@dereekb/firebase-server 13.11.8 → 13.11.10

package/index.cjs.js

@@ -35,7 +35,7 @@ function _define_property$z(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$j(target) {
+function _object_spread$l(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -102,7 +102,7 @@ function _type_of$7(obj) {
  */ function unauthenticatedError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('unauthenticated', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'unauthenticated', _object_spread_props$e(_object_spread$j({
+    return new https.HttpsError('unauthenticated', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'unauthenticated', _object_spread_props$e(_object_spread$l({
         status: 401,
         code: firebase.UNAUTHENTICATED_ERROR_CODE
     }, serverError), {
@@ -117,7 +117,7 @@ function _type_of$7(obj) {
  */ function forbiddenError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'forbidden', _object_spread_props$e(_object_spread$j({
+    return new https.HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'forbidden', _object_spread_props$e(_object_spread$l({
         status: 403,
         code: firebase.FORBIDDEN_ERROR_CODE
     }, serverError), {
@@ -132,7 +132,7 @@ function _type_of$7(obj) {
  */ function permissionDeniedError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'permission denied', _object_spread_props$e(_object_spread$j({
+    return new https.HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'permission denied', _object_spread_props$e(_object_spread$l({
         status: 403,
         code: firebase.PERMISSION_DENIED_ERROR_CODE
     }, serverError), {
@@ -147,7 +147,7 @@ function _type_of$7(obj) {
  */ function notFoundError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'not found', _object_spread_props$e(_object_spread$j({
+    return new https.HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'not found', _object_spread_props$e(_object_spread$l({
         status: 404,
         code: firebase.NOT_FOUND_ERROR_CODE
     }, serverError), {
@@ -162,7 +162,7 @@ function _type_of$7(obj) {
  */ function modelNotAvailableError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'model was not available', _object_spread_props$e(_object_spread$j({
+    return new https.HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'model was not available', _object_spread_props$e(_object_spread$l({
         status: 404,
         code: firebase.MODEL_NOT_AVAILABLE_ERROR_CODE
     }, serverError), {
@@ -177,7 +177,7 @@ function _type_of$7(obj) {
  */ function badRequestError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('invalid-argument', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'bad request', _object_spread_props$e(_object_spread$j({
+    return new https.HttpsError('invalid-argument', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'bad request', _object_spread_props$e(_object_spread$l({
         status: 400,
         code: firebase.BAD_REQUEST_ERROR_CODE
     }, serverError), {
@@ -192,7 +192,7 @@ function _type_of$7(obj) {
  */ function preconditionConflictError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('failed-precondition', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'conflict', _object_spread_props$e(_object_spread$j({
+    return new https.HttpsError('failed-precondition', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'conflict', _object_spread_props$e(_object_spread$l({
         status: 409,
         code: firebase.CONFLICT_ERROR_CODE
     }, serverError), {
@@ -207,7 +207,7 @@ function _type_of$7(obj) {
  */ function alreadyExistsError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('already-exists', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'already exists', _object_spread_props$e(_object_spread$j({
+    return new https.HttpsError('already-exists', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'already exists', _object_spread_props$e(_object_spread$l({
         status: 409,
         code: firebase.ALREADY_EXISTS_ERROR_CODE
     }, serverError), {
@@ -222,7 +222,7 @@ function _type_of$7(obj) {
  */ function unavailableError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('unavailable', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'service unavailable', _object_spread_props$e(_object_spread$j({
+    return new https.HttpsError('unavailable', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'service unavailable', _object_spread_props$e(_object_spread$l({
         status: 503,
         code: firebase.UNAVAILABLE_ERROR_CODE
     }, serverError), {
@@ -237,7 +237,7 @@ function _type_of$7(obj) {
  */ function unavailableOrDeactivatedFunctionError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('unimplemented', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'the requested function is not available or has been deactivated for use', _object_spread_props$e(_object_spread$j({
+    return new https.HttpsError('unimplemented', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'the requested function is not available or has been deactivated for use', _object_spread_props$e(_object_spread$l({
         status: 501,
         code: firebase.UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE
     }, serverError), {
@@ -252,7 +252,7 @@ function _type_of$7(obj) {
  */ function internalServerError(messageOrError) {
     var _serverError_message;
     var serverError = util.partialServerError(messageOrError);
-    return new https.HttpsError('internal', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'internal error', _object_spread_props$e(_object_spread$j({
+    return new https.HttpsError('internal', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'internal error', _object_spread_props$e(_object_spread$l({
         status: 500,
         code: firebase.INTERNAL_SERVER_ERROR_CODE
     }, serverError), {
@@ -412,7 +412,11 @@ function _type_of$7(obj) {
  * Converts a Firebase Admin {@link admin.auth.DecodedIdToken} into a normalized {@link FirebaseAuthToken}.
  *
  * Maps Firebase Admin token fields (snake_case) to the application's token interface (camelCase),
- * including email, phone, and sign-in timestamps.
+ * including email, phone, and sign-in timestamps. `auth_time`/`iat` are Unix seconds per the
+ * Firebase Admin types, so they are converted to milliseconds before being formatted. Missing
+ * or non-finite values map to `undefined` (the {@link FirebaseAuthToken} fields are optional) —
+ * synthetic tokens built from OIDC bearer auth do not always carry those claims, and we must
+ * not throw `RangeError("Invalid time value")` from this path.
  *
  * @param token - The decoded ID token from Firebase Admin Auth.
  * @returns A normalized {@link FirebaseAuthToken} with camelCase fields.
@@ -427,10 +431,20 @@ function _type_of$7(obj) {
         email: token.email,
         emailVerified: token.email_verified,
         phoneNumber: token.phone_number,
-        lastSignInTime: new Date(token.auth_time).toISOString(),
-        lastRefreshTime: new Date(token.iat).toISOString()
+        lastSignInTime: toIsoStringFromUnixSeconds(token.auth_time),
+        lastRefreshTime: toIsoStringFromUnixSeconds(token.iat)
     };
 }
+function toIsoStringFromUnixSeconds(value) {
+    var result;
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        var date = new Date(value * 1000);
+        if (Number.isFinite(date.getTime())) {
+            result = date.toISOString();
+        }
+    }
+    return result;
+}
 
