@dereekb/firebase-server 13.12.8 → 13.13.0

package/oidc/index.esm.js

@@ -4,7 +4,7 @@ import { SECONDS_IN_MINUTE, SECONDS_IN_DAY, cachedGetter, unixDateTimeSecondsNum
 import { generateKeyPairSync, randomBytes } from 'node:crypto';
 import { resolveEncryptionKey, encryptValue, decryptValue, createAesStringEncryptionProvider, isValidAES256GCMEncryptionSecret } from '@dereekb/nestjs';
 import { where, iterateFirestoreDocumentSnapshotPairs, firestoreModelIdentity, snapshotConverterFunctions, optionalFirestoreDate, firestoreDate, firestoreEnum, firestorePassThroughField, AbstractFirestoreDocument, createOidcClientParamsType, deleteOidcClientParamsType, deleteOidcTokenParamsType, rotateOidcClientSecretParamsType, updateOidcClientParamsType, firestoreModelKey, oidcEntryIdentity, PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD, OIDC_ENTRY_CLIENT_TYPE, oidcEntriesByUserCodeQuery, oidcEntriesByUidQuery, oidcEntriesByGrantIdQuery, oidcEntryFirestoreCollection, callModelOidcScopeForCallType, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE } from '@dereekb/firebase';
-import { firestoreEncryptedField, firebaseServerActionsContext, FirebaseServerEnvService, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FirebaseServerFirestoreContextModule, forbiddenError } from '@dereekb/firebase-server';
+import { firestoreEncryptedField, firebaseServerActionsContext, FirebaseServerEnvService, FirebaseServerAnalyticsService, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FirebaseServerFirestoreContextModule, forbiddenError } from '@dereekb/firebase-server';
 import { nanoid } from 'nanoid';
 import { safeToJsDate } from '@dereekb/date';
 import { makeUrlSearchParamsString } from '@dereekb/util/fetch';
@@ -27,13 +27,13 @@ import { ConfigService, ConfigModule } from '@nestjs/config';
     return req.auth;
 });
 
-function _type_of$1(obj) {
+function _type_of$2(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
 function __decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if ((typeof Reflect === "undefined" ? "undefined" : _type_of$1(Reflect)) === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    if ((typeof Reflect === "undefined" ? "undefined" : _type_of$2(Reflect)) === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
@@ -47,12 +47,12 @@ typeof SuppressedError === "function" ? SuppressedError : function(error, suppre
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 };
 
-function _class_call_check$g(instance, Constructor) {
+function _class_call_check$i(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$d(target, props) {
+function _defineProperties$e(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -61,11 +61,11 @@ function _defineProperties$d(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$d(Constructor, protoProps, staticProps) {
-    if (staticProps) _defineProperties$d(Constructor, staticProps);
+function _create_class$e(Constructor, protoProps, staticProps) {
+    if (staticProps) _defineProperties$e(Constructor, staticProps);
     return Constructor;
 }
-function _define_property$f(obj, key, value) {
+function _define_property$g(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -109,6 +109,23 @@ function _define_property$f(obj, key, value) {
 /**
  * Default global floor for a client-requested login duration, in seconds. 1 hour.
  */ var DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS = 60 * SECONDS_IN_MINUTE;
+/**
+ * Default ceiling (seconds) on a login duration for a non-admin user. 45 days.
+ *
+ * Tier 1 of the tiered ceiling resolved by `resolveTieredServerMaxSeconds`.
+ */ var DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS = 45 * SECONDS_IN_DAY;
+/**
+ * Default ceiling (seconds) on a normal (non-service-token) login duration for an admin user. 90 days.
+ *
+ * Tier 2 of the tiered ceiling resolved by `resolveTieredServerMaxSeconds`.
+ */ var DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS = 90 * SECONDS_IN_DAY;
+/**
+ * Default ceiling (seconds) on a login duration carrying an admin-only service-token scope. 365 days.
+ *
+ * Tier 3 of the tiered ceiling resolved by `resolveTieredServerMaxSeconds`. Also matches
+ * node-oidc-provider's absolute refresh-token rotation cap (`totalLifetime >= 365.25d`), so a
+ * service token issued at this ceiling never rotates.
+ */ var DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS = 365 * SECONDS_IN_DAY;
 /**
  * Default token lifetimes: 15 min access tokens, 30-day refresh tokens, 30-day sessions/grants, 60 s auth codes.
  */ var DEFAULT_OIDC_TOKEN_LIFETIMES = {
@@ -126,32 +143,32 @@ function _define_property$f(obj, key, value) {
  * Used as an abstract class so it can serve as both a type and a NestJS DI token.
