, EXACT_UPLOADED_FILE_TYPE_DETERMINATION_LEVEL, FIREBASE_AUTH_CREDENTIAL_ALREADY_IN_USE_ERROR, FIREBASE_AUTH_EMAIL_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_EMAIL_ALREADY_IN_USE_ERROR, FIREBASE_AUTH_INVALID_PHONE_NUMBER_ERROR, FIREBASE_AUTH_NETWORK_REQUEST_ERROR, FIREBASE_AUTH_NETWORK_REQUEST_FAILED, FIREBASE_AUTH_OOB_CODE_DATA_PAIR_DELIMITER, FIREBASE_AUTH_PASSWORD_MAX_LENGTH, FIREBASE_AUTH_PASSWORD_MIN_LENGTH, FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_PROVIDER_ALREADY_LINKED_ERROR, FIREBASE_AUTH_QUOTA_EXCEEDED_ERROR, FIREBASE_AUTH_USER_NOT_FOUND_ERROR, FIREBASE_AUTH_WRONG_PASSWORD, FIREBASE_DEVELOPMENT_FUNCTIONS_MAP_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FIRESTORE_COLLECTION_NAME_SEPARATOR, FIRESTORE_DUMMY_MODEL_KEY, FIRESTORE_EMPTY_VALUE, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, FIRESTORE_ITEM_PAGE_ITERATOR, FIRESTORE_ITEM_PAGE_ITERATOR_DELEGATE, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, FIRESTORE_MAX_WHERE_IN_FILTER_ARGS_COUNT, FIRESTORE_MODEL_ID_REGEX, FIRESTORE_MODEL_KEY_REGEX, FIRESTORE_MODEL_KEY_REGEX_STRICT, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, FIRESTORE_PASSTHROUGH_FIELD, FIRESTORE_PERMISSION_DENIED_ERROR_CODE, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, FORBIDDEN_ERROR_CODE, FirebaseDevelopmentFunctions, FirebaseModelPermissionServiceInstance, FirebaseServerError, FirestoreAccessorStreamMode, FirestoreDocumentContextType, HIGH_UPLOADED_FILE_TYPE_DETERMINATION_LEVEL, INTERNAL_SERVER_ERROR_CODE, INVOKE_MODEL_OIDC_SCOPE, LOW_UPLOADED_FILE_TYPE_DETERMINATION_LEVEL, MAX_FIRESTORE_MAP_ZOOM_LEVEL_VALUE, MAX_ON_CALL_QUERY_MODEL_LIMIT, MIN_FIRESTORE_MAP_ZOOM_LEVEL_VALUE, MODEL_FUNCTION_FIREBASE_CRUD_FUNCTION_SPECIFIER_SPLITTER, MODEL_NOT_AVAILABLE_ERROR_CODE, MODEL_STORAGE_FILE_SLASH_PATH_FACTORY, ModifyBeforeSetFirestoreDocumentDataAccessorWrapper, NOTIFICATION_BOX_DOES_NOT_EXIST_ERROR_CODE, NOTIFICATION_BOX_EXCLUSION_TARGET_INVALID_ERROR_CODE, NOTIFICATION_BOX_EXISTS_FOR_MODEL_ERROR_CODE, NOTIFICATION_BOX_MODEL_CRUD_FUNCTIONS_CONFIG, NOTIFICATION_BOX_RECIPIENT_DOES_NOT_EXIST_ERROR_CODE, NOTIFICATION_FUNCTION_TYPE_CONFIG_MAP, NOTIFICATION_LOGGED_EVENT_DAY_ITEM_CONVERTER, NOTIFICATION_MESSAGE_MAX_LENGTH, NOTIFICATION_MESSAGE_MIN_LENGTH, NOTIFICATION_MODEL_ALREADY_INITIALIZED_ERROR_CODE, NOTIFICATION_RECIPIENT_NAME_MAX_LENGTH, NOTIFICATION_RECIPIENT_NAME_MIN_LENGTH, NOTIFICATION_SUBJECT_MAX_LENGTH, NOTIFICATION_SUBJECT_MIN_LENGTH, NOTIFICATION_SUMMARY_EMBEDDED_NOTIFICATION_ITEM_MESSAGE_MAX_LENGTH, NOTIFICATION_SUMMARY_EMBEDDED_NOTIFICATION_ITEM_SUBJECT_MAX_LENGTH, NOTIFICATION_SUMMARY_ITEM_LIMIT, NOTIFICATION_TASK_SUBTASK_CHECKPOINT_CLEANUP, NOTIFICATION_TASK_SUBTASK_CHECKPOINT_PROCESSING, NOTIFICATION_USER_BLOCKED_FROM_BEING_ADD_TO_RECIPIENTS_ERROR_CODE, NOTIFICATION_USER_INVALID_UID_FOR_CREATE_ERROR_CODE, NOTIFICATION_USER_LOCKED_CONFIG_FROM_BEING_UPDATED_ERROR_CODE, NOTIFICATION_WEEK_NOTIFICATION_ITEM_LIMIT, NOT_FOUND_ERROR_CODE, NotificationBoxDocument, NotificationBoxRecipientFlag, NotificationBoxRecipientTemplateConfigBoolean, NotificationDocument, NotificationFirestoreCollections, NotificationFunctions, NotificationLoggedEventDayDocument, NotificationLoggedEventDayPageDocument, NotificationMessageFlag, NotificationRecipientSendFlag, NotificationSendState, NotificationSendType, NotificationSummaryDocument, NotificationUserDocument, NotificationWeekDocument, OFFLINE_ACCESS_OIDC_SCOPE, OFFLINE_ACCESS_OIDC_SCOPE_DETAILS, OIDC_ENTRY_CLIENT_TYPE, OIDC_FUNCTION_TYPE_CONFIG_MAP, OIDC_MODEL_CRUD_FUNCTIONS_CONFIG, OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX, OPENID_OIDC_SCOPE, OPENID_OIDC_SCOPE_DETAILS, OidcEntryDocument, OidcModelFirestoreCollections, OidcModelFunctions, PERMISSION_DENIED_ERROR_CODE, PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD, PROFILE_OIDC_SCOPE, PROFILE_OIDC_SCOPE_DETAILS, PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD, QUERY_MODEL_OIDC_SCOPE, READ_MODEL_OIDC_SCOPE, RUN_DEV_FUNCTION_APP_FUNCTION_KEY, SCHEDULED_FUNCTION_DEV_FUNCTION_SPECIFIER