@dereekb/firebase-server 13.11.14 → 13.11.15

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.11.14",
+  "version": "13.11.15",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.14",
-    "@dereekb/date": "13.11.14",
-    "@dereekb/firebase": "13.11.14",
-    "@dereekb/firebase-server": "13.11.14",
-    "@dereekb/model": "13.11.14",
-    "@dereekb/nestjs": "13.11.14",
-    "@dereekb/rxjs": "13.11.14",
-    "@dereekb/util": "13.11.14",
-    "@dereekb/zoho": "13.11.14",
+    "@dereekb/analytics": "13.11.15",
+    "@dereekb/date": "13.11.15",
+    "@dereekb/firebase": "13.11.15",
+    "@dereekb/firebase-server": "13.11.15",
+    "@dereekb/model": "13.11.15",
+    "@dereekb/nestjs": "13.11.15",
+    "@dereekb/rxjs": "13.11.15",
+    "@dereekb/util": "13.11.15",
+    "@dereekb/zoho": "13.11.15",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",

package/oidc/src/lib/controller/oidc.interaction.controller.d.ts

@@ -21,51 +21,72 @@ export declare class OidcInteractionController {
     private readonly oidcService;
     constructor(oidcInteractionService: OidcInteractionService, oidcProviderConfigService: OidcProviderConfigService, accountService: OidcAccountService, oidcService: OidcService);
     /**
-     * GET /interaction/:uid
+     * GET /interaction/:uid.
      *
      * Detects the interaction type and redirects to the appropriate frontend page.
      *
-     * @param uid - the interaction UID from the URL path
-     * @param req - the incoming Express request
-     * @param res - the Express response used for redirecting
-     * @returns a redirect response to the appropriate frontend page
-     * @throws {HttpException} 404 when the interaction UID is not found or has expired.
+     * @param uid - The interaction UID from the URL path.
+     * @param req - The incoming Express request.
+     * @param res - The Express response used for redirecting.
+     * @returns A redirect response to the appropriate frontend page.
+     * @throws {HttpException} HTTP 404 when the interaction UID is not found or has expired.
      */
     getInteraction(uid: OidcInteractionUid, req: Request, res: Response): Promise<void>;
     /**
-     * POST /interaction/:uid/login
+     * POST /interaction/:uid/login.
      *
      * Verifies the Firebase Auth ID token sent by the frontend, extracts the
      * user's UID, and completes the oidc-provider login interaction.
      *
-     * @param uid - the interaction UID from the URL path
-     * @param body - the login request containing the Firebase ID token
-     * @param res - the Express response used for sending JSON
-     * @throws {HttpException} 401 when the Firebase ID token is invalid.
-     * @throws {HttpException} 400 when the login interaction cannot be completed.
+     * @param uid - The interaction UID from the URL path.
+     * @param body - The login request containing the Firebase ID token.
+     * @param res - The Express response used for sending JSON.
+     * @throws {HttpException} HTTP 401 when the Firebase ID token is invalid.
+     * @throws {HttpException} HTTP 400 when the login interaction cannot be completed.
      */
     postLogin(uid: OidcInteractionUid, body: OAuthInteractionLoginRequest, res: Response): Promise<void>;
     /**
-     * POST /interaction/:uid/consent
+     * POST /interaction/:uid/consent.
      *
      * Receives consent decision from frontend. Grants missing OIDC scopes and claims
      * when approved, or returns `access_denied` when rejected.
      *
-     * @param uid - the interaction UID from the URL path
-     * @param body - the consent request containing approval decision and Firebase ID token
-     * @param res - the Express response used for sending JSON
-     * @throws {HttpException} 400 when the consent interaction cannot be completed.
+     * @param uid - The interaction UID from the URL path.
+     * @param body - The consent request containing approval decision and Firebase ID token.
+     * @param res - The Express response used for sending JSON.
+     * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */
     postConsent(uid: OidcInteractionUid, body: OAuthInteractionConsentRequest, res: Response): Promise<void>;
     /**
      * Verifies a Firebase Auth ID token and returns the user's UID.
      *
-     * @param idToken - the Firebase Auth ID token to verify
-     * @returns the user's UID extracted from the decoded token
-     * @throws {HttpException} 401 when the token is invalid or expired.
+     * @param idToken - The Firebase Auth ID token to verify.
+     * @returns The user's UID extracted from the decoded token.
+     * @throws {HttpException} HTTP 401 when the token is invalid or expired.
      */
     private _verifyIdToken;
 }
+/**
+ * Inputs for {@link resolveEffectiveSubset}.
+ */
+export interface ResolveEffectiveSubsetInput {
+    /**
+     * Entries the OIDC prompt indicated were missing for this consent.
+     */
+    readonly missing: readonly string[];
+    /**
+     * Optional subset the caller wants to grant; each value must be in `missing` or `alreadyEncountered`.
+     */
+    readonly requestedSubset: readonly string[] | undefined;
+    /**
+     * Entries that must be granted whenever they appear in `missing`, regardless of `requestedSubset`.
+     */
+    readonly alwaysGranted?: readonly string[];
+    /**
+     * Entries the existing Grant has previously granted or rejected. Tolerated as no-ops on re-consent.
+     */
+    readonly alreadyEncountered?: readonly string[];
+}
 /**
  * Resolves the effective set to grant — and the complementary set to
  * reject — from a missing set, an optional caller-provided subset, an
@@ -82,13 +103,11 @@ export declare class OidcInteractionController {
  *   are not re-applied to the grant (no-op).
  * - Always-granted entries are union'd into `granted` (clamped to `missing`).
  *
- * @param missing - Entries the OIDC prompt indicated were missing for this consent.
- * @param requestedSubset - Optional subset the caller wants to grant; each value must be in `missing` or `alreadyEncountered`.
- * @param alwaysGranted - Entries that must be granted whenever they appear in `missing`, regardless of `requestedSubset`.
- * @param alreadyEncountered - Entries the existing Grant has previously granted or rejected. Tolerated as no-ops on re-consent.
+ * @param input - Missing entries plus optional subset, always-granted, and already-encountered lists.
  * @returns `granted` to add to the grant and `rejected` to record on the grant.
+ * @throws {HttpException} `400 BAD_REQUEST` when `requestedSubset` includes a value that is neither missing nor already-encountered.
  */
-export declare function resolveEffectiveSubset(missing: readonly string[], requestedSubset: readonly string[] | undefined, alwaysGranted?: readonly string[], alreadyEncountered?: readonly string[]): {
+export declare function resolveEffectiveSubset(input: ResolveEffectiveSubsetInput): {
     granted: string[];
     rejected: string[];
 };