  */ var OidcModuleConfig = /*#__PURE__*/ function() {
     function OidcModuleConfig() {
-        _class_call_check$g(this, OidcModuleConfig);
+        _class_call_check$i(this, OidcModuleConfig);
         /**
      * The OIDC issuer URL (e.g., 'https://accounts.example.com').
      * Must be the canonical URL where the OIDC provider is accessible.
-     */ _define_property$f(this, "issuer", void 0);
+     */ _define_property$g(this, "issuer", void 0);
         /**
      * The path prefix used for OIDC interaction endpoints (login/consent).
      *
      * Appended to the base appUrl this is the base frontend interaction path.
      *
      * Defaults to '/oauth'.
-     */ _define_property$f(this, "appOAuthInteractionPath", void 0);
+     */ _define_property$g(this, "appOAuthInteractionPath", void 0);
         /**
      * Frontend URL for the login interaction page.
      * The interaction uid will be appended as a query parameter.
      *
      * Defaults to `<appOAuthInteractionPath>/login`.
-     */ _define_property$f(this, "appOAuthLoginUrlPart", void 0);
+     */ _define_property$g(this, "appOAuthLoginUrlPart", void 0);
         /**
      * Frontend URL for the consent interaction page.
      *
      * Defaults to `<appOAuthInteractionPath>/consent`.
-     */ _define_property$f(this, "appOAuthConsentUrlPart", void 0);
+     */ _define_property$g(this, "appOAuthConsentUrlPart", void 0);
         /**
      * Token lifetime configuration.
-     */ _define_property$f(this, "tokenLifetimes", void 0);
+     */ _define_property$g(this, "tokenLifetimes", void 0);
         /**
      * Maximum login duration (seconds) a client may request via the `dbx_session_ttl` auth-URL param.
      *
@@ -160,24 +177,43 @@ function _define_property$f(obj, key, value) {
      * `min(client.dbx_max_session_ttl, this)`.
      *
      * Defaults to {@link DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS} (90 days).
-     */ _define_property$f(this, "maxRequestedLoginDuration", void 0);
+     */ _define_property$g(this, "maxRequestedLoginDuration", void 0);
         /**
      * Minimum login duration (seconds) a client may request via the `dbx_session_ttl` auth-URL param.
      *
      * Requested values below this floor are clamped up. Prevents pathological 30-second sessions.
      *
      * Defaults to {@link DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS} (1 hour).
-     */ _define_property$f(this, "minRequestedLoginDuration", void 0);
+     */ _define_property$g(this, "minRequestedLoginDuration", void 0);
         /**
      * Default login duration (seconds) used when a client does NOT pass the `dbx_session_ttl`
      * auth-URL param. When undefined, falls back to {@link OidcTokenLifetimes.refreshToken}.
-     */ _define_property$f(this, "defaultRequestedLoginDuration", void 0);
+     */ _define_property$g(this, "defaultRequestedLoginDuration", void 0);
+        /**
+     * Tiered ceiling (seconds) on the requested login duration for a non-admin user.
+     *
+     * Used by `resolveTieredServerMaxSeconds` when the resolving user is not an admin; the resolved
+     * tier value is used as the `serverMaxSeconds` ceiling (it replaces the flat
+     * {@link maxRequestedLoginDuration}, since service-token tokens intentionally exceed it).
+     *
+     * Defaults to {@link DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS} (45 days).
+     */ _define_property$g(this, "maxRequestedLoginDurationNonAdmin", void 0);
+        /**
+     * Tiered ceiling (seconds) on a normal (non-service-token) requested login duration for an admin user.
+     *
+     * Defaults to {@link DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS} (90 days).
+     */ _define_property$g(this, "maxRequestedLoginDurationAdmin", void 0);
+        /**
+     * Tiered ceiling (seconds) on a requested login duration carrying an admin-only service-token scope.
+     *
+     * Defaults to {@link DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS} (365 days).
+     */ _define_property$g(this, "maxRequestedLoginDurationServiceToken", void 0);
         /**
      * JWKS service configuration (encryption secret, rotated key max age).
-     */ _define_property$f(this, "jwksServiceConfig", void 0);
+     */ _define_property$g(this, "jwksServiceConfig", void 0);
         /**
      * JWKS key converter configuration (encryption secret for Firestore field encryption).
-     */ _define_property$f(this, "jwksKeyConverterConfig", void 0);
+     */ _define_property$g(this, "jwksKeyConverterConfig", void 0);
         /**
      * Custom error rendering function for the oidc-provider.