, SERVICE_TOKEN_OIDC_SCOPE, SERVICE_TOKEN_OIDC_SCOPE_DETAILS, STANDARD_OIDC_SCOPES, STANDARD_OIDC_SCOPE_DETAILS, STORAGEFILE_RELATED_FILE_METADATA_KEY, STORAGE_FILE_ALREADY_PROCESSED_ERROR_CODE, STORAGE_FILE_CANNOT_BE_DELETED_YET_ERROR_CODE, STORAGE_FILE_FUNCTION_TYPE_CONFIG_MAP, STORAGE_FILE_GROUP_CREATE_INPUT_ERROR_CODE, STORAGE_FILE_GROUP_QUEUED_FOR_INITIALIZATION_ERROR_CODE, STORAGE_FILE_GROUP_ROOT_FOLDER_PATH, STORAGE_FILE_GROUP_ZIP_FILE_PATH, STORAGE_FILE_GROUP_ZIP_INFO_JSON_FILE_NAME, STORAGE_FILE_GROUP_ZIP_STORAGE_FILE_PURPOSE, STORAGE_FILE_GROUP_ZIP_STORAGE_FILE_PURPOSE_CREATE_ZIP_SUBTASK, STORAGE_FILE_MODEL_ALREADY_INITIALIZED_ERROR_CODE, STORAGE_FILE_MODEL_CRUD_FUNCTIONS_CONFIG, STORAGE_FILE_NOT_FLAGGED_FOR_DELETION_ERROR_CODE, STORAGE_FILE_NOT_FLAGGED_FOR_GROUPS_SYNC_ERROR_CODE, STORAGE_FILE_PROCESSING_NOTIFICATION_TASK_TYPE, STORAGE_FILE_PROCESSING_NOT_ALLOWED_FOR_INVALID_STATE_ERROR_CODE, STORAGE_FILE_PROCESSING_NOT_AVAILABLE_FOR_TYPE_ERROR_CODE, STORAGE_FILE_PROCESSING_NOT_QUEUED_FOR_PROCESSING_ERROR_CODE, STORAGE_FILE_PROCESSING_STUCK_THROTTLE_CHECK_MS, STORAGE_FILE_UPLOAD_USER_ROLE, STORAGE_FILE_UPLOAD_USER_SIMPLE_CLAIMS_CONFIGURATION, ScheduledFunctionDevelopmentFirebaseFunctionListEntry, ScheduledFunctionDevelopmentFunctionTypeEnum, StorageFileCreationType, StorageFileDocument, StorageFileFirestoreCollections, StorageFileFunctions, StorageFileGroupDocument, StorageFileProcessingState, StorageFileState, StorageFileUploadStreamUnsupportedError, SystemStateDocument, SystemStateFirestoreCollections, UNAUTHENTICATED_ERROR_CODE, UNAVAILABLE_ERROR_CODE, UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE, UNKNOWN_MODEL_TYPE_ERROR_CODE, UPDATE_MODEL_OIDC_SCOPE, UPLOADED_FILE_DOES_NOT_EXIST_ERROR_CODE, UPLOADED_FILE_INITIALIZATION_DISCARDED_ERROR_CODE, UPLOADED_FILE_INITIALIZATION_FAILED_ERROR_CODE, UPLOADED_FILE_NOT_ALLOWED_TO_BE_INITIALIZED_ERROR_CODE, UPLOADS_FOLDER_PATH, _createNotificationDocumentFromPair, abstractSubscribeOrUnsubscribeToNotificationBoxParamsType, abstractSubscribeToNotificationBoxParamsType, addConstraintToBuilder, addOrReplaceLimitInConstraints, adminOnlyScopesForOidcProviderProfiles, allChildDocumentsUnderParent, allChildDocumentsUnderParentPath, allChildDocumentsUnderRelativePath, allowDocumentSnapshotWithPathOnceFilter, allowedNotificationRecipients, appNotificationTemplateTypeInfoRecordService, applyExclusionsToNotificationUserNotificationBoxRecipientConfigs, arrayUpdateWithAccessorFunction, asTopLevelFieldPath, asTopLevelFieldPaths, assertFirestoreUpdateHasData, assertStorageUploadOptionsStringFormat, assignDateCellRangeFunction, assignDateCellScheduleFunction, assignUnitedStatesAddressFunction, assignWebsiteFileLinkFunction, assignWebsiteLinkFunction, assignmentOnlyScopesForOidcProviderProfiles, buildFirebaseCollectionTypeModelTypeMap, calculateNsForNotificationUserNotificationBoxRecipientConfigs, calculateStorageFileGroupEmbeddedFileUpdate, calculateStorageFileGroupRegeneration, callModelFirebaseFunctionMapFactory, callModelOidcScopeForCallType, canQueueStorageFileForProcessing, childFirestoreModelKey, childFirestoreModelKeyPath, childFirestoreModelKeys, cleanupOldNotificationLoggedEventDaysParamsType, cleanupSentNotificationsParamsType, clientFirebaseFirestoreContextFactory, clientFirebaseStorageContextFactory, combineUploadFileTypeDeterminers, completeSubtaskProcessingAndScheduleCleanupTaskResult, contextGrantedModelRolesReader, contextGrantedModelRolesReaderDoesNotExistErrorMessage, contextGrantedModelRolesReaderPermissionErrorMessage, convertHttpsCallableErrorToReadableError, copyDocumentIdForUserRelatedModifierFunction, copyDocumentIdToFieldModifierFunction, copyStoragePath, copyUserRelatedDataAccessorFactoryFunction, copyUserRelatedDataModifierConfig, createNotificationBoxParamsType, createNotificationDocument, createNotificationDocumentIfSending, createNotificationDocumentPair, createNotificationLoggedEventTemplate, createNotificationSummaryParamsType, createNotificationTaskTemplate, createNotificationTemplate, createNotificationUserParamsType, createOidcClientFieldParamsType, createOidcClientParamsType, createStorageFileDocumentPair, createStorageFileDocumentPairFactory, createStorageFileGroupParamsType, createStorageFileParamsType, createStorageFileSignedUploadUrlParamsType, dataFromDocumentSnapshots, dataFromSnapshotStream, decodeFirebaseAuthOobCode, defaultOidcProviderProfiles, defaultPagedItemPageDataConverter, defaultUnlockedScopesForOidcProviderProfiles, delayCompletion, deleteAllQueuedStorageFilesParamsType, targetModelParamsType