@dereekb/dbx-cli 13.28.0 → 13.30.0

package/eslint/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@dereekb/dbx-cli/eslint",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "peerDependencies": {
-    "@dereekb/dbx-cli": "13.28.0",
-    "@dereekb/util": "13.28.0",
+    "@dereekb/dbx-cli": "13.30.0",
+    "@dereekb/util": "13.30.0",
     "@typescript-eslint/utils": "8.59.3",
     "typescript": "5.9.3"
   },

package/firebase-api-manifest/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/dbx-cli-firebase-api-manifest",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "private": true,
   "type": "module",
   "devDependencies": {
     "ts-morph": "^21.0.0"
   },
   "peerDependencies": {
-    "@dereekb/dbx-cli": "13.28.0",
-    "@dereekb/util": "13.28.0",
+    "@dereekb/dbx-cli": "13.30.0",
+    "@dereekb/util": "13.30.0",
     "prettier": "3.8.3"
   }
 }

package/generate-firestore-indexes/main.js

@@ -5,14 +5,14 @@ const require = __createRequire(import.meta.url);
 // packages/dbx-cli/generate-firestore-indexes/package.json
 var package_default = {
   name: "@dereekb/dbx-cli-generate-firestore-indexes",
-  version: "13.28.0",
+  version: "13.30.0",
   private: true,
   type: "module",
   devDependencies: {
     eslint: "10.4.0"
   },
   peerDependencies: {
-    "@dereekb/dbx-cli": "13.28.0"
+    "@dereekb/dbx-cli": "13.30.0"
   }
 };
 

package/generate-firestore-indexes/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@dereekb/dbx-cli-generate-firestore-indexes",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "private": true,
   "type": "module",
   "devDependencies": {
     "eslint": "10.4.0"
   },
   "peerDependencies": {
-    "@dereekb/dbx-cli": "13.28.0"
+    "@dereekb/dbx-cli": "13.30.0"
   }
 }

package/generate-mcp-manifest/main.js

@@ -226,7 +226,7 @@ function indexApps(apps) {
 var UTIL_ROLE_PATH = "packages/util/src/lib/auth/auth.role.ts";
 var STORAGE_CLAIM_PATH = "packages/firebase/src/lib/model/storagefile/storagefile.upload.claims.ts";
 var OIDC_SCOPE_PATH = "packages/firebase/src/lib/common/auth/oidc/oidc.ts";
-var OIDC_SCOPE_PRE_ASSERT_PATH = "packages/firebase-server/oidc/src/lib/scope.ts";
+var OIDC_SCOPE_ENFORCEMENT_PATH = "packages/firebase-server/src/lib/nest/controller/model/model.api.scope.ts";
 var DEMO_CLAIMS_PATH = "components/demo-firebase/src/lib/auth/claims.ts";
 var BUILTIN_AUTH_ROLES = [
   {
@@ -302,9 +302,9 @@ var BUILTIN_AUTH_SCOPES = CALL_MODEL_OIDC_SCOPES.map((scope) => {
     description: `Required OIDC scope for the \`callModel\` ${callType ?? "CRUD"} verb.`,
     enforcedAt: [
       {
-        path: OIDC_SCOPE_PRE_ASSERT_PATH,
-        line: 21,
-        description: "`oidcCallModelScopePreAssert` rejects requests that lack this scope."
+        path: OIDC_SCOPE_ENFORCEMENT_PATH,
+        line: 115,
+        description: "`assertModelApiOidcScope` (model-api dispatch + `/get`) rejects requests that lack this scope."
       }
     ],
     errorCode: CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE,

package/generate-mcp-manifest/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@dereekb/dbx-cli-generate-mcp-manifest",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "private": true,
   "type": "module",
   "peerDependencies": {
-    "@dereekb/dbx-cli": "13.28.0",
-    "@dereekb/model": "13.28.0",
+    "@dereekb/dbx-cli": "13.30.0",
+    "@dereekb/model": "13.30.0",
     "arktype": "^2.2.0",
     "jiti": "2.6.1"
   }