 function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -975,7 +989,7 @@ function _non_iterable_rest$4() {
 function _non_iterable_spread$a() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$i(target) {
+function _object_spread$k(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -1407,7 +1421,7 @@ function _ts_generator$g(thisArg, body) {
                 return _async_to_generator$g(function() {
                     var claims;
                     return _ts_generator$g(this, function(_state) {
-                        claims = _object_spread$i({}, claimsToRetain, this._claimsForRolesChange(_to_consumable_array$a(roles)));
+                        claims = _object_spread$k({}, claimsToRetain, this._claimsForRolesChange(_to_consumable_array$a(roles)));
                         return [
                             2,
                             this.setClaims(claims)
@@ -1451,7 +1465,7 @@ function _ts_generator$g(thisArg, body) {
                                 ];
                             case 1:
                                 currentClaims = _state.sent();
-                                newClaims = _object_spread$i({}, currentClaims, util.filterUndefinedValues(claims, false));
+                                newClaims = _object_spread$k({}, currentClaims, util.filterUndefinedValues(claims, false));
                                 newClaims = util.filterNullAndUndefinedValues(newClaims);
                                 return [
                                     2,
@@ -3220,7 +3234,7 @@ function _iterable_to_array$9(iter) {
 function _non_iterable_spread$9() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$h(target) {
+function _object_spread$j(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3277,7 +3291,7 @@ function _unsupported_iterable_to_array$d(o, minLen) {
         }
         return result;
     }
-    var updateData = _object_spread$h({}, createUpdatesWithArrayFunction(union, firestore.FieldValue.arrayUnion), createUpdatesWithArrayFunction(remove, firestore.FieldValue.arrayRemove));
+    var updateData = _object_spread$j({}, createUpdatesWithArrayFunction(union, firestore.FieldValue.arrayUnion), createUpdatesWithArrayFunction(remove, firestore.FieldValue.arrayRemove));
     return updateData;
 }
 