as deleteOidcClientParamsType, targetModelParamsType as deleteOidcTokenParamsType, deleteStorageFileParamsType, determineByFileName, determineByFilePath, determineByFolderName, determineUserByFolder, determineUserByFolderWrapperFunction, determineUserByUserUploadsFolderWrapperFunction, developmentFirebaseFunctionMapFactory, directDataHttpsCallable, documentData, documentDataFunction, documentDataWithIdAndKey, documentReferenceFromDocument, documentReferencesFromDocuments, documentReferencesFromSnapshot, downloadMultipleStorageFilesFileParamsType, downloadMultipleStorageFilesParamsType, downloadStorageFileParamsType, effectiveNotificationBoxRecipientConfig, effectiveNotificationBoxRecipientTemplateConfig, encodeFirebaseAuthOobCode, endAt, endAtValue, endBefore, extendFirestoreCollectionWithPagedItemAccessor, extendFirestoreCollectionWithSingleDocumentAccessor, filterConstraintsOfType, filterDisallowedFirestoreItemPageIteratorInputConstraints, filterRepeatCheckpointSnapshots, filterWithDateRange, firebaseAuthErrorToReadableError, firebaseFirestoreClientDrivers, firebaseFirestoreQueryConstraintFunctionsDriver, firebaseFirestoreQueryDriver, firebaseFunctionMapFactory, firebaseModelLoader, firebaseModelPermissionService, firebaseModelService, firebaseModelServiceFactory, firebaseModelsService, firebaseQueryItemAccumulator, firebaseQuerySnapshotAccumulator, firebaseStorageBucketFolderPath, firebaseStorageClientAccessorDriver, firebaseStorageClientAccessorFile, firebaseStorageClientAccessorFolder, firebaseStorageClientDrivers, firebaseStorageClientListFilesResultFactory, firebaseStorageContextFactory, firebaseStorageFileExists, firebaseStorageFilePathFromStorageFilePath, firebaseStorageRefForStorageFilePath, firestoreArray, firestoreArrayMap, firestoreBitwiseObjectMap, firestoreBitwiseSet, firestoreBitwiseSetMap, firestoreBoolean, firestoreClientAccessorDriver, firestoreClientArrayUpdateToUpdateData, firestoreClientIncrementUpdateToUpdateData, firestoreCollectionDocumentCache, firestoreCollectionQueryFactory, firestoreContextFactory, firestoreDate, firestoreDateCellRange, firestoreDateCellRangeArray, firestoreDateCellRangeAssignFn, firestoreDateCellSchedule, firestoreDateCellScheduleAssignFn, firestoreDateNumber, firestoreDencoderArray, firestoreDencoderMap, firestoreDencoderStringArray, firestoreDocumentAccessorContextExtension, firestoreDocumentAccessorFactory, firestoreDocumentLoader, firestoreDocumentSnapshotPairsLoader, firestoreDocumentSnapshotPairsLoaderInstance, firestoreDummyKey, firestoreEncodedArray, firestoreEncodedObjectMap, firestoreEnum, firestoreEnumArray, firestoreField, firestoreFieldConfigToModelMapFunctionsRef, firestoreFixedItemPageIteration, firestoreFixedItemPageIterationFactory, firestoreIdBatchVerifierFactory, firestoreIdentityTypeArray, firestoreIdentityTypeArrayName, firestoreItemPageIteration, firestoreItemPageIterationFactory, firestoreLatLngString, firestoreMap, firestoreMapZoomLevel, firestoreModelId, firestoreModelIdArrayField, firestoreModelIdFromDocument, firestoreModelIdFromEmail, firestoreModelIdGrantedRoleArrayMap, firestoreModelIdGrantedRoleMap, firestoreModelIdOrKeyType, firestoreModelIdString, firestoreModelIdType, firestoreModelIdentity, firestoreModelIdentityTypeMap, firestoreModelIdsFromDocuments, firestoreModelIdsFromKey, firestoreModelKey, firestoreModelKeyArrayField, firestoreModelKeyCollectionName, firestoreModelKeyCollectionType, firestoreModelKeyCollectionTypeArray, firestoreModelKeyCollectionTypeArrayName, firestoreModelKeyCollectionTypePair, firestoreModelKeyEncodedGrantedRoleMap, firestoreModelKeyFactory, firestoreModelKeyFromDocument, firestoreModelKeyGrantedRoleArrayMap, firestoreModelKeyGrantedRoleMap, firestoreModelKeyPairObject, firestoreModelKeyParentKey, firestoreModelKeyParentKeyPartPairs, firestoreModelKeyPart, firestoreModelKeyPartPairs, firestoreModelKeyPartPairsKeyPath, firestoreModelKeyPartPairsPaths, firestoreModelKeyPath, firestoreModelKeyString, firestoreModelKeyType, firestoreModelKeyTypePair, firestoreModelKeys, firestoreModelKeysFromDocuments, firestoreModelType, firestoreNotificationBoxRecipient, firestoreNotificationBoxRecipientTemplateConfigRecord, firestoreNotificationItem, firestoreNotificationRecipientWithConfig, firestoreNotificationUserDefaultNotificationBoxRecipientConfig, firestoreNotificationUserNotificationBoxRecipientConfig, firestoreNumber, firestoreObjectArray, firestorePassThroughField, firestoreQueryConstraint, firestoreQueryConstraintFactory, firestoreQueryDocumentSnapshotPairsLoader, firestoreQueryFactory, firestoreSingleDocumentAccessor, firestoreString, firestoreSubObject, firestoreTimezoneString, firestoreUID, firestoreUniqueArray, firestoreUniqueKeyedArray, firestoreUniqueNumberArray, firestoreUniqueStringArray, firestoreUnitedStatesAddress, firestoreUnitedStatesAddressAssignFn, firestoreUnixDateTimeSecondsNumber, firestoreUpdateWithNoDataError, firestoreWebsiteFileLink, firestoreWebsiteFileLinkAssignFn, firestoreWebsiteFileLinkEncodedArray, firestoreWebsiteFileLinkObjectArray, firestoreWebsiteLink, firestoreWebsiteLinkArray, firestoreWebsiteLinkAssignFn, flatFirestoreModelKey, getDataFromDocumentSnapshots, getDocumentSnapshotData, getDocumentSnapshotDataPair, getDocumentSnapshotDataPairs, getDocumentSnapshotDataPairsWithData, getDocumentSnapshotDataTuples, getDocumentSnapshotPair, getDocumentSnapshotPairs, getDocumentSnapshots, getDocumentSnapshotsData, grantFullAccessIfAdmin, grantFullAccessIfAuthUserRelated, grantModelRolesIfAdmin, grantModelRolesIfAdminFunction, grantModelRolesIfAuthUserRelatedModelFunction, grantModelRolesIfFunction, grantModelRolesIfHasAuthRolesFactory, grantModelRolesIfHasAuthRolesFunction, grantModelRolesOnlyIfFunction, grantStorageFileRolesForUserAuthFunction, inContextFirebaseModelServiceFactory, inContextFirebaseModelsServiceFactory, inMemoryFirestoreCollectionCacheDelegate, inMemoryFirestoreContextCache, inMemoryFirestoreContextCacheFactory, incrementUpdateWithAccessorFunction, inferKeyFromTwoWayFlatFirestoreModelKey, inferNotificationBoxRelatedModelKey, inferStorageFileGroupRelatedModelKey, inferredTargetModelIdParamsType, inferredTargetModelParamsType, initializeAllApplicableNotificationBoxesParamsType, initializeAllApplicableNotificationSummariesParamsType, initializeAllApplicableStorageFileGroupsParamsType, initializeAllStorageFilesFromUploadsParamsType, initializeNotificationModelParamsType, initializeStorageFileFromUploadParamsType, initializeStorageFileModelParamsType, interceptAccessorFactoryFunction, isAdminInFirebaseModelContext, isClientFirebaseError, isCompleteNotificationSendState, isFirebaseStorageObjectNotFoundError, isFirestoreModelId, isFirestoreModelIdOrKey, isFirestoreModelKey, isLoggedEventNotification, isOwnerOfUserRelatedModelInFirebaseModelContext, iterateFirestoreDocumentSnapshotBatches, iterateFirestoreDocumentSnapshotCheckpoints, iterateFirestoreDocumentSnapshotPairBatches, iterateFirestoreDocumentSnapshotPairs, iterateFirestoreDocumentSnapshots, iterateStorageListFiles, iterateStorageListFilesByEachFile, iterateStorageListFilesFactory, iterationQueryDocChangeWatcher, iterationQueryDocChangeWatcherChangeTypeForGroup, latestDataFromDocuments, latestSnapshotsFromDocuments, lazyFirebaseFunctionsFactory, limit, limitToLast, limitUploadFileTypeDeterminer, limitedFirestoreDocumentAccessorFactory, limitedFirestoreDocumentAccessorSnapshotCache, loadAllFirestoreDocumentSnapshot, loadAllFirestoreDocumentSnapshotPairs, loadDocumentsForDocumentReferences, loadDocumentsForDocumentReferencesFromValues, loadDocumentsForIds, loadDocumentsForIdsFromValues, loadDocumentsForKeys, loadDocumentsForKeysFromValues, loadDocumentsForSnapshots, loadDocumentsForValues, loadNotificationBoxDocumentForReferencePair, loadStorageFileGroupDocumentForReferencePair, makeDocuments, makeFirestoreCollection, makeFirestoreCollectionGroup, makeFirestoreCollectionWithParent, makeFirestoreContextCache, makeFirestoreItemPageIteratorDelegate, makeFirestoreQueryConstraintFunctionsDriver, makePagedItemFirestoreCollection, makeRootSingleItemFirestoreCollection, makeSingleItemFirestoreCollection, mapDataFromSnapshot, mapHttpsCallable, mapLatestSnapshotsFromDocuments, mergeNotificationBoxRecipientTemplateConfigRecords, mergeNotificationBoxRecipientTemplateConfigs, mergeNotificationBoxRecipients, mergeNotificationSendMessagesResult, mergeNotificationUserDefaultNotificationBoxRecipientConfig, mergeNotificationUserNotificationBoxRecipientConfigs, modelStorageSlashPathFactory, modifyBeforeSetInterceptAccessorFactoryFunction, newDocuments, newNotificationBoxRecipientForUid, noContentNotificationMessageFunctionFactory, noStringFormatInStorageUploadOptionsError, noopFirestoreCollectionCache, noopFirestoreCollectionCacheDelegate, noopFirestoreCollectionDocumentCache, noopFirestoreContextCache, notificationBoxCollectionReference, notificationBoxConverter, notificationBoxFirestoreCollection, notificationBoxIdForModel, notificationBoxIdentity, notificationBoxRecipientTemplateConfigArrayEntryParamType, notificationBoxRecipientTemplateConfigArrayToRecord, notificationBoxRecipientTemplateConfigRecordToArray, notificationBoxesFlaggedForNeedsInitializationQuery, notificationBoxesFlaggedInvalidQuery, notificationCollectionReference, notificationCollectionReferenceFactory, notificationConverter, notificationFirestoreCollectionFactory, notificationFirestoreCollectionGroup, notificationFunctionMap, notificationIdentity, notificationLoggedEventDayCollectionReference, notificationLoggedEventDayCollectionReferenceFactory, notificationLoggedEventDayConverter, notificationLoggedEventDayFirestoreCollectionFactory, notificationLoggedEventDayFirestoreCollectionGroup, notificationLoggedEventDayId, notificationLoggedEventDayIdentity, notificationLoggedEventDayPageCollectionReference, notificationLoggedEventDayPageFirestoreCollectionGroup, notificationLoggedEventDayPageIdentity, notificationLoggedEventDayPagedItemsCollectionFactory, notificationLoggedEventDayPagedItemsCollectionReferenceFactory, notificationLoggedEventDaysOlderThanQuery, notificationLoggedEventLoader, notificationMessageFunction, notificationRecipientParamsType, notificationSendExclusionCanSendFunction, notificationSendFlagsImplyIsComplete, notificationSubtaskComplete, notificationSummariesFlaggedForNeedsInitializationQuery, notificationSummaryCollectionReference, notificationSummaryConverter, notificationSummaryFirestoreCollection, notificationSummaryIdForModel, notificationSummaryIdForUidFunctionForRootFirestoreModelIdentity, notificationSummaryIdentity, notificationTaskCanRunNextCheckpoint, notificationTaskComplete, notificationTaskDelayRetry, notificationTaskFailed, notificationTaskPartiallyComplete, notificationTaskUniqueId, notificationTemplateTypeInfoRecord, notificationUserCollectionReference, notificationUserConverter, notificationUserFirestoreCollection, notificationUserHasExclusionQuery, notificationUserIdentity, notificationUsersFlaggedForNeedsSyncQuery, notificationWeekCollectionReference, notificationWeekCollectionReferenceFactory, notificationWeekConverter, notificationWeekFirestoreCollectionFactory, notificationWeekFirestoreCollectionGroup, notificationWeekIdentity, notificationsPastSendAtTimeQuery, notificationsReadyForCleanupQuery, offset, oidcClientEntriesByOwnerQuery, oidcEntriesByClientIdQuery, oidcEntriesByGrantIdQuery, oidcEntriesByUidQuery, oidcEntriesByUserCodeQuery, oidcEntriesWithTypeQuery, oidcEntryCollectionReference, oidcEntryConverter, oidcEntryFirestoreCollection, oidcEntryIdentity, oidcGrantEntriesByUidQuery, oidcModelFunctionMap, oidcProviderProfileDetails