package/oidc/src/lib/controller/oidc.provider.controller.d.ts

@@ -17,7 +17,7 @@ export declare class OidcProviderController {
     private _callback;
     constructor(oidcService: OidcService, oidcProviderConfigService: OidcProviderConfigService);
     /**
-     * GET /oidc/login/client
+     * GET /oidc/login/client.
      *
      * Convenience redirect from the API issuer path back to the frontend app's
      * OAuth login page. Lets a user who lands on the API host get bounced to the

package/oidc/src/lib/controller/oidc.wellknown.controller.d.ts

@@ -15,7 +15,7 @@ export declare class OidcWellKnownController {
      * Returns the provider metadata so clients can auto-discover endpoints,
      * supported scopes, signing algorithms, etc.
      *
-     * @returns the OIDC discovery metadata document
+     * @returns The OIDC discovery metadata document.
      */
     getOpenIdConfiguration(): Promise<OidcDiscoveryMetadata>;
     /**
@@ -23,7 +23,7 @@ export declare class OidcWellKnownController {
      *
      * This endpoint is typically skipped if the JwksServiceStorageConfig is provided.
      *
-     * @returns the public JWKS containing all non-retired signing keys
+     * @returns The public JWKS containing all non-retired signing keys.
      */
     getJwks(): Promise<{
         keys: import("..").JsonWebKeyWithKid[];
@@ -34,7 +34,7 @@ export declare class OidcWellKnownController {
      * Returns the authorization server(s) that protect this resource,
      * allowing clients to discover which authorization server to use.
      *
-     * @returns the protected resource metadata with authorization server URLs
+     * @returns The protected resource metadata with authorization server URLs.
      */
     getProtectedResource(): {
         authorization_servers: string[];