      *
@@ -187,7 +223,7 @@ function _define_property$f(obj, key, value) {
      * errors are presented (e.g. redirect to an error page).
      *
      * The function signature matches oidc-provider's `renderError` configuration option.
-     */ _define_property$f(this, "renderError", void 0);
+     */ _define_property$g(this, "renderError", void 0);
         /**
      * Whether to suppress the oidc-provider "already parsed request body" warning.
      *
@@ -196,7 +232,7 @@ function _define_property$f(obj, key, value) {
      * this correctly by falling back to `req.body`, but emits a one-time warning.
      *
      * Defaults to `false`.
-     */ _define_property$f(this, "suppressBodyParserWarning", void 0);
+     */ _define_property$g(this, "suppressBodyParserWarning", void 0);
         /**
      * Path prefixes that require OAuth bearer token verification.
      *
@@ -206,7 +242,7 @@ function _define_property$f(obj, key, value) {
      *
      * Paths under the global API route prefix should not be included
      * since those are typically protected by AppCheck.
-     */ _define_property$f(this, "protectedPaths", void 0);
+     */ _define_property$g(this, "protectedPaths", void 0);
         /**
      * Map of recognized OAuth resource indicator URLs (RFC 8707) to their
      * {@link OidcResourceServerInfo}. When non-empty, oidc-provider's
@@ -228,7 +264,7 @@ function _define_property$f(obj, key, value) {
      *   }
      * }
      * ```
-     */ _define_property$f(this, "resourceServers", void 0);
+     */ _define_property$g(this, "resourceServers", void 0);
         /**
      * When `true`, {@link oidcModuleMetadata} automatically derives a resource-server
      * entry from `envService.appMcpUrl` and the registered {@link OidcAccountService}'s
@@ -244,7 +280,7 @@ function _define_property$f(obj, key, value) {
      * Defaults to `false`.
      *
      * @see buildFirebaseServerMcpResourceServer
-     */ _define_property$f(this, "configureMcpResourceServer", void 0);
+     */ _define_property$g(this, "configureMcpResourceServer", void 0);
         /**
      * Absolute URL of the OAuth 2.0 Protected Resource Metadata document
      * (RFC 9728) for the resources guarded by {@link protectedPaths}.
@@ -262,7 +298,7 @@ function _define_property$f(obj, key, value) {
      *
      * @example
      * resourceMetadataUrl: 'http://localhost:9902/dereekb-components/us-central1/api/.well-known/oauth-protected-resource'
-     */ _define_property$f(this, "resourceMetadataUrl", void 0);
+     */ _define_property$g(this, "resourceMetadataUrl", void 0);
         /**
      * Supported token endpoint authentication methods.
      *
@@ -270,7 +306,7 @@ function _define_property$f(obj, key, value) {
      * in the discovery metadata document.
      *
      * @see DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS
-     */ _define_property$f(this, "tokenEndpointAuthMethods", void 0);
+     */ _define_property$g(this, "tokenEndpointAuthMethods", void 0);
         /**
      * Whether to enable the OIDC dynamic client registration endpoint (`/reg`).
      *
@@ -278,7 +314,7 @@ function _define_property$f(obj, key, value) {
      * and manage their registrations via the registration management feature.
      *
      * Defaults to `false`.
-     */ _define_property$f(this, "registrationEnabled", void 0);
+     */ _define_property$g(this, "registrationEnabled", void 0);
         /**
      * Whether the oidc-provider should trust upstream proxy headers
      * (`X-Forwarded-Host`, `X-Forwarded-Proto`) when computing the request URL
@@ -297,7 +333,7 @@ function _define_property$f(obj, key, value) {
      * (which is the Koa `app.proxy` setting).
      *
      * Defaults to `'prod_only'` if the environment is `production`, otherwise `false`.
-     */ _define_property$f(this, "trustProxy", void 0);
+     */ _define_property$g(this, "trustProxy", void 0);
         /**
      * Whether to trust proxy headers in a non-production environment, such as the local environment.
      *
@@ -305,9 +341,9 @@ function _define_property$f(obj, key, value) {
      * `true` will result in errors.
      *
      * Defaults to `false`.
-     */ _define_property$f(this, "trustProxyInNonProduction", void 0);
+     */ _define_property$g(this, "trustProxyInNonProduction", void 0);
     }
-    _create_class$d(OidcModuleConfig, null, [
+    _create_class$e(OidcModuleConfig, null, [
         {
             key: "assertValidConfig",
             value: /**
@@ -351,6 +387,17 @@ function _define_property$f(obj, key, value) {
 /**
  * Custom oidc-provider client metadata field for a client's maximum requestable login duration (seconds).