@@ -4127,7 +4141,7 @@ function _iterable_to_array$8(iter) {
 function _non_iterable_spread$8() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$g(target) {
+function _object_spread$i(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4240,7 +4254,7 @@ var _obj;
  * const queryDriver = googleCloudFirestoreQueryDriver();
  * ```
  */ function googleCloudFirestoreQueryDriver() {
-    return _object_spread_props$d(_object_spread$g({}, firestoreClientQueryConstraintFunctionsDriver()), {
+    return _object_spread_props$d(_object_spread$i({}, firestoreClientQueryConstraintFunctionsDriver()), {
         countDocs: function countDocs(query) {
             return query.count().get().then(function(x) {
                 return x.data().count;
@@ -5446,7 +5460,7 @@ function _define_property$q(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$f(target) {
+function _object_spread$h(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -5624,7 +5638,7 @@ function _object_spread_props$c(target, source) {
                 modelType: modelType,
                 specifier: specifier
             });
-            return crudFn(_object_spread_props$c(_object_spread$f({}, request), {
+            return crudFn(_object_spread_props$c(_object_spread$h({}, request), {
                 specifier: specifier,
                 data: request.data.data
             }));
@@ -6278,7 +6292,7 @@ function _inherits$2(subClass, superClass) {
     });
     if (superClass) _set_prototype_of$2(subClass, superClass);
 }
-function _object_spread$e(target) {
+function _object_spread$g(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -6359,7 +6373,7 @@ function _is_native_reflect_construct$2() {
         {
             key: "handleOnCallAnalyticsEvent",
             value: function handleOnCallAnalyticsEvent(event) {
-                var properties = _object_spread$e(_object_spread_props$b(_object_spread$e({}, analytics.asAnalyticsEventData(event.properties)), {
+                var properties = _object_spread$g(_object_spread_props$b(_object_spread$g({}, analytics.asAnalyticsEventData(event.properties)), {
                     call: event.call,
                     modelType: event.modelType,
                     lifecycle: event.lifecycle
@@ -6489,7 +6503,7 @@ function _define_property$o(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$d(target) {
+function _object_spread$f(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -6570,7 +6584,7 @@ exports.FirebaseServerAuthModule = __decorate([
  */ function provideFirebaseServerAuthService(provider) {
     var _provider_inject;
     return [
-        _object_spread_props$a(_object_spread$d({}, provider), {
+        _object_spread_props$a(_object_spread$f({}, provider), {
             inject: (_provider_inject = provider.inject) !== null && _provider_inject !== void 0 ? _provider_inject : [
                 FIREBASE_AUTH_TOKEN
             ]
@@ -6771,7 +6785,7 @@ function _define_property$n(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$c(target) {
+function _object_spread$e(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -6816,7 +6830,7 @@ function _object_spread_props$9(target, source) {
  * @param request - The base request to augment (must include the nestApplication reference).
  * @returns A new object combining the request properties with the nest context.
  */ function injectNestIntoRequest(nest, request) {
-    return _object_spread_props$9(_object_spread$c({}, request), {
+    return _object_spread_props$9(_object_spread$e({}, request), {
         nest: nest
     });
 }
@@ -6830,7 +6844,7 @@ function _object_spread_props$9(target, source) {
  * @param request - The base request to augment.
  * @returns A new object combining the request properties with the application context.
  */ function injectNestApplicationContextIntoRequest(nestContext, request) {
-    return _object_spread_props$9(_object_spread$c({}, request), {
+    return _object_spread_props$9(_object_spread$e({}, request), {
         nestApplication: nestContext
     });
 }
@@ -6895,6 +6909,21 @@ function _define_property$m(obj, key, value) {
     }
     return obj;
 }
+function _object_spread$d(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$m(target, key, source[key]);
+        });
+    }
+    return target;
+}
 function _ts_generator$a(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -7053,14 +7082,17 @@ function _ts_generator$a(thisArg, body) {
      * @returns The handler's return value.
      */ function dispatch(params, auth, rawRequest) {
                 return _async_to_generator$a(function() {
-                    var _auth_oidcValidatedToken, callableRequest, appRequest, contextRequest;
+                    var _auth_token, _auth_oidcValidatedToken, callableRequest, appRequest, contextRequest;
                     return _ts_generator$a(this, function(_state) {
-                        // Build a synthetic CallableRequest that the dispatch chain expects
+                        // Build a synthetic CallableRequest that the dispatch chain expects. Layer the
+                        // OIDC-validated claim subset over the base token so standard JWT claims
+                        // (`iat`, `auth_time`, `email`, …) survive — the callModel chain and any
+                        // `authContextInfo` consumer downstream rely on them being present.
                         callableRequest = {
                             data: params,
                             auth: auth ? {
                                 uid: auth.uid,
-                                token: (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : {}
+                                token: _object_spread$d({}, (_auth_token = auth.token) !== null && _auth_token !== void 0 ? _auth_token : {}, (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : {})
                             } : undefined,
                             rawRequest: rawRequest,
                             acceptsStreaming: false
@@ -7156,6 +7188,21 @@ function _define_property$l(obj, key, value) {
     }
     return obj;
 }
+function _object_spread$c(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$l(target, key, source[key]);
+        });
+    }
+    return target;
+}
 function _ts_generator$9(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -7410,17 +7457,26 @@ function _ts_generator$9(thisArg, body) {
      * Builds an {@link AuthDataRef} compatible with `useModel()` from the HTTP request auth.
      *
      * Uses the same synthetic auth pattern as {@link ModelApiDispatchService.dispatch}.
+     * The OIDC-validated claim subset is layered over the base token so the synthetic
+     * `auth.token` keeps standard JWT claims (`iat`, `auth_time`, `email`, …) that
+     * downstream consumers like `authContextInfo` rely on.
      *
      * @param auth - The Firebase server auth data from the HTTP request, or undefined for unauthenticated requests.
      * @returns An object containing a synthetic {@link AuthData} for use with `useModel()`, or undefined auth.
      */ key: "_makeAuthRef",
             value: function _makeAuthRef(auth) {
-                var _ref, _auth_oidcValidatedToken;
-                return {
-                    auth: auth ? {
+                var synthetic;
+                if (auth) {
+                    var _auth_token, _auth_oidcValidatedToken;
+                    var baseToken = (_auth_token = auth.token) !== null && _auth_token !== void 0 ? _auth_token : {};
+                    var oidcToken = (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : {};
+                    synthetic = {
                         uid: auth.uid,
-                        token: (_ref = (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : auth.token) !== null && _ref !== void 0 ? _ref : {}
-                    } : undefined
+                        token: _object_spread$c({}, baseToken, oidcToken)
+                    };
+                }
+                return {
+                    auth: synthetic
                 };
             }
         }

package/index.esm.js

@@ -33,7 +33,7 @@ function _define_property$z(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$j(target) {
+function _object_spread$l(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -100,7 +100,7 @@ function _type_of$7(obj) {
  */ function unauthenticatedError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('unauthenticated', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'unauthenticated', _object_spread_props$e(_object_spread$j({
+    return new HttpsError('unauthenticated', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'unauthenticated', _object_spread_props$e(_object_spread$l({
         status: 401,
         code: UNAUTHENTICATED_ERROR_CODE
     }, serverError), {
@@ -115,7 +115,7 @@ function _type_of$7(obj) {
  */ function forbiddenError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'forbidden', _object_spread_props$e(_object_spread$j({
+    return new HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'forbidden', _object_spread_props$e(_object_spread$l({
         status: 403,
         code: FORBIDDEN_ERROR_CODE
     }, serverError), {
@@ -130,7 +130,7 @@ function _type_of$7(obj) {
  */ function permissionDeniedError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'permission denied', _object_spread_props$e(_object_spread$j({
+    return new HttpsError('permission-denied', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'permission denied', _object_spread_props$e(_object_spread$l({
         status: 403,
         code: PERMISSION_DENIED_ERROR_CODE
     }, serverError), {
@@ -145,7 +145,7 @@ function _type_of$7(obj) {
  */ function notFoundError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'not found', _object_spread_props$e(_object_spread$j({
+    return new HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'not found', _object_spread_props$e(_object_spread$l({
         status: 404,
         code: NOT_FOUND_ERROR_CODE
     }, serverError), {
@@ -160,7 +160,7 @@ function _type_of$7(obj) {
  */ function modelNotAvailableError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'model was not available', _object_spread_props$e(_object_spread$j({
+    return new HttpsError('not-found', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'model was not available', _object_spread_props$e(_object_spread$l({
         status: 404,
         code: MODEL_NOT_AVAILABLE_ERROR_CODE
     }, serverError), {
@@ -175,7 +175,7 @@ function _type_of$7(obj) {
  */ function badRequestError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('invalid-argument', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'bad request', _object_spread_props$e(_object_spread$j({
+    return new HttpsError('invalid-argument', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'bad request', _object_spread_props$e(_object_spread$l({
         status: 400,
         code: BAD_REQUEST_ERROR_CODE
     }, serverError), {
@@ -190,7 +190,7 @@ function _type_of$7(obj) {
  */ function preconditionConflictError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('failed-precondition', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'conflict', _object_spread_props$e(_object_spread$j({
+    return new HttpsError('failed-precondition', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'conflict', _object_spread_props$e(_object_spread$l({
         status: 409,
         code: CONFLICT_ERROR_CODE
     }, serverError), {
@@ -205,7 +205,7 @@ function _type_of$7(obj) {
  */ function alreadyExistsError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('already-exists', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'already exists', _object_spread_props$e(_object_spread$j({
+    return new HttpsError('already-exists', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'already exists', _object_spread_props$e(_object_spread$l({
         status: 409,
         code: ALREADY_EXISTS_ERROR_CODE
     }, serverError), {
@@ -220,7 +220,7 @@ function _type_of$7(obj) {
  */ function unavailableError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('unavailable', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'service unavailable', _object_spread_props$e(_object_spread$j({
+    return new HttpsError('unavailable', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'service unavailable', _object_spread_props$e(_object_spread$l({
         status: 503,
         code: UNAVAILABLE_ERROR_CODE
     }, serverError), {
@@ -235,7 +235,7 @@ function _type_of$7(obj) {
  */ function unavailableOrDeactivatedFunctionError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('unimplemented', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'the requested function is not available or has been deactivated for use', _object_spread_props$e(_object_spread$j({