package/oidc/src/lib/middleware/oauth-cors.module.d.ts

@@ -19,7 +19,7 @@ import { type INestApplication } from '@nestjs/common';
  * `/interaction/{uid}/*` POSTs carry the Firebase ID token in the JSON body, not in cookies, so
  * we keep the CORS surface minimal.
  *
- * @param nestApp - the NestJS application to configure.
+ * @param nestApp - The NestJS application to configure.
  *
  * @example
  * ```ts

package/oidc/src/lib/model/jwks/jwks.d.ts

@@ -86,15 +86,15 @@ export interface JwksKeyConverterConfig {
  *
  * Requires runtime encryption config since the private key field is encrypted at rest.
  *
- * @param config - encryption configuration for the private key field
- * @returns snapshot converter functions for JwksKey documents
+ * @param config - Encryption configuration for the private key field.
+ * @returns Snapshot converter functions for JwksKey documents.
  */
 export declare function jwksKeyConverter(config: JwksKeyConverterConfig): import("@dereekb/firebase").SnapshotConverterFunctions<JwksKey, Partial<import("@dereekb/util").ReplaceType<JwksKey, import("@dereekb/util").MaybeMap<object>, any>>>;
 /**
  * Returns the Firestore {@link CollectionReference} for {@link JwksKey} documents.
  *
- * @param context - the Firestore context to create the collection reference from
- * @returns the typed collection reference for JwksKey documents
+ * @param context - The Firestore context to create the collection reference from.
+ * @returns The typed collection reference for JwksKey documents.
  */
 export declare function jwksKeyCollectionReference(context: FirestoreContext): CollectionReference<JwksKey>;
 /**
@@ -110,7 +110,7 @@ export interface JwksKeyFirestoreCollectionConfig extends JwksKeyConverterConfig
 /**
  * Creates a {@link JwksKeyFirestoreCollection} with encrypted private key field support.
  *
- * @param config - configuration including the Firestore context and encryption settings
- * @returns the configured JwksKey Firestore collection
+ * @param config - Configuration including the Firestore context and encryption settings.
+ * @returns The configured JwksKey Firestore collection.
  */
 export declare function jwksKeyFirestoreCollection(config: JwksKeyFirestoreCollectionConfig): JwksKeyFirestoreCollection;

package/oidc/src/lib/model/jwks/jwks.query.d.ts

@@ -3,25 +3,25 @@ import { type JwksKeyStatus } from './jwks';
 /**
  * Query for JwksKey documents with a specific status.
  *
- * @param status - the lifecycle status to filter by
- * @returns Firestore query constraints filtering by the given status
+ * @param status - The lifecycle status to filter by.
+ * @returns Firestore query constraints filtering by the given status.
  */
 export declare function jwksKeysWithStatusQuery(status: JwksKeyStatus): FirestoreQueryConstraint[];
 /**
  * Query for active JwksKey documents.
  *
- * @returns Firestore query constraints filtering for active keys
+ * @returns Firestore query constraints filtering for active keys.
  */
 export declare function activeJwksKeysQuery(): FirestoreQueryConstraint[];
 /**
  * Query for non-retired JwksKey documents (active + rotated).
  *
- * @returns Firestore query constraints filtering for non-retired keys
+ * @returns Firestore query constraints filtering for non-retired keys.
  */
 export declare function nonRetiredJwksKeysQuery(): FirestoreQueryConstraint[];
 /**
  * Query for rotated JwksKey documents.
  *
- * @returns Firestore query constraints filtering for rotated keys
+ * @returns Firestore query constraints filtering for rotated keys.
  */
 export declare function rotatedJwksKeysQuery(): FirestoreQueryConstraint[];

package/oidc/src/lib/model/oidc/oidcmodel.action.server.d.ts

@@ -30,8 +30,8 @@ export declare abstract class OidcModelServerActions {
 /**
  * Creates a concrete {@link OidcModelServerActions} implementation wired to the provided context.
  *
- * @param context - the fully assembled OIDC model server actions context
- * @returns the concrete OidcModelServerActions instance