  */ var DBX_FIREBASE_SERVER_OIDC_MAX_SESSION_TTL_CLIENT_METADATA = 'dbx_max_session_ttl';
+/**
+ * Access-token `extra` claim carrying the grant's resolved expiry as unix seconds.
+ *
+ * Baked on at issuance (`extraTokenClaims`) and read back by `verifyAccessToken` and the
+ * `GET /oidc/session` route so clients can surface the session lifetime without decoding the token.
+ */ var DBX_FIREBASE_SERVER_OIDC_SESSION_EXPIRES_AT_CLAIM = 'dbx_session_expires_at';
+/**
+ * Access-token `extra` claim flagging whether the grant's refresh token rotation is disabled.
+ *
+ * `true` when the token's scope set intersects {@link OidcProviderConfig.nonRotatingScopes}.
+ */ var DBX_FIREBASE_SERVER_OIDC_ROTATION_DISABLED_CLAIM = 'dbx_rotation_disabled';
 /**
  * Clamps a requested login duration into the allowed range.
  *
@@ -378,6 +425,77 @@ function _define_property$f(obj, key, value) {
     var ceiling = Math.min(input.serverMaxSeconds, (_input_clientMaxSeconds = input.clientMaxSeconds) !== null && _input_clientMaxSeconds !== void 0 ? _input_clientMaxSeconds : Infinity);
     return Math.max(input.serverMinSeconds, Math.min(raw, ceiling));
 }
+/**
+ * Resolves the tiered server-max ceiling (seconds) used as `serverMaxSeconds` for a login duration.
+ *
+ * Tiers, highest to lowest priority:
+ * 1. Admin + service-token scope → `serviceTokenMax`.
+ * 2. Admin (normal) → `adminMax`.
+ * 3. Non-admin → `nonAdminMax`.
+ *
+ * A non-admin should never reach the service-token branch — the consent flow hard-rejects a
+ * non-admin requesting a service-token scope before this resolves — but the tiering is defensive:
+ * a non-admin always resolves to `nonAdminMax` regardless of `hasServiceScope`.
+ *
+ * @param input - The tier inputs (admin flag, service-scope flag, and the three tier ceilings).
+ * @returns The resolved ceiling in seconds.
+ */ function resolveTieredServerMaxSeconds(input) {
+    var isAdmin = input.isAdmin, hasServiceScope = input.hasServiceScope, nonAdminMax = input.nonAdminMax, adminMax = input.adminMax, serviceTokenMax = input.serviceTokenMax;
+    var result;
+    if (!isAdmin) {
+        result = nonAdminMax;
+    } else if (hasServiceScope) {
+        result = serviceTokenMax;
+    } else {
+        result = adminMax;
+    }
+    return result;
+}
+// MARK: Refresh token rotation
+/**
+ * Absolute cap (seconds) on how long a refresh token may be rotated, after which its TTL is final.
+ *
+ * Mirrors node-oidc-provider's default `rotateRefreshToken` cap of `365.25 * 24 * 60 * 60`.
+ */ var REFRESH_TOKEN_ROTATION_MAX_LIFETIME_SECONDS = 365.25 * 24 * 60 * 60;
+/**
+ * Percentage of a refresh token's lifetime that must elapse before the library-default branch rotates it.
+ *
+ * Mirrors node-oidc-provider's default `rotateRefreshToken` threshold of `70`.
+ */ var REFRESH_TOKEN_ROTATION_TTL_PERCENTAGE_THRESHOLD = 70;
+/**
+ * Decides whether a refresh token should rotate on exchange.
+ *
+ * Returns `false` (no rotation) whenever the token's scope set intersects `nonRotatingScopes` — the
+ * dbx-components extension point that makes service tokens stable for server env consumption.
+ *
+ * For every other token this **replicates node-oidc-provider's default `rotateRefreshToken`**
+ * (because setting the option disables the library's built-in default, we must reproduce it):
+ * 1. `totalLifetime >= 365.25d` → `false` (rotation cap reached; TTL is final).
+ * 2. public client (`clientAuthMethod === 'none'`) and not sender-constrained → `true`.
+ * 3. otherwise → `ttlPercentagePassed >= 70`.
+ *
+ * Keep this in sync with `node_modules/oidc-provider/lib/helpers/defaults.js` (`rotateRefreshToken`)
+ * across oidc-provider upgrades.
+ *
+ * @param input - The rotation inputs.
+ * @returns Whether the refresh token should rotate.