+    return new HttpsError('unimplemented', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'the requested function is not available or has been deactivated for use', _object_spread_props$e(_object_spread$l({
         status: 501,
         code: UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE
     }, serverError), {
@@ -250,7 +250,7 @@ function _type_of$7(obj) {
  */ function internalServerError(messageOrError) {
     var _serverError_message;
     var serverError = partialServerError(messageOrError);
-    return new HttpsError('internal', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'internal error', _object_spread_props$e(_object_spread$j({
+    return new HttpsError('internal', (_serverError_message = serverError.message) !== null && _serverError_message !== void 0 ? _serverError_message : 'internal error', _object_spread_props$e(_object_spread$l({
         status: 500,
         code: INTERNAL_SERVER_ERROR_CODE
     }, serverError), {
@@ -410,7 +410,11 @@ function _type_of$7(obj) {
  * Converts a Firebase Admin {@link admin.auth.DecodedIdToken} into a normalized {@link FirebaseAuthToken}.
  *
  * Maps Firebase Admin token fields (snake_case) to the application's token interface (camelCase),
- * including email, phone, and sign-in timestamps.
+ * including email, phone, and sign-in timestamps. `auth_time`/`iat` are Unix seconds per the
+ * Firebase Admin types, so they are converted to milliseconds before being formatted. Missing
+ * or non-finite values map to `undefined` (the {@link FirebaseAuthToken} fields are optional) —
+ * synthetic tokens built from OIDC bearer auth do not always carry those claims, and we must
+ * not throw `RangeError("Invalid time value")` from this path.
  *
  * @param token - The decoded ID token from Firebase Admin Auth.
  * @returns A normalized {@link FirebaseAuthToken} with camelCase fields.
@@ -425,10 +429,20 @@ function _type_of$7(obj) {
         email: token.email,
         emailVerified: token.email_verified,
         phoneNumber: token.phone_number,
-        lastSignInTime: new Date(token.auth_time).toISOString(),
-        lastRefreshTime: new Date(token.iat).toISOString()
+        lastSignInTime: toIsoStringFromUnixSeconds(token.auth_time),
+        lastRefreshTime: toIsoStringFromUnixSeconds(token.iat)
     };
 }
+function toIsoStringFromUnixSeconds(value) {
+    var result;
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        var date = new Date(value * 1000);
+        if (Number.isFinite(date.getTime())) {
+            result = date.toISOString();
+        }
+    }
+    return result;
+}
 
 function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -973,7 +987,7 @@ function _non_iterable_rest$4() {
 function _non_iterable_spread$a() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$i(target) {
+function _object_spread$k(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -1405,7 +1419,7 @@ function _ts_generator$g(thisArg, body) {
                 return _async_to_generator$g(function() {
                     var claims;
                     return _ts_generator$g(this, function(_state) {
-                        claims = _object_spread$i({}, claimsToRetain, this._claimsForRolesChange(_to_consumable_array$a(roles)));
+                        claims = _object_spread$k({}, claimsToRetain, this._claimsForRolesChange(_to_consumable_array$a(roles)));
                         return [
                             2,
                             this.setClaims(claims)
@@ -1449,7 +1463,7 @@ function _ts_generator$g(thisArg, body) {
                                 ];
                             case 1:
                                 currentClaims = _state.sent();
-                                newClaims = _object_spread$i({}, currentClaims, filterUndefinedValues(claims, false));
+                                newClaims = _object_spread$k({}, currentClaims, filterUndefinedValues(claims, false));
                                 newClaims = filterNullAndUndefinedValues(newClaims);
                                 return [
                                     2,
@@ -3218,7 +3232,7 @@ function _iterable_to_array$9(iter) {
 function _non_iterable_spread$9() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$h(target) {
+function _object_spread$j(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3275,7 +3289,7 @@ function _unsupported_iterable_to_array$d(o, minLen) {
         }
         return result;
     }
-    var updateData = _object_spread$h({}, createUpdatesWithArrayFunction(union, FieldValue.arrayUnion), createUpdatesWithArrayFunction(remove, FieldValue.arrayRemove));
+    var updateData = _object_spread$j({}, createUpdatesWithArrayFunction(union, FieldValue.arrayUnion), createUpdatesWithArrayFunction(remove, FieldValue.arrayRemove));
     return updateData;
 }
 
@@ -4125,7 +4139,7 @@ function _iterable_to_array$8(iter) {
 function _non_iterable_spread$8() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$g(target) {
+function _object_spread$i(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4238,7 +4252,7 @@ var _obj;
  * const queryDriver = googleCloudFirestoreQueryDriver();
  * ```
  */ function googleCloudFirestoreQueryDriver() {
-    return _object_spread_props$d(_object_spread$g({}, firestoreClientQueryConstraintFunctionsDriver()), {
+    return _object_spread_props$d(_object_spread$i({}, firestoreClientQueryConstraintFunctionsDriver()), {
         countDocs: function countDocs(query) {
             return query.count().get().then(function(x) {
                 return x.data().count;
@@ -5444,7 +5458,7 @@ function _define_property$q(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$f(target) {
+function _object_spread$h(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -5622,7 +5636,7 @@ function _object_spread_props$c(target, source) {
                 modelType: modelType,
                 specifier: specifier
             });
-            return crudFn(_object_spread_props$c(_object_spread$f({}, request), {
+            return crudFn(_object_spread_props$c(_object_spread$h({}, request), {
                 specifier: specifier,
                 data: request.data.data
             }));
@@ -6276,7 +6290,7 @@ function _inherits$2(subClass, superClass) {
     });
     if (superClass) _set_prototype_of$2(subClass, superClass);
 }
-function _object_spread$e(target) {
+function _object_spread$g(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -6357,7 +6371,7 @@ function _is_native_reflect_construct$2() {
         {
             key: "handleOnCallAnalyticsEvent",
             value: function handleOnCallAnalyticsEvent(event) {
-                var properties = _object_spread$e(_object_spread_props$b(_object_spread$e({}, asAnalyticsEventData(event.properties)), {
+                var properties = _object_spread$g(_object_spread_props$b(_object_spread$g({}, asAnalyticsEventData(event.properties)), {
                     call: event.call,
                     modelType: event.modelType,
                     lifecycle: event.lifecycle
@@ -6487,7 +6501,7 @@ function _define_property$o(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$d(target) {
+function _object_spread$f(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -6568,7 +6582,7 @@ FirebaseServerAuthModule = __decorate([
  */ function provideFirebaseServerAuthService(provider) {
     var _provider_inject;
     return [
-        _object_spread_props$a(_object_spread$d({}, provider), {
+        _object_spread_props$a(_object_spread$f({}, provider), {
             inject: (_provider_inject = provider.inject) !== null && _provider_inject !== void 0 ? _provider_inject : [
                 FIREBASE_AUTH_TOKEN
             ]
@@ -6769,7 +6783,7 @@ function _define_property$n(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$c(target) {
+function _object_spread$e(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -6814,7 +6828,7 @@ function _object_spread_props$9(target, source) {
  * @param request - The base request to augment (must include the nestApplication reference).
  * @returns A new object combining the request properties with the nest context.
  */ function injectNestIntoRequest(nest, request) {
-    return _object_spread_props$9(_object_spread$c({}, request), {
+    return _object_spread_props$9(_object_spread$e({}, request), {
         nest: nest
     });
 }
@@ -6828,7 +6842,7 @@ function _object_spread_props$9(target, source) {
  * @param request - The base request to augment.
  * @returns A new object combining the request properties with the application context.
  */ function injectNestApplicationContextIntoRequest(nestContext, request) {
-    return _object_spread_props$9(_object_spread$c({}, request), {
+    return _object_spread_props$9(_object_spread$e({}, request), {
         nestApplication: nestContext
     });
 }
@@ -6893,6 +6907,21 @@ function _define_property$m(obj, key, value) {
     }
     return obj;
 }
+function _object_spread$d(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$m(target, key, source[key]);
+        });
+    }
+    return target;
+}
 function _ts_generator$a(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -7051,14 +7080,17 @@ function _ts_generator$a(thisArg, body) {
      * @returns The handler's return value.
      */ function dispatch(params, auth, rawRequest) {
                 return _async_to_generator$a(function() {
-                    var _auth_oidcValidatedToken, callableRequest, appRequest, contextRequest;
+                    var _auth_token, _auth_oidcValidatedToken, callableRequest, appRequest, contextRequest;
                     return _ts_generator$a(this, function(_state) {
-                        // Build a synthetic CallableRequest that the dispatch chain expects
+                        // Build a synthetic CallableRequest that the dispatch chain expects. Layer the
+                        // OIDC-validated claim subset over the base token so standard JWT claims
+                        // (`iat`, `auth_time`, `email`, …) survive — the callModel chain and any
+                        // `authContextInfo` consumer downstream rely on them being present.
                         callableRequest = {
                             data: params,
                             auth: auth ? {
                                 uid: auth.uid,
-                                token: (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : {}
+                                token: _object_spread$d({}, (_auth_token = auth.token) !== null && _auth_token !== void 0 ? _auth_token : {}, (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : {})
                             } : undefined,
                             rawRequest: rawRequest,
                             acceptsStreaming: false
@@ -7154,6 +7186,21 @@ function _define_property$l(obj, key, value) {
     }
     return obj;
 }
+function _object_spread$c(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$l(target, key, source[key]);
+        });
+    }
+    return target;
+}
 function _ts_generator$9(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -7408,17 +7455,26 @@ function _ts_generator$9(thisArg, body) {
      * Builds an {@link AuthDataRef} compatible with `useModel()` from the HTTP request auth.
      *
      * Uses the same synthetic auth pattern as {@link ModelApiDispatchService.dispatch}.
+     * The OIDC-validated claim subset is layered over the base token so the synthetic
+     * `auth.token` keeps standard JWT claims (`iat`, `auth_time`, `email`, …) that
+     * downstream consumers like `authContextInfo` rely on.
      *
      * @param auth - The Firebase server auth data from the HTTP request, or undefined for unauthenticated requests.
      * @returns An object containing a synthetic {@link AuthData} for use with `useModel()`, or undefined auth.
      */ key: "_makeAuthRef",
             value: function _makeAuthRef(auth) {
-                var _ref, _auth_oidcValidatedToken;
-                return {
-                    auth: auth ? {
+                var synthetic;
+                if (auth) {
+                    var _auth_token, _auth_oidcValidatedToken;
+                    var baseToken = (_auth_token = auth.token) !== null && _auth_token !== void 0 ? _auth_token : {};
+                    var oidcToken = (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : {};
+                    synthetic = {
                         uid: auth.uid,
-                        token: (_ref = (_auth_oidcValidatedToken = auth.oidcValidatedToken) !== null && _auth_oidcValidatedToken !== void 0 ? _auth_oidcValidatedToken : auth.token) !== null && _ref !== void 0 ? _ref : {}
-                    } : undefined
+                        token: _object_spread$c({}, baseToken, oidcToken)
+                    };
+                }
+                return {
+                    auth: synthetic
                 };
             }
         }