+ * @param context - The fully assembled OIDC model server actions context.
+ * @returns The concrete OidcModelServerActions instance.
  *
  * @example
  * ```ts
@@ -47,8 +47,8 @@ export declare function oidcModelServerActions(context: OidcModelServerActionsCo
  * Delegates to {@link OidcClientService.createClient} to generate a `client_id` and `client_secret`,
  * create the adapter entry, and return the secret in plaintext (only returned once).
  *
- * @param context - the OIDC model server actions context
- * @returns a transform function factory for creating OIDC clients
+ * @param context - The OIDC model server actions context.
+ * @returns A transform function factory for creating OIDC clients.
  */
 export declare function createOidcClientFactory(context: OidcModelServerActionsContext): import("@dereekb/model").TransformAndValidateFunctionResultFunction<CreateOidcClientParams, () => Promise<CreateOidcClientResult>, object, unknown>;
 /**
@@ -56,8 +56,8 @@ export declare function createOidcClientFactory(context: OidcModelServerActionsC
  *
  * Delegates to {@link OidcClientService.updateClient} to apply plaintext field updates.
  *
- * @param context - the OIDC model server actions context
- * @returns a transform function factory for updating OIDC clients
+ * @param context - The OIDC model server actions context.
+ * @returns A transform function factory for updating OIDC clients.
  */
 export declare function updateOidcClientFactory(context: OidcModelServerActionsContext): import("@dereekb/model").TransformAndValidateFunctionResultFunction<UpdateOidcClientParams, (document: OidcEntryDocument) => Promise<OidcEntryDocument>, object, unknown>;
 /**
@@ -66,8 +66,8 @@ export declare function updateOidcClientFactory(context: OidcModelServerActionsC
  * Delegates to {@link OidcClientService.rotateClientSecret} to generate a new secret
  * and return it in plaintext (only returned once).
  *
- * @param context - the OIDC model server actions context
- * @returns a transform function factory for rotating OIDC client secrets
+ * @param context - The OIDC model server actions context.
+ * @returns A transform function factory for rotating OIDC client secrets.
  */
 export declare function rotateOidcClientSecretFactory(context: OidcModelServerActionsContext): import("@dereekb/model").TransformAndValidateFunctionResultFunction<import("@dereekb/firebase").TargetModelParams, (document: OidcEntryDocument) => Promise<RotateOidcClientSecretResult>, object, unknown>;
 /**
@@ -75,8 +75,8 @@ export declare function rotateOidcClientSecretFactory(context: OidcModelServerAc
  *
  * Delegates to {@link OidcClientService.deleteClient}.
  *
- * @param context - the OIDC model server actions context
- * @returns a transform function factory for deleting OIDC clients
+ * @param context - The OIDC model server actions context.
+ * @returns A transform function factory for deleting OIDC clients.
  */
 export declare function deleteOidcClientFactory(context: OidcModelServerActionsContext): import("@dereekb/model").TransformAndValidateFunctionResultFunction<import("@dereekb/firebase").TargetModelParams, (document: OidcEntryDocument) => Promise<void>, object, unknown>;
 /**
@@ -90,7 +90,7 @@ export declare function deleteOidcClientFactory(context: OidcModelServerActionsC
  * Per-user authorization (this user owns this Grant) is enforced upstream via the
  * model permission service before this action runs.
  *
- * @param context - the OIDC model server actions context
- * @returns a transform function factory for revoking OIDC grants
+ * @param context - The OIDC model server actions context.
+ * @returns A transform function factory for revoking OIDC grants.
  */
 export declare function deleteOidcTokenFactory(context: OidcModelServerActionsContext): import("@dereekb/model").TransformAndValidateFunctionResultFunction<import("@dereekb/firebase").TargetModelParams, (document: OidcEntryDocument) => Promise<void>, object, unknown>;

package/oidc/src/lib/model/oidc/oidcmodel.module.d.ts

@@ -5,9 +5,9 @@ import { OidcService } from '../../service/oidc.service';
 /**
  * Factory that creates an {@link OidcModelServerActions} instance from the injected services.
  *
- * @param oidcClientService - the OIDC client service for client CRUD actions
- * @param oidcService - the core OIDC service for grant revocation
- * @returns the configured OidcModelServerActions instance
+ * @param oidcClientService - The OIDC client service for client CRUD actions.
+ * @param oidcService - The core OIDC service for grant revocation.
+ * @returns The configured OidcModelServerActions instance.
  */
 export declare function oidcModelServerActionsFactory(oidcClientService: OidcClientService, oidcService: OidcService): OidcModelServerActions;
 export interface ProvideAppOidcModelMetadataConfig {
@@ -24,7 +24,7 @@ export interface ProvideAppOidcModelMetadataConfig {
  * By default this module exports:
  * - OidcModelServerActions
  *
- * @param config - the configuration specifying the OIDC module dependency
- * @returns the NestJS module metadata for the OidcModel module
+ * @param config - The configuration specifying the OIDC module dependency.
+ * @returns The NestJS module metadata for the OidcModel module.
  */
 export declare function appOidcModelModuleMetadata(config: ProvideAppOidcModelMetadataConfig): ModuleMetadata;

package/oidc/src/lib/oidc.config.d.ts

@@ -245,7 +245,7 @@ export declare abstract class OidcModuleConfig {
      *
      * Called by {@link oidcModuleConfigFactory} after building the config from environment variables.
      *
-     * @param config - the config object to validate
+     * @param config - The config object to validate.
      * @throws {Error} When any required field (`issuer`, `appInteractionPath`, `appLoginUrlPart`, `appConsentUrlPart`, `jwksServiceConfig`, `jwksKeyConverterConfig`) is missing.
      */
     static assertValidConfig(config: Partial<OidcModuleConfig>): void;

package/oidc/src/lib/oidc.module.d.ts

@@ -68,9 +68,9 @@ export declare const FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE: strin
  * The issuer can also be overridden directly by passing `issuer` on the `config` block to
  * {@link oidcModuleMetadata}; the override wins over the factory-derived value.
  *
- * @param configService - the NestJS ConfigService for reading environment variables
- * @param envService - the Firebase server environment service for app URL and env detection
- * @returns the constructed OidcModuleConfig
+ * @param configService - The NestJS ConfigService for reading environment variables.
+ * @param envService - The Firebase server environment service for app URL and env detection.
+ * @returns The constructed OidcModuleConfig.
  * @throws {Error} When `appUrl` is missing, the resolved issuer lacks an HTTP prefix, or the encryption secret is invalid.
  */
 export declare function oidcModuleConfigFactory(configService: ConfigService, envService: FirebaseServerEnvService): OidcModuleConfig;
@@ -78,9 +78,9 @@ export declare function oidcModuleConfigFactory(configService: ConfigService, en
  * Factory that creates {@link OidcServerFirestoreCollections} using the provided Firestore context
  * and JWKS encryption config from {@link OidcModuleConfig}.
  *
- * @param firestoreContext - the Firestore context for collection creation
- * @param oidcModuleConfig - the OIDC module config containing JWKS encryption settings
- * @returns the configured OidcServerFirestoreCollections
+ * @param firestoreContext - The Firestore context for collection creation.
+ * @param oidcModuleConfig - The OIDC module config containing JWKS encryption settings.
+ * @returns The configured OidcServerFirestoreCollections.
  */
 export declare function oidcFirestoreCollectionsFactory(firestoreContext: FirestoreContext, oidcModuleConfig: OidcModuleConfig): OidcServerFirestoreCollections;
 export interface ProvideAppOidcModuleMetadataConfig extends Pick<ModuleMetadata, 'imports' | 'exports' | 'providers'> {
@@ -109,7 +109,7 @@ export interface ProvideAppOidcModuleMetadataConfig extends Pick<ModuleMetadata,
  * Additionally, the following may be optionally provided:
  * - JwksServiceStorageConfig
  *
- * @param metadataConfig - the configuration for generating the OIDC module metadata
- * @returns the NestJS module metadata for the OIDC module
+ * @param metadataConfig - The configuration for generating the OIDC module metadata.
+ * @returns The NestJS module metadata for the OIDC module.
  */
 export declare function oidcModuleMetadata(metadataConfig: ProvideAppOidcModuleMetadataConfig): ModuleMetadata;