+ */ function shouldRotateRefreshToken(input) {
+    var scope = input.scope, nonRotatingScopes = input.nonRotatingScopes, totalLifetimeSeconds = input.totalLifetimeSeconds, clientAuthMethod = input.clientAuthMethod, isSenderConstrained = input.isSenderConstrained, ttlPercentagePassed = input.ttlPercentagePassed;
+    var scopeSet = new Set((scope !== null && scope !== void 0 ? scope : '').split(' ').filter(Boolean));
+    var result;
+    if (nonRotatingScopes.some(function(nonRotatingScope) {
+        return scopeSet.has(nonRotatingScope);
+    })) {
+        result = false;
+    } else if (totalLifetimeSeconds >= REFRESH_TOKEN_ROTATION_MAX_LIFETIME_SECONDS) {
+        result = false;
+    } else if (clientAuthMethod === 'none' && !isSenderConstrained) {
+        result = true;
+    } else {
+        result = ttlPercentagePassed >= REFRESH_TOKEN_ROTATION_TTL_PERCENTAGE_THRESHOLD;
+    }
+    return result;
+}
 // MARK: Param parsing
 /**
  * Parses a raw `dbx_session_ttl` value (string or number, from URL query / form / persisted interaction params)
@@ -475,7 +593,7 @@ function _define_property$f(obj, key, value) {
     return jwksKeysWithStatusQuery('rotated');
 }
 
-function _class_call_check$f(instance, Constructor) {
+function _class_call_check$h(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
@@ -487,7 +605,7 @@ function _class_call_check$f(instance, Constructor) {
  * Extends both {@link JwksFirestoreCollections} (server-only JWKS keys) and
  * {@link OidcModelFirestoreCollections} (shared adapter entries).
  */ var OidcServerFirestoreCollections = function OidcServerFirestoreCollections() {
-    _class_call_check$f(this, OidcServerFirestoreCollections);
+    _class_call_check$h(this, OidcServerFirestoreCollections);
 } 
 ;
 
@@ -520,12 +638,12 @@ function _async_to_generator$a(fn) {
         });
     };
 }
-function _class_call_check$e(instance, Constructor) {
+function _class_call_check$g(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$c(target, props) {
+function _defineProperties$d(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -534,11 +652,11 @@ function _defineProperties$c(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$c(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
+function _create_class$d(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$d(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$e(obj, key, value) {
+function _define_property$f(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -551,7 +669,7 @@ function _define_property$e(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$6(target) {
+function _object_spread$7(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -561,7 +679,7 @@ function _object_spread$6(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$e(target, key, source[key]);
+            _define_property$f(target, key, source[key]);
         });
     }
     return target;
@@ -686,24 +804,24 @@ function _ts_generator$a(thisArg, body) {
 }
 // MARK: Config
 var JwksServiceConfig = function JwksServiceConfig() {
-    _class_call_check$e(this, JwksServiceConfig);
+    _class_call_check$g(this, JwksServiceConfig);
 };
 /**
  * If provided, the JwksService will write the JWKS to this file when keys are rotated.
  */ var JwksServiceStorageConfig = function JwksServiceStorageConfig() {
-    _class_call_check$e(this, JwksServiceStorageConfig);
+    _class_call_check$g(this, JwksServiceStorageConfig);
 };
 var DEFAULT_ROTATED_KEY_MAX_AGE = 30 * 24 * 60 * 60; // 30 days
 // MARK: Service
 var JwksService = /*#__PURE__*/ function() {
     function JwksService(config, collections, storageConfig) {
         var _this = this;
-        _class_call_check$e(this, JwksService);
+        _class_call_check$g(this, JwksService);
         var _config_rotatedKeyMaxAge, _config_enableSaveJwksToStorage, _config_serveJwksFromStorage;
-        _define_property$e(this, "config", void 0);
-        _define_property$e(this, "collections", void 0);
-        _define_property$e(this, "storageConfig", void 0);
-        _define_property$e(this, "_jwksStoragePublicUrl", cachedGetter(function() {
+        _define_property$f(this, "config", void 0);
+        _define_property$f(this, "collections", void 0);
+        _define_property$f(this, "storageConfig", void 0);
+        _define_property$f(this, "_jwksStoragePublicUrl", cachedGetter(function() {
             return _async_to_generator$a(function() {
                 var _this, _this_storageConfig, result, _file;
                 return _ts_generator$a(this, function(_state) {
@@ -752,13 +870,13 @@ var JwksService = /*#__PURE__*/ function() {
                 });
             }).call(_this);
         }));
-        _define_property$e(this, "rotatedKeyMaxAge", void 0);
+        _define_property$f(this, "rotatedKeyMaxAge", void 0);
         /**
      * Whether the JWKS is served from a public storage URL rather than the built-in endpoint.