, oidcProviderProfilesForClient, oidcProviderProfilesForKeys, oidcScopeTermSatisfied, oidcScopeTermsSatisfied, oidcScopesFromScopeClaim, onCallCreateModelParams, onCallCreateModelResult, onCallCreateModelResultWithDocs, onCallDeleteModelParams, onCallDevelopmentParams, onCallInvokeModelParams, onCallQueryModelParams, onCallReadModelParams, onCallTypedModelParams, onCallTypedModelParamsFunction, onCallUpdateModelParams, optionalFirestoreArray, optionalFirestoreBoolean, optionalFirestoreDate, optionalFirestoreDateNumber, optionalFirestoreEnum, optionalFirestoreField, optionalFirestoreNumber, optionalFirestoreString, optionalFirestoreUID, optionalFirestoreUnitedStatesAddress, optionalFirestoreUnixDateTimeSecondsNumber, orderBy, orderByDocumentId, processAllQueuedStorageFilesParamsType, processStorageFileParamsType, readFirestoreModelKey, readFirestoreModelKeyFromDocumentSnapshot, readLoggingFirestoreContextCache, readLoggingFirestoreContextCacheFactory, readMultipleStorageFilesMetadataFileParamsType, readMultipleStorageFilesMetadataParamsType, readStorageFileMetadataParamsType, regenerateAllFlaggedStorageFileGroupsContentParamsType, regenerateStorageFileGroupContentParamsType, replaceConstraints, requiredScopesForOidcProviderProfiles, resolveEffectiveOidcScopeTerms, resolveOidcModelScopeRequirement, resyncAllNotificationUserParamsType, targetModelParamsType as resyncNotificationUserParamsType, targetModelParamsType as rotateOidcClientSecretParamsType, scheduledFunctionDevelopmentFirebaseFunctionParamsType, scopesForOidcProviderProfiles, selectFromFirebaseModelsService, sendNotificationParamsType, sendQueuedNotificationsParamsType, separateConstraints, setIdAndKeyFromKeyIdRefOnDocumentData, setIdAndKeyFromSnapshotOnDocumentData, shouldSaveNotificationToNotificationWeek, shouldSendCreatedNotificationInput, snapshotConverterFunctions, snapshotStreamDataForAccessor, snapshotStreamForAccessor, sortNotificationItemsFunction, startAfter, startAt, startAtValue, storageFileCollectionReference, storageFileConverter, storageFileFirestoreCollection, storageFileFlaggedForSyncWithGroupsQuery, storageFileFunctionMap, storageFileGroupCollectionReference, storageFileGroupConverter, storageFileGroupCreateStorageFileKeyFactory, storageFileGroupCreatedStorageFileKey, storageFileGroupEmbeddedFile, storageFileGroupFirestoreCollection, storageFileGroupFolderPath, storageFileGroupIdForModel, storageFileGroupIdentity, storageFileGroupZipFileStoragePath, storageFileGroupZipStorageFileKey, storageFileGroupsFlaggedForContentRegenerationQuery, storageFileGroupsFlaggedForNeedsInitializationQuery, storageFileGroupsFlaggedInvalidQuery, storageFileIdentity, storageFileProcessingNotificationTaskTemplate, storageFilePurposeAndUserQuery, storageFilesQueuedForDeleteQuery, storageFilesQueuedForProcessingQuery, storageListFilesResultFactory, storageListFilesResultHasNoNextError, storagePathFactory, storedFileReaderFactory, streamDocumentSnapshotDataPairs, streamDocumentSnapshotDataPairsWithData, streamDocumentSnapshotsData, streamFromOnSnapshot, syncAllFlaggedStorageFilesWithGroupsParamsType, syncStorageFileWithGroupsParamsType, systemStateCollectionReference, systemStateConverter, systemStateFirestoreCollection, systemStateIdentity, targetModelIdParamsType, targetModelParamsType, twoWayFlatFirestoreModelKey, unreadNotificationItems, unsupportedFirestoreDriverFunctionError, targetModelParamsType as updateNotificationBoxParamsType, updateNotificationBoxRecipientLikeParamsType, updateNotificationBoxRecipientParamsType, updateNotificationBoxRecipientTemplateConfigRecord, updateNotificationRecipient, updateNotificationSummaryParamsType, updateNotificationUserDefaultNotificationBoxRecipientConfig, updateNotificationUserDefaultNotificationBoxRecipientConfigParamsType, updateNotificationUserNotificationBoxRecipientConfigIfChanged, updateNotificationUserNotificationBoxRecipientConfigs, updateNotificationUserNotificationBoxRecipientParamsType, updateNotificationUserNotificationSendExclusions, updateNotificationUserParamsType, updateOidcClientFieldParamsType, updateOidcClientParamsType, updateStorageFileGroupEntryParamsType, updateStorageFileGroupParamsType, updateStorageFileParamsType, updateWithAccessorUpdateAndConverterFunction, uploadFileWithStream, useContextAuth, useContextAuthUid, useDocumentSnapshot, useDocumentSnapshotData, useFirebaseModelsService, userUploadsFolderSlashPathFactory, userUploadsFolderStoragePathFactory, where, whereDateIsAfter, whereDateIsAfterWithSort, whereDateIsBefore, whereDateIsBeforeWithSort, whereDateIsBetween, whereDateIsInRange, whereDateIsOnOrAfter, whereDateIsOnOrAfterWithSort, whereDateIsOnOrBefore, whereDateIsOnOrBeforeWithSort, whereDocumentId, whereStringHasRootIdentityModelKey, whereStringValueHasPrefix };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase",
-  "version": "13.30.0",
+  "version": "13.31.0",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -24,10 +24,10 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/date": "13.30.0",
-    "@dereekb/model": "13.30.0",
-    "@dereekb/rxjs": "13.30.0",
-    "@dereekb/util": "13.30.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0",
     "@firebase/rules-unit-testing": "5.0.0",
     "@marcbachmann/cel-js": "^7.6.1",
     "@typescript-eslint/parser": "8.59.3",

package/src/lib/common/auth/oidc/oidc.profile.d.ts

@@ -63,11 +63,49 @@ export interface OidcProviderProfile<S extends OidcScope = OidcScope> {
      * Optional human-readable description, used in the admin profile picker.
      */
     readonly description?: string;
+    /**
+     * Whether this profile applies to a client that has NO profiles assigned (an empty or absent
+     * `dbx_provider_profiles`). Defaults to `false`.
+     *
+     * Lets an app make a coarse, broadly-available scope profile-gated — so the profile picker becomes
+     * the single control surface for scope grouping — without breaking every already-registered client.
+     * Multiple default profiles union.
+     *
+     * The fallback is exclusive: a client assigned ANY profile resolves to exactly its assigned
+     * profiles, so assigning a non-default profile does NOT additionally confer the default's scopes.
+     *
+     * Note a `require: 'required'` scope on a default profile is force-required for EVERY unassigned
+     * client — a default profile usually wants `require: 'none'`.
+     *
+     * @see oidcProviderProfilesForClient
+     */
+    readonly isDefault?: boolean;
+    /**
+     * Whether the scopes this profile unlocks may only be granted to admin users. Defaults to `false`.
+     *
+     * Equivalent to listing this profile's scopes in `OidcProviderConfig.adminOnlyScopes` — the two are
+     * unioned — but declared alongside the profile so the fact lives in one place rather than drifting
+     * between the shared registry and the server provider config.
+     *
+     * Combined with `require: 'required'`, this makes the whole client admin-only: the client always
+     * requests the scope, so a non-admin resolving its consent is always rejected with `access_denied`.
+     *
+     * Independent of {@link isDefault} and of the profile unlock gate — a scope may be subject to both
+     * gates.
+     *
+     * @see adminOnlyScopesForOidcProviderProfiles
+     */
+    readonly adminOnly?: boolean;
     /**
      * The scopes this profile unlocks, each with an optional require mode.
      */
     readonly scopes: readonly OidcProviderProfileScopeConfig<S>[];
 }
+/**
+ * Suffix appended to a default profile's description in {@link oidcProviderProfileDetails}, so an
+ * admin viewing the picker sees that leaving the field empty still grants that profile's scopes.
+ */
+export declare const OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX = "Applied by default when no profiles are assigned.";
 /**
  * Profile picker entry (label + key + description), mirroring {@link OidcScopeDetails}.
  */
@@ -80,6 +118,31 @@ export type OidcProviderProfileDetails = LabeledValueWithDescription<OidcProvide
  * @returns The registry profiles whose key is in `keys`.
