@lpdjs/firestore-repo-service 2.6.2-beta.0 → 2.6.2

package/dist/{create-servers-CVudVM8e.d.ts → create-servers-BlxW-09M.d.ts}

@@ -1,11 +1,11 @@
-import { S as SyncQueue } from './queue-DYmbVDu5.js';
-import { F as FirestoreSyncConfig, S as SyncEvent } from './types-FLGn8CAI.js';
-import { O as OpenAPIDocument } from './openapi-DB8bXZB-.js';
+import { S as SyncQueue } from './queue-B7uCIF1O.js';
+import { F as FirestoreSyncConfig, S as SyncEvent } from './types-CMrrjq1V.js';
+import { O as OpenAPIDocument } from './openapi-ChZojCEO.js';
 import * as firebase_functions_v2_https from 'firebase-functions/v2/https';
 import { onRequest, HttpsOptions } from 'firebase-functions/v2/https';
 import { H as HistoryTriggersConfig } from './read-CTWZjxyh.js';
-import { C as ConfiguredRepository, a as CrudServerOptions, b as CrudRepoConfig } from './types-BHZ-Gk-s.js';
-import { A as AdminServerOptions, a as AdminRepoConfig } from './index-oFhGCBrY.js';
+import { C as ConfiguredRepository, a as CrudServerOptions, b as CrudRepoConfig } from './types-CeyFvYXO.js';
+import { A as AdminServerOptions, a as AdminRepoConfig } from './index-BM1mgnpJ.js';
 
 /** Per-repo admin config with `repo` omitted (auto-bound from the registry key). */
 type BoundAdminRepoConfig<TRepo extends ConfiguredRepository<any>> = Omit<AdminRepoConfig<TRepo>, "repo">;

package/dist/{create-servers-B4GrBqdA.d.cts → create-servers-DoOU7VMv.d.cts}

@@ -1,11 +1,11 @@
-import { S as SyncQueue } from './queue-B8YUTnBT.cjs';
-import { F as FirestoreSyncConfig, S as SyncEvent } from './types-wcX7xfdo.cjs';
-import { O as OpenAPIDocument } from './openapi-B2w5tVRR.cjs';
+import { S as SyncQueue } from './queue-QISiqmAy.cjs';
+import { F as FirestoreSyncConfig, S as SyncEvent } from './types-CCREogoy.cjs';
+import { O as OpenAPIDocument } from './openapi-DpMtzJGo.cjs';
 import * as firebase_functions_v2_https from 'firebase-functions/v2/https';
 import { onRequest, HttpsOptions } from 'firebase-functions/v2/https';
 import { H as HistoryTriggersConfig } from './read-CTWZjxyh.cjs';
-import { C as ConfiguredRepository, a as CrudServerOptions, b as CrudRepoConfig } from './types-GvexCqrq.cjs';
-import { A as AdminServerOptions, a as AdminRepoConfig } from './index-DzO9MfNI.cjs';
+import { C as ConfiguredRepository, a as CrudServerOptions, b as CrudRepoConfig } from './types-KYdNUffK.cjs';
+import { A as AdminServerOptions, a as AdminRepoConfig } from './index-BuxFmMV8.cjs';
 
 /** Per-repo admin config with `repo` omitted (auto-bound from the registry key). */
 type BoundAdminRepoConfig<TRepo extends ConfiguredRepository<any>> = Omit<AdminRepoConfig<TRepo>, "repo">;

package/dist/{firebase-auth-Dpvrd8MP.d.cts → firebase-auth-BTclYg-c.d.cts}

@@ -279,10 +279,14 @@ interface FirebaseAuthConfig<TContext = unknown> {
      * requests are exempt (a browser never auto-attaches an `Authorization`
      * header, so they are not CSRF-able).
      *
-     * Defaults to `true` for `cookie`/`both` modes and `false` for `bearer`.
-     * This is the primary protection when `sameSite: "None"` is used and a
-     * defense-in-depth layer otherwise. Disable only if you implement your own
-     * CSRF protection upstream.
+     * **Defaults to `true` only when `sameSite: "None"`** (and not in `bearer`
+     * mode). With the default `Lax`/`Strict` cookie the browser already blocks
+     * the session cookie on cross-site mutations, so the check is unnecessary
+     * and is left off to avoid false positives behind proxies whose `Host`
+     * differs from the public origin (e.g. Cloud Functions v2 / Cloud Run).
+     * Set to `true` to force the check on regardless of `sameSite`, or `false`
+     * to disable it even with `sameSite: "None"` (only if you implement your
+     * own CSRF protection upstream).
      */
     csrfProtection?: boolean;
     /**

package/dist/{firebase-auth-Dpvrd8MP.d.ts → firebase-auth-BTclYg-c.d.ts}

@@ -279,10 +279,14 @@ interface FirebaseAuthConfig<TContext = unknown> {
      * requests are exempt (a browser never auto-attaches an `Authorization`
      * header, so they are not CSRF-able).
      *
-     * Defaults to `true` for `cookie`/`both` modes and `false` for `bearer`.
-     * This is the primary protection when `sameSite: "None"` is used and a
-     * defense-in-depth layer otherwise. Disable only if you implement your own
-     * CSRF protection upstream.
+     * **Defaults to `true` only when `sameSite: "None"`** (and not in `bearer`
+     * mode). With the default `Lax`/`Strict` cookie the browser already blocks
+     * the session cookie on cross-site mutations, so the check is unnecessary
+     * and is left off to avoid false positives behind proxies whose `Host`
+     * differs from the public origin (e.g. Cloud Functions v2 / Cloud Run).
+     * Set to `true` to force the check on regardless of `sameSite`, or `false`
+     * to disable it even with `sameSite: "None"` (only if you implement your
+     * own CSRF protection upstream).
      */
     csrfProtection?: boolean;
     /**

package/dist/{index-oFhGCBrY.d.ts → index-BM1mgnpJ.d.ts}

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { HttpsOptions } from 'firebase-functions/v2/https';
-import { C as ConfiguredRepository, f as RepositoryConfig, g as FieldPath, F as FieldRole, S as SecurityHeadersOptions } from './types-BHZ-Gk-s.js';
-import { A as AuthExtension, h as Middleware } from './firebase-auth-Dpvrd8MP.js';
+import { C as ConfiguredRepository, f as RepositoryConfig, g as FieldPath, F as FieldRole, S as SecurityHeadersOptions } from './types-CeyFvYXO.js';
+import { A as AuthExtension, h as Middleware } from './firebase-auth-BTclYg-c.js';
 
 interface PageOptions {
     title: string;

package/dist/{index-DzO9MfNI.d.cts → index-BuxFmMV8.d.cts}

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { HttpsOptions } from 'firebase-functions/v2/https';
-import { C as ConfiguredRepository, f as RepositoryConfig, g as FieldPath, F as FieldRole, S as SecurityHeadersOptions } from './types-GvexCqrq.cjs';
-import { A as AuthExtension, h as Middleware } from './firebase-auth-Dpvrd8MP.cjs';
+import { C as ConfiguredRepository, f as RepositoryConfig, g as FieldPath, F as FieldRole, S as SecurityHeadersOptions } from './types-KYdNUffK.cjs';
+import { A as AuthExtension, h as Middleware } from './firebase-auth-BTclYg-c.cjs';
 
 interface PageOptions {
     title: string;