-     */ _define_property$e(this, "serveJwksFromStorage", void 0);
+     */ _define_property$f(this, "serveJwksFromStorage", void 0);
         /**
      * Whether the JWKS should be saved to storage when keys are rotated.
-     */ _define_property$e(this, "saveJwksToStorage", void 0);
+     */ _define_property$f(this, "saveJwksToStorage", void 0);
         this.config = config;
         this.collections = collections;
         this.storageConfig = storageConfig;
@@ -767,7 +885,7 @@ var JwksService = /*#__PURE__*/ function() {
         this.saveJwksToStorage = (_config_enableSaveJwksToStorage = config.enableSaveJwksToStorage) !== null && _config_enableSaveJwksToStorage !== void 0 ? _config_enableSaveJwksToStorage : hasStorageFile;
         this.serveJwksFromStorage = (_config_serveJwksFromStorage = config.serveJwksFromStorage) !== null && _config_serveJwksFromStorage !== void 0 ? _config_serveJwksFromStorage : this.saveJwksToStorage;
     }
-    _create_class$c(JwksService, [
+    _create_class$d(JwksService, [
         {
             key: "jwksKeyCollection",
             get: function get() {
@@ -802,13 +920,13 @@ var JwksService = /*#__PURE__*/ function() {
                                     }
                                 }), publicKey = _generateKeyPairSync.publicKey, privateKey = _generateKeyPairSync.privateKey;
                                 kid = randomBytes(16).toString('hex');
-                                publicJwk = _object_spread_props$3(_object_spread$6({}, publicKey), {
+                                publicJwk = _object_spread_props$3(_object_spread$7({}, publicKey), {
                                     kid: kid,
                                     kty: 'RSA',
                                     alg: 'RS256',
                                     use: 'sig'
                                 });
-                                privateJwk = _object_spread_props$3(_object_spread$6({}, privateKey), {
+                                privateJwk = _object_spread_props$3(_object_spread$7({}, privateKey), {
                                     kid: kid,
                                     kty: 'RSA',
                                     alg: 'RS256',
@@ -1226,12 +1344,12 @@ function _async_to_generator$9(fn) {
         });
     };
 }
-function _class_call_check$d(instance, Constructor) {
+function _class_call_check$f(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$b(target, props) {
+function _defineProperties$c(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -1240,11 +1358,11 @@ function _defineProperties$b(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$b(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
+function _create_class$c(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$d(obj, key, value) {
+function _define_property$e(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -1399,7 +1517,7 @@ function _ts_generator$9(thisArg, body) {
  * };
  * ```
  */ var OidcAccountServiceDelegate = function OidcAccountServiceDelegate() {
-    _class_call_check$d(this, OidcAccountServiceDelegate);
+    _class_call_check$f(this, OidcAccountServiceDelegate);
 };
 // MARK: User Context
 /**
@@ -1408,15 +1526,15 @@ function _ts_generator$9(thisArg, body) {
  * Created by {@link OidcAccountService.userContext} for a specific user ID.
  */ var OidcAccountServiceUserContext = /*#__PURE__*/ function() {
     function OidcAccountServiceUserContext(_service, _uid) {
-        _class_call_check$d(this, OidcAccountServiceUserContext);
-        _define_property$d(this, "_service", void 0);
-        _define_property$d(this, "_uid", void 0);
-        _define_property$d(this, "authUserContext", void 0);
+        _class_call_check$f(this, OidcAccountServiceUserContext);
+        _define_property$e(this, "_service", void 0);
+        _define_property$e(this, "_uid", void 0);
+        _define_property$e(this, "authUserContext", void 0);
         this._service = _service;
         this._uid = _uid;
         this.authUserContext = this._service.authService.userContext(this._uid);
     }
-    _create_class$b(OidcAccountServiceUserContext, [
+    _create_class$c(OidcAccountServiceUserContext, [
         {
             key: "uid",
             get: function get() {
@@ -1491,13 +1609,13 @@ function _ts_generator$9(thisArg, body) {
  * Register it as a provider using the `OidcAccountService` class as the injection token.