package/oidc/src/lib/service/oidc.account.service.d.ts

@@ -79,7 +79,7 @@ export declare class OidcAccountServiceUserContext<S extends OidcScope = OidcSco
      * Returns an {@link OidcAccount} compatible with oidc-provider's `findAccount` interface,
      * or `undefined` if the user does not exist in Firebase Auth.
      *
-     * @returns the OIDC account for this user, or undefined if the user does not exist
+     * @returns The OIDC account for this user, or undefined if the user does not exist.
      */
     findAccount(): Promise<OidcAccount | undefined>;
 }
@@ -98,14 +98,14 @@ export declare class OidcAccountService<S extends OidcScope = OidcScope, U exten
     /**
      * The provider config from the delegate.
      *
-     * @returns the OIDC provider configuration from the delegate
+     * @returns The OIDC provider configuration from the delegate.
      */
     get providerConfig(): OidcProviderConfig<S>;
     /**
      * Creates a user context for the given user ID.
      *
-     * @param uid - the Firebase Auth user ID
-     * @returns a new user context bound to the given user
+     * @param uid - The Firebase Auth user ID.
+     * @returns A new user context bound to the given user.
      */
     userContext(uid: string): OidcAccountServiceUserContext<S, U>;
 }

package/oidc/src/lib/service/oidc.adapter.service.d.ts

@@ -13,14 +13,14 @@ export type GrantableModelName = (typeof GRANTABLE_MODEL_NAMES)[number];
  * Sensitive payload fields (`client_secret`, `registration_access_token`) are selectively
  * encrypted via the {@link OidcEncryptionService}.
  *
+ * @param collections - Firestore collection access for adapter entries.
+ * @param encryptionService - Encryption service for sensitive payload fields.
+ * @returns An oidc-provider adapter constructor backed by Firestore.
+ *
  * @example
  * ```ts
  * const adapter = createAdapterFactory(collections, encryptionService);
  * new Provider('issuer', { adapter });
  * ```
- *
- * @param collections - Firestore collection access for adapter entries.
- * @param encryptionService - Encryption service for sensitive payload fields.
- * @returns an oidc-provider adapter constructor backed by Firestore
  */
 export declare function createAdapterFactory(collections: OidcServerFirestoreCollections, encryptionService: OidcEncryptionService): AdapterConstructor;

package/oidc/src/lib/service/oidc.client.service.d.ts

@@ -33,7 +33,7 @@ export declare class OidcClientService {
      *
      * @param clientId - The client's document/adapter entry ID.
      * @param params - The fields to update.
-     * @throws When the client is not found.
+     * @throws {Error} When the client is not found.
      */
     updateClient(clientId: OidcEntryClientId, params: Omit<UpdateOidcClientParams, 'key'>): Promise<void>;
     /**
@@ -44,14 +44,14 @@ export declare class OidcClientService {
      *
      * @param clientId - The client's document/adapter entry ID.
      * @returns The client ID and new secret (plaintext, returned only once).
-     * @throws When the client is not found.
+     * @throws {Error} When the client is not found.
      */
     rotateClientSecret(clientId: OidcEntryClientId): Promise<RotateOidcClientSecretResult>;
     /**
      * Deletes an OIDC client through the oidc-provider adapter.
      *
      * @param clientId - The client's document/adapter entry ID.
-     * @throws When the client is not found.
+     * @throws {Error} When the client is not found.
      */
     deleteClient(clientId: OidcEntryClientId): Promise<void>;
 }