  */
 export declare function oidcProviderProfilesForKeys<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[], keys: readonly OidcProviderProfileKey[] | undefined): OidcProviderProfile<S>[];
+/**
+ * Filters the provider-profile registry to the profiles marked {@link OidcProviderProfile.isDefault}.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The registry profiles that apply to a client with no assigned profiles.
+ */
+export declare function defaultOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): OidcProviderProfile<S>[];
+/**
+ * Resolves the profiles that apply to a client: its assigned profiles, or — when it has NO profiles
+ * assigned — the registry's default profiles.
+ *
+ * The fallback is exclusive: a client with any assigned key resolves to exactly
+ * {@link oidcProviderProfilesForKeys}, so a non-default assignment never additionally confers the
+ * default profiles' scopes. A registry declaring no default behaves identically to
+ * {@link oidcProviderProfilesForKeys}.
+ *
+ * The fallback keys off the assigned key list being empty/absent rather than off the resolved set
+ * being empty, so a client whose assigned profile was later removed from the registry resolves to no
+ * profiles (fail-closed) rather than silently picking up the default.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @param keys - The profile keys assigned to the client (its `dbx_provider_profiles`).
+ * @returns The client's assigned profiles, or the default profiles when none are assigned.
+ */
+export declare function oidcProviderProfilesForClient<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[], keys: readonly OidcProviderProfileKey[] | undefined): OidcProviderProfile<S>[];
 /**
  * Collects every scope referenced by the given profiles.
  *
@@ -87,6 +150,11 @@ export declare function oidcProviderProfilesForKeys<S extends OidcScope = OidcSc
  * obtain via a profile. Passed a client's assigned profiles, this is the set of scopes those
  * profiles unlock for that client.
  *
+ * Note a gated scope is not necessarily unavailable to an unassigned client: a scope unlocked by a
+ * default profile is gated yet reachable by every client. Use
+ * {@link assignmentOnlyScopesForOidcProviderProfiles} for the "requires an explicit assignment"
+ * subset (e.g. to exclude scopes from a general picker or from advertised scope metadata).
+ *
  * @param profiles - The profiles to collect scopes from.
  * @returns The union of every profile's scopes.
  */
@@ -98,9 +166,47 @@ export declare function scopesForOidcProviderProfiles<S extends OidcScope = Oidc
  * @returns The union of every profile's `required` scopes.
  */
 export declare function requiredScopesForOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): Set<S>;
+/**
+ * Collects the scopes unlocked by the registry's default profiles — the scopes every client can
+ * obtain, including one with no profiles assigned.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The union of every default profile's scopes. Empty when no profile is marked default.
+ */
+export declare function defaultUnlockedScopesForOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): Set<S>;
+/**
+ * Collects the gated scopes that are NOT unlocked by default — the scopes a client can only obtain
+ * via an explicit profile assignment.
+ *
+ * This is the set to exclude from a general scope picker or from advertised scope metadata (e.g. an
+ * MCP protected-resource document's `scopes_supported`). Prefer it over
+ * {@link scopesForOidcProviderProfiles} for that job: the full gated set would wrongly drop a
+ * default-unlocked scope that every client can in fact obtain. With no default declared the two are
+ * identical.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns Every profile-gated scope minus the default-unlocked ones.
+ */
+export declare function assignmentOnlyScopesForOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): Set<S>;
+/**
+ * Collects the scopes of every profile marked {@link OidcProviderProfile.adminOnly}.
+ *
+ * Unioned with `OidcProviderConfig.adminOnlyScopes` by the consent admin-only gate: a consent
+ * requesting one of these scopes is hard-rejected with `access_denied` when the resolving user is
+ * not an admin.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The union of every admin-only profile's scopes. Empty when no profile is marked admin-only.
+ */
+export declare function adminOnlyScopesForOidcProviderProfiles<S extends OidcScope = OidcScope>(profiles: readonly OidcProviderProfile<S>[]): Set<S>;
 /**
  * Builds picker entries for the given provider profiles, suitable for an admin profile-selection field.
  *
+ * A default profile's description carries {@link OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX} so
+ * an admin isn't surprised that an empty selection still grants scopes. Default profiles are
+ * deliberately not pre-selected — persisting the default as an explicit assignment would opt the
+ * client out of the fallback, so it would stop tracking the registry if the default later changed.
+ *
  * @param profiles - The provider-profile registry.
  * @returns One {@link OidcProviderProfileDetails} per profile.
  */

package/test/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@dereekb/firebase/test",
-  "version": "13.30.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/date": "13.30.0",
-    "@dereekb/firebase": "13.30.0",
-    "@dereekb/model": "13.30.0",
-    "@dereekb/rxjs": "13.30.0",
-    "@dereekb/util": "13.30.0",
+    "@dereekb/date": "13.31.0",
+    "@dereekb/firebase": "13.31.0",
+    "@dereekb/model": "13.31.0",
+    "@dereekb/rxjs": "13.31.0",
+    "@dereekb/util": "13.31.0",
     "@firebase/rules-unit-testing": "5.0.0",
     "date-fns": "^4.1.0",
     "firebase": "^12.12.1",