  */ var OidcAccountService = /*#__PURE__*/ function() {
     function OidcAccountService(authService, delegate) {
-        _class_call_check$d(this, OidcAccountService);
-        _define_property$d(this, "authService", void 0);
-        _define_property$d(this, "delegate", void 0);
+        _class_call_check$f(this, OidcAccountService);
+        _define_property$e(this, "authService", void 0);
+        _define_property$e(this, "delegate", void 0);
         this.authService = authService;
         this.delegate = delegate;
     }
-    _create_class$b(OidcAccountService, [
+    _create_class$c(OidcAccountService, [
         {
             key: "providerConfig",
             get: /**
@@ -1524,22 +1642,22 @@ function _ts_generator$9(thisArg, body) {
 } 
 ();
 
-function _assert_this_initialized(self) {
+function _assert_this_initialized$1(self) {
     if (self === void 0) {
         throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
     }
     return self;
 }
-function _call_super(_this, derived, args) {
-    derived = _get_prototype_of(derived);
-    return _possible_constructor_return(_this, _is_native_reflect_construct() ? Reflect.construct(derived, args || [], _get_prototype_of(_this).constructor) : derived.apply(_this, args));
+function _call_super$1(_this, derived, args) {
+    derived = _get_prototype_of$1(derived);
+    return _possible_constructor_return$1(_this, _is_native_reflect_construct$1() ? Reflect.construct(derived, args || [], _get_prototype_of$1(_this).constructor) : derived.apply(_this, args));
 }
-function _class_call_check$c(instance, Constructor) {
+function _class_call_check$e(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$a(target, props) {
+function _defineProperties$b(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -1548,17 +1666,17 @@ function _defineProperties$a(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$a(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
+function _create_class$b(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _get_prototype_of(o) {
-    _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
+function _get_prototype_of$1(o) {
+    _get_prototype_of$1 = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
         return o.__proto__ || Object.getPrototypeOf(o);
     };
-    return _get_prototype_of(o);
+    return _get_prototype_of$1(o);
 }
-function _inherits(subClass, superClass) {
+function _inherits$1(subClass, superClass) {
     if (typeof superClass !== "function" && superClass !== null) {
         throw new TypeError("Super expression must either be null or a function");
     }
@@ -1569,30 +1687,30 @@ function _inherits(subClass, superClass) {
             configurable: true
         }
     });
-    if (superClass) _set_prototype_of(subClass, superClass);
+    if (superClass) _set_prototype_of$1(subClass, superClass);
 }
-function _possible_constructor_return(self, call) {
-    if (call && (_type_of(call) === "object" || typeof call === "function")) {
+function _possible_constructor_return$1(self, call) {
+    if (call && (_type_of$1(call) === "object" || typeof call === "function")) {
         return call;
     }
-    return _assert_this_initialized(self);
+    return _assert_this_initialized$1(self);
 }
-function _set_prototype_of(o, p) {
-    _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o, p) {
+function _set_prototype_of$1(o, p) {
+    _set_prototype_of$1 = Object.setPrototypeOf || function setPrototypeOf(o, p) {
         o.__proto__ = p;
         return o;
     };
-    return _set_prototype_of(o, p);
+    return _set_prototype_of$1(o, p);
 }
-function _type_of(obj) {
+function _type_of$1(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _is_native_reflect_construct() {
+function _is_native_reflect_construct$1() {
     try {
         var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {}));
     } catch (_) {}
-    return (_is_native_reflect_construct = function() {
+    return (_is_native_reflect_construct$1 = function() {
         return !!result;
     })();
 }
@@ -1602,7 +1720,7 @@ function _is_native_reflect_construct() {
  *
  * Implementations provide concrete collection instances wired to a specific {@link FirestoreContext}.
  */ var JwksFirestoreCollections = function JwksFirestoreCollections() {
-    _class_call_check$c(this, JwksFirestoreCollections);
+    _class_call_check$e(this, JwksFirestoreCollections);
 };
 // MARK: Identity
 /**
@@ -1613,12 +1731,12 @@ function _is_native_reflect_construct() {
 /**
  * Firestore document wrapper for {@link JwksKey}.
  */ var JwksKeyDocument = /*#__PURE__*/ function(AbstractFirestoreDocument) {
-    _inherits(JwksKeyDocument, AbstractFirestoreDocument);
+    _inherits$1(JwksKeyDocument, AbstractFirestoreDocument);
     function JwksKeyDocument() {
-        _class_call_check$c(this, JwksKeyDocument);
-        return _call_super(this, JwksKeyDocument, arguments);
+        _class_call_check$e(this, JwksKeyDocument);
+        return _call_super$1(this, JwksKeyDocument, arguments);
     }
-    _create_class$a(JwksKeyDocument, [
+    _create_class$b(JwksKeyDocument, [
         {
             key: "modelIdentity",
             get: function get() {
@@ -1710,7 +1828,7 @@ function _async_to_generator$8(fn) {
         });
     };
 }
-function _class_call_check$b(instance, Constructor) {
+function _class_call_check$d(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
@@ -1820,7 +1938,7 @@ function _ts_generator$8(thisArg, body) {
  *
  * @see {@link oidcModelServerActions} for the concrete implementation factory.