package/generate-route-manifest/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dereekb/dbx-cli-generate-route-manifest",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "private": true,
   "type": "module",
   "peerDependencies": {
-    "@dereekb/dbx-cli": "13.28.0",
+    "@dereekb/dbx-cli": "13.30.0",
     "ts-morph": "^21.0.0"
   }
 }

package/index.cjs.js

@@ -15971,7 +15971,7 @@ function _unsupported_iterable_to_array$K(o, minLen) {
  *
  *   - **scopes** — OAuth/OIDC scope names (`model.read`, `model.write`, …)
  *     surfaced through the OIDC bridge, plus the source location where each
- *     scope is enforced (e.g. `oidcCallModelScopePreAssert`).
+ *     scope is enforced (e.g. `assertModelApiOidcScope`).
  *
  *   - **apps**   — one entry per downstream app (demo-api, hellosubs-api).
  *     Bundles the claims interface name, the claims-service constant name,
@@ -16295,7 +16295,7 @@ function _unsupported_iterable_to_array$J(o, minLen) {
 var UTIL_ROLE_PATH = 'packages/util/src/lib/auth/auth.role.ts';
 var STORAGE_CLAIM_PATH = 'packages/firebase/src/lib/model/storagefile/storagefile.upload.claims.ts';
 var OIDC_SCOPE_PATH = 'packages/firebase/src/lib/common/auth/oidc/oidc.ts';
-var OIDC_SCOPE_PRE_ASSERT_PATH = 'packages/firebase-server/oidc/src/lib/scope.ts';
+var OIDC_SCOPE_ENFORCEMENT_PATH = 'packages/firebase-server/src/lib/nest/controller/model/model.api.scope.ts';
 var DEMO_CLAIMS_PATH = 'components/demo-firebase/src/lib/auth/claims.ts';
 // MARK: Built-in roles
 /**
@@ -16407,9 +16407,8 @@ var DEMO_CLAIMS_PATH = 'components/demo-firebase/src/lib/auth/claims.ts';
 ];
 // MARK: Built-in scopes
 /**
- * The five callModel CRUD scopes enforced by
- * {@link oidcCallModelScopePreAssert}. App-specific scopes live in the
- * downstream catalog layer.
+ * The five callModel CRUD scopes enforced by {@link assertModelApiOidcScope} at
+ * the model-api layer. App-specific scopes live in the downstream catalog layer.
  */ var BUILTIN_AUTH_SCOPES = firebase.CALL_MODEL_OIDC_SCOPES.map(function(scope) {
     var _Object_entries_find;
     var callType = ((_Object_entries_find = Object.entries(firebase.CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE).find(function(param) {
@@ -16423,9 +16422,9 @@ var DEMO_CLAIMS_PATH = 'components/demo-firebase/src/lib/auth/claims.ts';
         description: "Required OIDC scope for the `callModel` ".concat(callType !== null && callType !== void 0 ? callType : 'CRUD', " verb."),
         enforcedAt: [
             {
-                path: OIDC_SCOPE_PRE_ASSERT_PATH,
-                line: 21,
-                description: '`oidcCallModelScopePreAssert` rejects requests that lack this scope.'
+                path: OIDC_SCOPE_ENFORCEMENT_PATH,
+                line: 115,
+                description: '`assertModelApiOidcScope` (model-api dispatch + `/get`) rejects requests that lack this scope.'
             }
         ],
         errorCode: firebase.CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE,