package/mailgun/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/mailgun",
-  "version": "13.11.8",
+  "version": "13.11.10",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.8",
-    "@dereekb/firebase": "13.11.8",
-    "@dereekb/firebase-server": "13.11.8",
-    "@dereekb/date": "13.11.8",
-    "@dereekb/nestjs": "13.11.8",
-    "@dereekb/model": "13.11.8",
-    "@dereekb/rxjs": "13.11.8",
-    "@dereekb/util": "13.11.8"
+    "@dereekb/analytics": "13.11.10",
+    "@dereekb/firebase": "13.11.10",
+    "@dereekb/firebase-server": "13.11.10",
+    "@dereekb/date": "13.11.10",
+    "@dereekb/nestjs": "13.11.10",
+    "@dereekb/model": "13.11.10",
+    "@dereekb/rxjs": "13.11.10",
+    "@dereekb/util": "13.11.10"
   },
   "exports": {
     "./package.json": "./package.json",

package/model/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.11.8",
+  "version": "13.11.10",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.8",
-    "@dereekb/date": "13.11.8",
-    "@dereekb/firebase": "13.11.8",
-    "@dereekb/firebase-server": "13.11.8",
-    "@dereekb/model": "13.11.8",
-    "@dereekb/nestjs": "13.11.8",
-    "@dereekb/rxjs": "13.11.8",
-    "@dereekb/util": "13.11.8",
+    "@dereekb/analytics": "13.11.10",
+    "@dereekb/date": "13.11.10",
+    "@dereekb/firebase": "13.11.10",
+    "@dereekb/firebase-server": "13.11.10",
+    "@dereekb/model": "13.11.10",
+    "@dereekb/nestjs": "13.11.10",
+    "@dereekb/rxjs": "13.11.10",
+    "@dereekb/util": "13.11.10",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.1",