package/oidc/src/lib/service/oidc.config.service.d.ts

@@ -95,7 +95,7 @@ export declare class OidcProviderConfigService {
      *
      * @param jwksUri - Optional override for the JWKS URI (e.g., from cloud storage).
      *   Falls back to `{issuer}{routes.jwks}`.
-     * @returns the fully constructed OIDC discovery metadata
+     * @returns The fully constructed OIDC discovery metadata.
      */
     buildDiscoveryMetadata(jwksUri?: string): OidcDiscoveryMetadata;
 }

package/oidc/src/lib/service/oidc.encryption.service.d.ts

@@ -45,15 +45,15 @@ export declare class OidcEncryptionService {
      * Encrypts sensitive fields in an adapter payload and returns it as a {@link JsonSerializableObject}
      * suitable for storing directly in Firestore.
      *
-     * @param payload - the adapter payload to encrypt
-     * @returns the encrypted payload as a JSON-serializable object
+     * @param payload - The adapter payload to encrypt.
+     * @returns The encrypted payload as a JSON-serializable object.
      */
     encryptAdapterPayload(payload: AdapterPayload): JsonSerializableObject;
     /**
      * Decrypts sensitive fields in a Firestore-stored payload object back to an {@link AdapterPayload}.
      *
-     * @param payload - the encrypted Firestore-stored payload
-     * @returns the decrypted adapter payload
+     * @param payload - The encrypted Firestore-stored payload.
+     * @returns The decrypted adapter payload.
      */
     decryptAdapterPayload(payload: JsonSerializableObject): AdapterPayload;
 }

package/oidc/src/lib/service/oidc.interaction.service.d.ts

@@ -15,9 +15,9 @@ export declare class OidcInteractionService {
      *
      * Requires the oidc-provider interaction cookie to be present on the request.
      *
-     * @param req - the Express request containing the interaction cookie
-     * @param res - the Express response
-     * @returns the oidc-provider interaction details
+     * @param req - The Express request containing the interaction cookie.
+     * @param res - The Express response.
+     * @returns The oidc-provider interaction details.
      */
     getInteractionDetails(req: Request, res: Response): Promise<Interaction>;
     /**
@@ -27,8 +27,8 @@ export declare class OidcInteractionService {
      * This is necessary when the interaction cookie is scoped to a different path
      * (e.g., the frontend) and is not sent with backend API requests.
      *
-     * @param uid - the interaction UID to look up
-     * @returns the interaction details for the given UID
+     * @param uid - The interaction UID to look up.
+     * @returns The interaction details for the given UID.
      * @throws {Error} When the interaction is not found or has expired.
      */
     findInteractionByUid(uid: OidcInteractionUid): Promise<Interaction>;
@@ -38,10 +38,10 @@ export declare class OidcInteractionService {
      * Looks up the interaction directly by UID, applies the result, saves it,
      * and returns the `returnTo` URL for the client to redirect to.
      *
-     * @param uid - the interaction UID to complete
-     * @param result - the interaction results to apply
-     * @param options - optional settings for merging with the last submission
-     * @param options.mergeWithLastSubmission - whether to merge with the last submission (defaults to true)
+     * @param uid - The interaction UID to complete.
+     * @param result - The interaction results to apply.
+     * @param options - Optional settings for merging with the last submission.
+     * @param options.mergeWithLastSubmission - Whether to merge with the last submission (defaults to true)
      * @returns The `returnTo` URL that the client should redirect to.
      */
     finishInteractionByUid(uid: OidcInteractionUid, result: InteractionResults, options?: {
@@ -55,11 +55,11 @@ export declare class OidcInteractionService {
      * `dbx_session_ttl` request param when save is driven from a NestJS controller — see
      * {@link OidcService#resolveLoginDurationForGrant}).
      *
-     * @param grantId - the existing grant ID to look up, or undefined to create a new grant
-     * @param accountId - the account ID for creating a new grant
-     * @param clientId - the client ID for creating a new grant
-     * @param expiresInSeconds - optional TTL (seconds) to assign to a newly-created grant
-     * @returns the found or newly created grant
+     * @param grantId - The existing grant ID to look up, or undefined to create a new grant.
+     * @param accountId - The account ID for creating a new grant.
+     * @param clientId - The client ID for creating a new grant.
+     * @param expiresInSeconds - Optional TTL (seconds) to assign to a newly-created grant.
+     * @returns The found or newly created grant.
      */
     findOrCreateGrant(grantId: string | undefined, accountId: string, clientId: string, expiresInSeconds?: number): Promise<Grant>;
 }