package/index.esm.js

@@ -15969,7 +15969,7 @@ function _unsupported_iterable_to_array$K(o, minLen) {
  *
  *   - **scopes** — OAuth/OIDC scope names (`model.read`, `model.write`, …)
  *     surfaced through the OIDC bridge, plus the source location where each
- *     scope is enforced (e.g. `oidcCallModelScopePreAssert`).
+ *     scope is enforced (e.g. `assertModelApiOidcScope`).
  *
  *   - **apps**   — one entry per downstream app (demo-api, hellosubs-api).
  *     Bundles the claims interface name, the claims-service constant name,
@@ -16293,7 +16293,7 @@ function _unsupported_iterable_to_array$J(o, minLen) {
 var UTIL_ROLE_PATH = 'packages/util/src/lib/auth/auth.role.ts';
 var STORAGE_CLAIM_PATH = 'packages/firebase/src/lib/model/storagefile/storagefile.upload.claims.ts';
 var OIDC_SCOPE_PATH = 'packages/firebase/src/lib/common/auth/oidc/oidc.ts';
-var OIDC_SCOPE_PRE_ASSERT_PATH = 'packages/firebase-server/oidc/src/lib/scope.ts';
+var OIDC_SCOPE_ENFORCEMENT_PATH = 'packages/firebase-server/src/lib/nest/controller/model/model.api.scope.ts';
 var DEMO_CLAIMS_PATH = 'components/demo-firebase/src/lib/auth/claims.ts';
 // MARK: Built-in roles
 /**
@@ -16405,9 +16405,8 @@ var DEMO_CLAIMS_PATH = 'components/demo-firebase/src/lib/auth/claims.ts';
 ];
 // MARK: Built-in scopes
 /**
- * The five callModel CRUD scopes enforced by
- * {@link oidcCallModelScopePreAssert}. App-specific scopes live in the
- * downstream catalog layer.
+ * The five callModel CRUD scopes enforced by {@link assertModelApiOidcScope} at
+ * the model-api layer. App-specific scopes live in the downstream catalog layer.
  */ var BUILTIN_AUTH_SCOPES = CALL_MODEL_OIDC_SCOPES.map(function(scope) {
     var _Object_entries_find;
     var callType = ((_Object_entries_find = Object.entries(CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE).find(function(param) {
@@ -16421,9 +16420,9 @@ var DEMO_CLAIMS_PATH = 'components/demo-firebase/src/lib/auth/claims.ts';
         description: "Required OIDC scope for the `callModel` ".concat(callType !== null && callType !== void 0 ? callType : 'CRUD', " verb."),
         enforcedAt: [
             {
-                path: OIDC_SCOPE_PRE_ASSERT_PATH,
-                line: 21,
-                description: '`oidcCallModelScopePreAssert` rejects requests that lack this scope.'
+                path: OIDC_SCOPE_ENFORCEMENT_PATH,
+                line: 115,
+                description: '`assertModelApiOidcScope` (model-api dispatch + `/get`) rejects requests that lack this scope.'
             }
         ],
         errorCode: CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE,

package/lint-cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli-lint-cache",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "private": true,
   "type": "module",
   "devDependencies": {
@@ -8,7 +8,7 @@
     "eslint": "10.4.0"
   },
   "peerDependencies": {
-    "@dereekb/util": "13.28.0",
+    "@dereekb/util": "13.30.0",
     "yargs": "^18.0.0"
   }
 }

package/manifest-extract/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dereekb/dbx-cli/manifest-extract",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "sideEffects": false,
   "peerDependencies": {
     "@dereekb/date": "13.15.0",
-    "@dereekb/dbx-cli": "13.28.0",
+    "@dereekb/dbx-cli": "13.30.0",
     "@dereekb/firebase": "13.15.0",
     "@dereekb/model": "13.15.0",
     "@dereekb/nestjs": "13.15.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "type": "module",
   "sideEffects": false,
   "bin": {
@@ -66,11 +66,11 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/date": "13.28.0",
-    "@dereekb/firebase": "13.28.0",
-    "@dereekb/model": "13.28.0",
-    "@dereekb/nestjs": "13.28.0",
-    "@dereekb/util": "13.28.0",
+    "@dereekb/date": "13.30.0",
+    "@dereekb/firebase": "13.30.0",
+    "@dereekb/model": "13.30.0",
+    "@dereekb/nestjs": "13.30.0",
+    "@dereekb/util": "13.30.0",
     "@nestjs/common": "^11.1.19",
     "arktype": "^2.2.0",
     "jiti": "2.6.1",

package/route/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/dbx-cli/route",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/date": "13.28.0",
-    "@dereekb/dbx-cli": "13.28.0",
-    "@dereekb/firebase": "13.28.0",
-    "@dereekb/model": "13.28.0",
-    "@dereekb/nestjs": "13.28.0",
-    "@dereekb/util": "13.28.0"
+    "@dereekb/date": "13.30.0",
+    "@dereekb/dbx-cli": "13.30.0",
+    "@dereekb/firebase": "13.30.0",
+    "@dereekb/model": "13.30.0",
+    "@dereekb/nestjs": "13.30.0",
+    "@dereekb/util": "13.30.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/src/lib/mcp-scan/registry/auth-builtin.d.ts

@@ -42,9 +42,8 @@ export declare const BUILTIN_AUTH_ROLES: readonly AuthRoleInfo[];
  */
 export declare const BUILTIN_AUTH_CLAIMS: readonly AuthClaimInfo[];
 /**
- * The five callModel CRUD scopes enforced by
- * {@link oidcCallModelScopePreAssert}. App-specific scopes live in the
- * downstream catalog layer.
+ * The five callModel CRUD scopes enforced by {@link assertModelApiOidcScope} at
+ * the model-api layer. App-specific scopes live in the downstream catalog layer.
  */
 export declare const BUILTIN_AUTH_SCOPES: readonly AuthScopeInfo[];
 /**

package/src/lib/mcp-scan/registry/auth-runtime.d.ts

@@ -15,7 +15,7 @@
  *
  *   - **scopes** — OAuth/OIDC scope names (`model.read`, `model.write`, …)
  *     surfaced through the OIDC bridge, plus the source location where each
- *     scope is enforced (e.g. `oidcCallModelScopePreAssert`).
+ *     scope is enforced (e.g. `assertModelApiOidcScope`).
  *
  *   - **apps**   — one entry per downstream app (demo-api, hellosubs-api).
  *     Bundles the claims interface name, the claims-service constant name,
@@ -162,13 +162,13 @@ export interface AuthClaimInfo {
 /**
  * Where a scope is enforced. Multiple entries are allowed when a scope is
  * checked in more than one place (e.g. `model.read` is enforced by the
- * callModel preAssert and by per-app middleware).
+ * model-api scope gate and by per-app middleware).
  */
 export interface AuthScopeEnforcementInfo {
     readonly path: string;
     readonly line?: number;
     /**
-     * One-line description of the gate (e.g. `'oidcCallModelScopePreAssert'`).
+     * One-line description of the gate (e.g. `'assertModelApiOidcScope'`).
      */
     readonly description: string;
 }

package/test/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/dbx-cli/test",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "peerDependencies": {
-    "@dereekb/date": "13.28.0",
-    "@dereekb/dbx-cli": "13.28.0",
-    "@dereekb/firebase": "13.28.0",
-    "@dereekb/firebase-server/test": "13.28.0",
-    "@dereekb/model": "13.28.0",
-    "@dereekb/nestjs": "13.28.0",
-    "@dereekb/rxjs": "13.28.0",
-    "@dereekb/util": "13.28.0",
+    "@dereekb/date": "13.30.0",
+    "@dereekb/dbx-cli": "13.30.0",
+    "@dereekb/firebase": "13.30.0",
+    "@dereekb/firebase-server/test": "13.30.0",
+    "@dereekb/model": "13.30.0",
+    "@dereekb/nestjs": "13.30.0",
+    "@dereekb/rxjs": "13.30.0",
+    "@dereekb/util": "13.30.0",
     "@nestjs/common": "^11.1.19",
     "arktype": "^2.2.0",
     "vitest": "4.1.5",