package/oidc/index.cjs.js

@@ -5283,7 +5283,7 @@ function _ts_generator$2(thisArg, body) {
      * @throws {HttpException} 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var _ref, _ref1, _prompt_details_missingOIDCScope, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, redirectTo, interaction, prompt, params, session, clientId, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, missingOIDCScope, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, redirectTo1, err;
+                    var _ref, _ref1, _prompt_details_missingOIDCScope, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, redirectTo, interaction, prompt, params, session, clientId, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, encounteredOIDCScopes, missingOIDCScope, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, redirectTo1, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -5353,9 +5353,15 @@ function _ts_generator$2(thisArg, body) {
                                 ];
                             case 7:
                                 grant = _state.sent();
+                                // Encountered = scopes/claims already granted (or rejected) on the existing Grant. oidc-provider
+                                // excludes these from `missingOIDCScope` etc. when the consent prompt is re-shown via `prompt=consent`,
+                                // but the consent UI sources its checkbox list from the auth URL's `scope=` param (the full request set)
+                                // and re-submits them all. We accept already-encountered values as silent no-ops so a re-consent on a
+                                // client the user has previously authorized doesn't fail validation.
+                                encounteredOIDCScopes = grant.getOIDCScopeEncountered().split(' ').filter(Boolean);
                                 missingOIDCScope = (_prompt_details_missingOIDCScope = prompt.details.missingOIDCScope) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [];
                                 if (missingOIDCScope.length > 0) {
-                                    _resolveEffectiveSubset = resolveEffectiveSubset(missingOIDCScope, body.grantedOIDCScopes, ALWAYS_GRANTED_OIDC_SCOPES), granted = _resolveEffectiveSubset.granted, rejected = _resolveEffectiveSubset.rejected;
+                                    _resolveEffectiveSubset = resolveEffectiveSubset(missingOIDCScope, body.grantedOIDCScopes, ALWAYS_GRANTED_OIDC_SCOPES, encounteredOIDCScopes), granted = _resolveEffectiveSubset.granted, rejected = _resolveEffectiveSubset.rejected;
                                     if (granted.length > 0) {
                                         grant.addOIDCScope(granted.join(' '));
                                     }
@@ -5380,9 +5386,10 @@ function _ts_generator$2(thisArg, body) {
                                         }
                                     }
                                 }
+                                encounteredOIDCClaims = grant.getOIDCClaimsEncountered();
                                 missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details.missingOIDCClaims) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
                                 if (missingOIDCClaims.length > 0) {
-                                    _resolveEffectiveSubset1 = resolveEffectiveSubset(missingOIDCClaims, body.grantedOIDCClaims), granted1 = _resolveEffectiveSubset1.granted, rejected1 = _resolveEffectiveSubset1.rejected;
+                                    _resolveEffectiveSubset1 = resolveEffectiveSubset(missingOIDCClaims, body.grantedOIDCClaims, [], encounteredOIDCClaims), granted1 = _resolveEffectiveSubset1.granted, rejected1 = _resolveEffectiveSubset1.rejected;
                                     if (granted1.length > 0) {
                                         grant.addOIDCClaims(granted1);
                                     }
@@ -5397,7 +5404,8 @@ function _ts_generator$2(thisArg, body) {
                                         _step_value = _sliced_to_array(_step1.value, 2), indicator = _step_value[0], scopes = _step_value[1];
                                         ;
                                         requestedSubset = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator];
-                                        _resolveEffectiveSubset2 = resolveEffectiveSubset(scopes, requestedSubset), granted2 = _resolveEffectiveSubset2.granted, rejected2 = _resolveEffectiveSubset2.rejected;
+                                        encounteredResourceScopes = grant.getResourceScopeEncountered(indicator).split(' ').filter(Boolean);
+                                        _resolveEffectiveSubset2 = resolveEffectiveSubset(scopes, requestedSubset, [], encounteredResourceScopes), granted2 = _resolveEffectiveSubset2.granted, rejected2 = _resolveEffectiveSubset2.rejected;
                                         if (granted2.length > 0) {
                                             grant.addResourceScope(indicator, granted2.join(' '));
                                         }
@@ -5551,24 +5559,29 @@ exports.OidcInteractionController = __decorate([
 ], exports.OidcInteractionController);
 /**
  * Resolves the effective set to grant — and the complementary set to
- * reject — from a missing set, an optional caller-provided subset, and
- * an optional list of always-granted entries.
+ * reject — from a missing set, an optional caller-provided subset, an
+ * optional list of always-granted entries, and an optional list of
+ * already-encountered entries (granted or rejected on the existing Grant).
  *
- * Throws `400 BAD_REQUEST` if the requested subset contains entries that
- * are not in the missing set (no privilege escalation).
+ * Throws `400 BAD_REQUEST` if the requested subset contains an entry that
+ * is in neither the missing set nor the already-encountered set (no
+ * privilege escalation).
  *
  * - When `requestedSubset` is undefined → grants everything in `missing` (back-compat); rejects nothing.
- * - When `requestedSubset` is provided → grants exactly that subset; rejects every other missing entry so
- *   oidc-provider does not re-prompt for them.
+ * - When `requestedSubset` is provided → grants the intersection with `missing`; rejects every other missing
+ *   entry so oidc-provider does not re-prompt for them. Values in `alreadyEncountered` pass validation but
+ *   are not re-applied to the grant (no-op).
  * - Always-granted entries are union'd into `granted` (clamped to `missing`).
  *
  * @param missing - Entries the OIDC prompt indicated were missing for this consent.
- * @param requestedSubset - Optional subset the caller wants to grant; must be a subset of `missing`.
+ * @param requestedSubset - Optional subset the caller wants to grant; each value must be in `missing` or `alreadyEncountered`.
  * @param alwaysGranted - Entries that must be granted whenever they appear in `missing`, regardless of `requestedSubset`.
+ * @param alreadyEncountered - Entries the existing Grant has previously granted or rejected. Tolerated as no-ops on re-consent.
  * @returns `granted` to add to the grant and `rejected` to record on the grant.
  */ function resolveEffectiveSubset(missing, requestedSubset) {
-    var alwaysGranted = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : [];
+    var alwaysGranted = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : [], alreadyEncountered = arguments.length > 3 && arguments[3] !== void 0 ? arguments[3] : [];
     var missingSet = new Set(missing);
+    var encounteredSet = new Set(alreadyEncountered);
     var baseSelection;
     if (requestedSubset === undefined) {
         baseSelection = missing;
@@ -5577,7 +5590,7 @@ exports.OidcInteractionController = __decorate([
         try {
             for(var _iterator = requestedSubset[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                 var value = _step.value;
-                if (!missingSet.has(value)) {
+                if (!missingSet.has(value) && !encounteredSet.has(value)) {
                     throw new common.HttpException('Granted value "'.concat(value, '" is not in the requested set.'), common.HttpStatus.BAD_REQUEST);
                 }
             }
@@ -5595,7 +5608,11 @@ exports.OidcInteractionController = __decorate([
                 }
             }
         }
-        baseSelection = requestedSubset;
+        // Filter to `missing` only — already-encountered values pass validation but
+        // do not need to be re-applied (oidc-provider's Grant tracks them already).
+        baseSelection = requestedSubset.filter(function(value) {
+            return missingSet.has(value);
+        });
     }
     var grantedSet = new Set(baseSelection);
     var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
@@ -6582,6 +6599,7 @@ exports.oidcModelServerActions = oidcModelServerActions;
 exports.oidcModelServerActionsFactory = oidcModelServerActionsFactory;
 exports.oidcModuleConfigFactory = oidcModuleConfigFactory;
 exports.oidcModuleMetadata = oidcModuleMetadata;
+exports.resolveEffectiveSubset = resolveEffectiveSubset;
 exports.rotateOidcClientSecretFactory = rotateOidcClientSecretFactory;
 exports.rotatedJwksKeysQuery = rotatedJwksKeysQuery;
 exports.updateOidcClientFactory = updateOidcClientFactory;