package/oidc/src/lib/service/oidc.jwks.service.d.ts

@@ -75,13 +75,13 @@ export declare class JwksService {
      * Returns both the stored {@link JwksKey} and the unencrypted private JWK
      * so callers can use the signing key immediately without a decryption round-trip.
      *
-     * @returns the generated key pair result containing the stored JwksKey and signing key
+     * @returns The generated key pair result containing the stored JwksKey and signing key.
      */
     generateKeyPair(): Promise<GenerateKeyPairResult>;
     /**
      * Returns the currently active signing key's private JWK.
      *
-     * @returns the active signing key's private JWK, or undefined if no active key exists
+     * @returns The active signing key's private JWK, or undefined if no active key exists.
      */
     getActiveSigningKey(): Promise<JsonWebKeyWithKid | undefined>;
     /**
@@ -93,13 +93,13 @@ export declare class JwksService {
      * Returns undefined if storage is not configured or `serveJwksFromStorage` is false.
      * Returns null if an error occured while trying to setup.
      *
-     * @returns the public URL, or null/undefined if unavailable
+     * @returns The public URL, or null/undefined if unavailable.
      */
     getJwksStoragePublicUrl(): Promise<Maybe<WebsiteUrlWithPrefix>>;
     /**
      * Returns the public JWKS (all non-retired keys) by querying Firestore.
      *
-     * @returns the public JWKS containing all non-retired signing keys
+     * @returns The public JWKS containing all non-retired signing keys.
      */
     getLatestPublicJwks(): Promise<{
         keys: JsonWebKeyWithKid[];
@@ -107,7 +107,7 @@ export declare class JwksService {
     /**
      * Rotates keys: marks the current active key as rotated and generates a new active key.
      *
-     * @returns the newly generated active JwksKey
+     * @returns The newly generated active JwksKey.
      */
     rotateKeys(): Promise<JwksKey>;
     private _initializeKeysAndCloud;
@@ -115,7 +115,7 @@ export declare class JwksService {
     /**
      * Retires rotated keys whose expiresAt has passed.
      *
-     * @returns the number of keys retired
+     * @returns The number of keys retired.
      */
     retireExpiredKeys(): Promise<number>;
 }

package/oidc/src/lib/service/oidc.service.d.ts

@@ -24,7 +24,7 @@ export declare class OidcService {
     /**
      * Returns the oidc-provider instance, initializing it on first access.
      *
-     * @returns the lazily-initialized oidc-provider instance
+     * @returns The lazily-initialized oidc-provider instance.
      */
     getProvider(): Promise<Provider>;
     /**
@@ -63,8 +63,8 @@ export declare class OidcService {
      * referencing the grant is gone — `verifyAccessToken` returns `undefined`
      * and a `grant_type=refresh_token` exchange fails with `invalid_grant`.
      *
-     * @param grantId - the grant id (and Grant adapter entry id) to revoke
-     * @throws when the Grant entry does not exist
+     * @param grantId - The grant id (and Grant adapter entry id) to revoke.
+     * @throws {Error} When the Grant entry does not exist.
      */
     revokeGrant(grantId: string): Promise<void>;
     /**
@@ -81,8 +81,8 @@ export declare class OidcService {
      * Does NOT include `adapter`, `findAccount`, or `jwks` — those require async
      * setup and are handled by {@link OidcService}.
      *
-     * @param cookieKeys - the signing keys for oidc-provider session cookies
-     * @returns the oidc-provider configuration options
+     * @param cookieKeys - The signing keys for oidc-provider session cookies.
+     * @returns The oidc-provider configuration options.
      */
     buildProviderConfiguration(cookieKeys: string[]): Configuration;
     private _buildProvider;