package/oidc/index.esm.js

@@ -5281,7 +5281,7 @@ function _ts_generator$2(thisArg, body) {
      * @throws {HttpException} 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var _ref, _ref1, _prompt_details_missingOIDCScope, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, redirectTo, interaction, prompt, params, session, clientId, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, missingOIDCScope, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, redirectTo1, err;
+                    var _ref, _ref1, _prompt_details_missingOIDCScope, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, redirectTo, interaction, prompt, params, session, clientId, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, encounteredOIDCScopes, missingOIDCScope, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, redirectTo1, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -5351,9 +5351,15 @@ function _ts_generator$2(thisArg, body) {
                                 ];
                             case 7:
                                 grant = _state.sent();
+                                // Encountered = scopes/claims already granted (or rejected) on the existing Grant. oidc-provider
+                                // excludes these from `missingOIDCScope` etc. when the consent prompt is re-shown via `prompt=consent`,
+                                // but the consent UI sources its checkbox list from the auth URL's `scope=` param (the full request set)
+                                // and re-submits them all. We accept already-encountered values as silent no-ops so a re-consent on a
+                                // client the user has previously authorized doesn't fail validation.
+                                encounteredOIDCScopes = grant.getOIDCScopeEncountered().split(' ').filter(Boolean);
                                 missingOIDCScope = (_prompt_details_missingOIDCScope = prompt.details.missingOIDCScope) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [];
                                 if (missingOIDCScope.length > 0) {
-                                    _resolveEffectiveSubset = resolveEffectiveSubset(missingOIDCScope, body.grantedOIDCScopes, ALWAYS_GRANTED_OIDC_SCOPES), granted = _resolveEffectiveSubset.granted, rejected = _resolveEffectiveSubset.rejected;
+                                    _resolveEffectiveSubset = resolveEffectiveSubset(missingOIDCScope, body.grantedOIDCScopes, ALWAYS_GRANTED_OIDC_SCOPES, encounteredOIDCScopes), granted = _resolveEffectiveSubset.granted, rejected = _resolveEffectiveSubset.rejected;
                                     if (granted.length > 0) {
                                         grant.addOIDCScope(granted.join(' '));
                                     }
@@ -5378,9 +5384,10 @@ function _ts_generator$2(thisArg, body) {
                                         }
                                     }
                                 }
+                                encounteredOIDCClaims = grant.getOIDCClaimsEncountered();
                                 missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details.missingOIDCClaims) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
                                 if (missingOIDCClaims.length > 0) {
-                                    _resolveEffectiveSubset1 = resolveEffectiveSubset(missingOIDCClaims, body.grantedOIDCClaims), granted1 = _resolveEffectiveSubset1.granted, rejected1 = _resolveEffectiveSubset1.rejected;
+                                    _resolveEffectiveSubset1 = resolveEffectiveSubset(missingOIDCClaims, body.grantedOIDCClaims, [], encounteredOIDCClaims), granted1 = _resolveEffectiveSubset1.granted, rejected1 = _resolveEffectiveSubset1.rejected;
                                     if (granted1.length > 0) {
                                         grant.addOIDCClaims(granted1);
                                     }
@@ -5395,7 +5402,8 @@ function _ts_generator$2(thisArg, body) {
                                         _step_value = _sliced_to_array(_step1.value, 2), indicator = _step_value[0], scopes = _step_value[1];
                                         ;
                                         requestedSubset = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator];
-                                        _resolveEffectiveSubset2 = resolveEffectiveSubset(scopes, requestedSubset), granted2 = _resolveEffectiveSubset2.granted, rejected2 = _resolveEffectiveSubset2.rejected;
+                                        encounteredResourceScopes = grant.getResourceScopeEncountered(indicator).split(' ').filter(Boolean);
+                                        _resolveEffectiveSubset2 = resolveEffectiveSubset(scopes, requestedSubset, [], encounteredResourceScopes), granted2 = _resolveEffectiveSubset2.granted, rejected2 = _resolveEffectiveSubset2.rejected;
                                         if (granted2.length > 0) {
                                             grant.addResourceScope(indicator, granted2.join(' '));
                                         }
@@ -5549,24 +5557,29 @@ OidcInteractionController = __decorate([
 ], OidcInteractionController);
 /**
  * Resolves the effective set to grant — and the complementary set to
- * reject — from a missing set, an optional caller-provided subset, and
- * an optional list of always-granted entries.
+ * reject — from a missing set, an optional caller-provided subset, an
+ * optional list of always-granted entries, and an optional list of
+ * already-encountered entries (granted or rejected on the existing Grant).
  *
- * Throws `400 BAD_REQUEST` if the requested subset contains entries that
- * are not in the missing set (no privilege escalation).
+ * Throws `400 BAD_REQUEST` if the requested subset contains an entry that
+ * is in neither the missing set nor the already-encountered set (no
+ * privilege escalation).
  *
  * - When `requestedSubset` is undefined → grants everything in `missing` (back-compat); rejects nothing.
- * - When `requestedSubset` is provided → grants exactly that subset; rejects every other missing entry so
- *   oidc-provider does not re-prompt for them.
+ * - When `requestedSubset` is provided → grants the intersection with `missing`; rejects every other missing
+ *   entry so oidc-provider does not re-prompt for them. Values in `alreadyEncountered` pass validation but
+ *   are not re-applied to the grant (no-op).
  * - Always-granted entries are union'd into `granted` (clamped to `missing`).
  *
  * @param missing - Entries the OIDC prompt indicated were missing for this consent.
- * @param requestedSubset - Optional subset the caller wants to grant; must be a subset of `missing`.
+ * @param requestedSubset - Optional subset the caller wants to grant; each value must be in `missing` or `alreadyEncountered`.
  * @param alwaysGranted - Entries that must be granted whenever they appear in `missing`, regardless of `requestedSubset`.
+ * @param alreadyEncountered - Entries the existing Grant has previously granted or rejected. Tolerated as no-ops on re-consent.
  * @returns `granted` to add to the grant and `rejected` to record on the grant.
  */ function resolveEffectiveSubset(missing, requestedSubset) {
-    var alwaysGranted = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : [];
+    var alwaysGranted = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : [], alreadyEncountered = arguments.length > 3 && arguments[3] !== void 0 ? arguments[3] : [];
     var missingSet = new Set(missing);
+    var encounteredSet = new Set(alreadyEncountered);
     var baseSelection;
     if (requestedSubset === undefined) {
         baseSelection = missing;
@@ -5575,7 +5588,7 @@ OidcInteractionController = __decorate([
         try {
             for(var _iterator = requestedSubset[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                 var value = _step.value;
-                if (!missingSet.has(value)) {
+                if (!missingSet.has(value) && !encounteredSet.has(value)) {
                     throw new HttpException('Granted value "'.concat(value, '" is not in the requested set.'), HttpStatus.BAD_REQUEST);
                 }
             }
@@ -5593,7 +5606,11 @@ OidcInteractionController = __decorate([
                 }
             }
         }
-        baseSelection = requestedSubset;
+        // Filter to `missing` only — already-encountered values pass validation but
+        // do not need to be re-applied (oidc-provider's Grant tracks them already).
+        baseSelection = requestedSubset.filter(function(value) {
+            return missingSet.has(value);
+        });
     }
     var grantedSet = new Set(baseSelection);
     var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
@@ -6529,4 +6546,4 @@ function _unsupported_iterable_to_array(o, minLen) {
     return fn;
 }
 
-export { DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, oidcCallModelScopePreAssert, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };
+export { DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, oidcCallModelScopePreAssert, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, resolveEffectiveSubset, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.11.8",
+  "version": "13.11.10",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.8",
-    "@dereekb/date": "13.11.8",
-    "@dereekb/firebase": "13.11.8",
-    "@dereekb/firebase-server": "13.11.8",
-    "@dereekb/model": "13.11.8",
-    "@dereekb/nestjs": "13.11.8",
-    "@dereekb/rxjs": "13.11.8",
-    "@dereekb/util": "13.11.8",
-    "@dereekb/zoho": "13.11.8",
+    "@dereekb/analytics": "13.11.10",
+    "@dereekb/date": "13.11.10",
+    "@dereekb/firebase": "13.11.10",
+    "@dereekb/firebase-server": "13.11.10",
+    "@dereekb/model": "13.11.10",
+    "@dereekb/nestjs": "13.11.10",
+    "@dereekb/rxjs": "13.11.10",
+    "@dereekb/util": "13.11.10",
+    "@dereekb/zoho": "13.11.10",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",

package/oidc/src/lib/controller/oidc.interaction.controller.d.ts

@@ -66,3 +66,29 @@ export declare class OidcInteractionController {
      */
     private _verifyIdToken;
 }
+/**
+ * Resolves the effective set to grant — and the complementary set to
+ * reject — from a missing set, an optional caller-provided subset, an
+ * optional list of always-granted entries, and an optional list of
+ * already-encountered entries (granted or rejected on the existing Grant).
+ *
+ * Throws `400 BAD_REQUEST` if the requested subset contains an entry that
+ * is in neither the missing set nor the already-encountered set (no
+ * privilege escalation).
+ *
+ * - When `requestedSubset` is undefined → grants everything in `missing` (back-compat); rejects nothing.
+ * - When `requestedSubset` is provided → grants the intersection with `missing`; rejects every other missing
+ *   entry so oidc-provider does not re-prompt for them. Values in `alreadyEncountered` pass validation but
+ *   are not re-applied to the grant (no-op).
+ * - Always-granted entries are union'd into `granted` (clamped to `missing`).
+ *
+ * @param missing - Entries the OIDC prompt indicated were missing for this consent.
+ * @param requestedSubset - Optional subset the caller wants to grant; each value must be in `missing` or `alreadyEncountered`.
+ * @param alwaysGranted - Entries that must be granted whenever they appear in `missing`, regardless of `requestedSubset`.
+ * @param alreadyEncountered - Entries the existing Grant has previously granted or rejected. Tolerated as no-ops on re-consent.
+ * @returns `granted` to add to the grant and `rejected` to record on the grant.
+ */
+export declare function resolveEffectiveSubset(missing: readonly string[], requestedSubset: readonly string[] | undefined, alwaysGranted?: readonly string[], alreadyEncountered?: readonly string[]): {
+    granted: string[];
+    rejected: string[];
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.11.8",
+  "version": "13.11.10",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -44,15 +44,15 @@
   "main": "./index.cjs.js",
   "types": "./src/index.d.ts",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.8",
-    "@dereekb/date": "13.11.8",
-    "@dereekb/dbx-core": "13.11.8",
-    "@dereekb/firebase": "13.11.8",
-    "@dereekb/model": "13.11.8",
-    "@dereekb/nestjs": "13.11.8",
-    "@dereekb/rxjs": "13.11.8",
-    "@dereekb/util": "13.11.8",
-    "@dereekb/zoho": "13.11.8",
+    "@dereekb/analytics": "13.11.10",
+    "@dereekb/date": "13.11.10",
+    "@dereekb/dbx-core": "13.11.10",
+    "@dereekb/firebase": "13.11.10",
+    "@dereekb/model": "13.11.10",
+    "@dereekb/nestjs": "13.11.10",
+    "@dereekb/rxjs": "13.11.10",
+    "@dereekb/util": "13.11.10",
+    "@dereekb/zoho": "13.11.10",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",

package/src/lib/auth/auth.context.d.ts

@@ -14,7 +14,11 @@ export interface AuthDataRef<T extends AuthData = AuthData> {
  * Converts a Firebase Admin {@link admin.auth.DecodedIdToken} into a normalized {@link FirebaseAuthToken}.
  *
  * Maps Firebase Admin token fields (snake_case) to the application's token interface (camelCase),
- * including email, phone, and sign-in timestamps.
+ * including email, phone, and sign-in timestamps. `auth_time`/`iat` are Unix seconds per the
+ * Firebase Admin types, so they are converted to milliseconds before being formatted. Missing
+ * or non-finite values map to `undefined` (the {@link FirebaseAuthToken} fields are optional) —
+ * synthetic tokens built from OIDC bearer auth do not always carry those claims, and we must
+ * not throw `RangeError("Invalid time value")` from this path.
  *
  * @param token - The decoded ID token from Firebase Admin Auth.
  * @returns A normalized {@link FirebaseAuthToken} with camelCase fields.

package/src/lib/nest/controller/model/model.api.get.service.d.ts

@@ -65,6 +65,9 @@ export declare class ModelApiGetService {
      * Builds an {@link AuthDataRef} compatible with `useModel()` from the HTTP request auth.
      *
      * Uses the same synthetic auth pattern as {@link ModelApiDispatchService.dispatch}.
+     * The OIDC-validated claim subset is layered over the base token so the synthetic
+     * `auth.token` keeps standard JWT claims (`iat`, `auth_time`, `email`, …) that
+     * downstream consumers like `authContextInfo` rely on.
      *
      * @param auth - The Firebase server auth data from the HTTP request, or undefined for unauthenticated requests.
      * @returns An object containing a synthetic {@link AuthData} for use with `useModel()`, or undefined auth.

package/test/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.11.8",
+  "version": "13.11.10",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.8",
-    "@dereekb/date": "13.11.8",
-    "@dereekb/firebase": "13.11.8",
-    "@dereekb/firebase-server": "13.11.8",
-    "@dereekb/firebase-server/oidc": "13.11.8",
-    "@dereekb/model": "13.11.8",
-    "@dereekb/nestjs": "13.11.8",
-    "@dereekb/rxjs": "13.11.8",
-    "@dereekb/util": "13.11.8",
+    "@dereekb/analytics": "13.11.10",
+    "@dereekb/date": "13.11.10",
+    "@dereekb/firebase": "13.11.10",
+    "@dereekb/firebase-server": "13.11.10",
+    "@dereekb/firebase-server/oidc": "13.11.10",
+    "@dereekb/model": "13.11.10",
+    "@dereekb/nestjs": "13.11.10",
+    "@dereekb/rxjs": "13.11.10",
+    "@dereekb/util": "13.11.10",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,7 +23,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.11.8"
+    "@dereekb/nestjs": "13.11.10"
   },
   "exports": {
     "./package.json": "./package.json",

package/zoho/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/zoho",
-  "version": "13.11.8",
+  "version": "13.11.10",
   "peerDependencies": {
-    "@dereekb/analytics": "13.11.8",
-    "@dereekb/date": "13.11.8",
-    "@dereekb/model": "13.11.8",
-    "@dereekb/nestjs": "13.11.8",
-    "@dereekb/rxjs": "13.11.8",
-    "@dereekb/firebase": "13.11.8",
-    "@dereekb/util": "13.11.8",
-    "@dereekb/zoho": "13.11.8"
+    "@dereekb/analytics": "13.11.10",
+    "@dereekb/date": "13.11.10",
+    "@dereekb/model": "13.11.10",
+    "@dereekb/nestjs": "13.11.10",
+    "@dereekb/rxjs": "13.11.10",
+    "@dereekb/firebase": "13.11.10",
+    "@dereekb/util": "13.11.10",
+    "@dereekb/zoho": "13.11.10"
   },
   "exports": {
     "./package.json": "./package.json",