  */ var OidcModelServerActions = function OidcModelServerActions() {
-    _class_call_check$b(this, OidcModelServerActions);
+    _class_call_check$d(this, OidcModelServerActions);
 };
 /**
  * Creates a concrete {@link OidcModelServerActions} implementation wired to the provided context.
@@ -2062,12 +2180,12 @@ function _async_to_generator$7(fn) {
         });
     };
 }
-function _class_call_check$a(instance, Constructor) {
+function _class_call_check$c(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$9(target, props) {
+function _defineProperties$a(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -2076,11 +2194,11 @@ function _defineProperties$9(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$9(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
+function _create_class$a(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$c(obj, key, value) {
+function _define_property$d(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2093,7 +2211,7 @@ function _define_property$c(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$5(target) {
+function _object_spread$6(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2103,7 +2221,7 @@ function _object_spread$5(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$c(target, key, source[key]);
+            _define_property$d(target, key, source[key]);
         });
     }
     return target;
@@ -2232,13 +2350,17 @@ function _ts_generator$7(thisArg, body) {
  *
  * Mirrors the oidc-provider `registration.js` flow to ensure all provider
  * validation and lifecycle hooks run.
+ *
+ * Client create/update/rotate/delete are driven by callModel functions, so their
+ * analytics are captured by the callModel analytics layer (`OnCallModelAnalyticsService`)
+ * with the acting user — not by the OIDC analytics service.
  */ var OidcClientService = /*#__PURE__*/ function() {
     function OidcClientService(oidcService) {
-        _class_call_check$a(this, OidcClientService);
-        _define_property$c(this, "oidcService", void 0);
+        _class_call_check$c(this, OidcClientService);
+        _define_property$d(this, "oidcService", void 0);
         this.oidcService = oidcService;
     }
-    _create_class$9(OidcClientService, [
+    _create_class$a(OidcClientService, [
         {
             key: "createClient",
             value: /**
@@ -2376,7 +2498,7 @@ function _ts_generator$7(thisArg, body) {
                                 if (!existing) {
                                     throw new Error('Client not found.');
                                 }
-                                updatedMetadata = _object_spread$5({}, existing);
+                                updatedMetadata = _object_spread$6({}, existing);
                                 updatedMetadata.client_name = params.client_name;
                                 updatedMetadata.redirect_uris = params.redirect_uris;
                                 if (params.logo_uri !== undefined) {
@@ -2450,7 +2572,7 @@ function _ts_generator$7(thisArg, body) {
                                     throw new Error('Cannot rotate a client secret for a public PKCE client (token_endpoint_auth_method "none"). Public clients have no secret.');
                                 }
                                 newSecret = randomBytes(64).toString('base64url');
-                                updatedMetadata = _object_spread_props$2(_object_spread$5({}, existing), {
+                                updatedMetadata = _object_spread_props$2(_object_spread$6({}, existing), {
                                     client_secret: newSecret,
                                     client_secret_expires_at: 0
                                 });
@@ -2527,7 +2649,7 @@ function _ts_generator$7(thisArg, body) {
 } 
 ();
 
-function _define_property$b(obj, key, value) {
+function _define_property$c(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2540,7 +2662,7 @@ function _define_property$b(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$4(target) {
+function _object_spread$5(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2550,7 +2672,7 @@ function _object_spread$4(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$b(target, key, source[key]);
+            _define_property$c(target, key, source[key]);
         });
     }
     return target;
@@ -2582,7 +2704,7 @@ function _object_spread_props$1(target, source) {
  * @param oidcService - The core OIDC service for grant revocation.
  * @returns The configured OidcModelServerActions instance.
  */ function oidcModelServerActionsFactory(oidcClientService, oidcService) {
-    var context = _object_spread_props$1(_object_spread$4({}, firebaseServerActionsContext()), {
+    var context = _object_spread_props$1(_object_spread$5({}, firebaseServerActionsContext()), {
         oidcClientService: oidcClientService,
         oidcService: oidcService
     });
@@ -2647,12 +2769,12 @@ function _async_to_generator$6(fn) {
         });
     };
 }
-function _class_call_check$9(instance, Constructor) {
+function _class_call_check$b(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$8(target, props) {
+function _defineProperties$9(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -2661,11 +2783,11 @@ function _defineProperties$8(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$8(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
+function _create_class$9(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$a(obj, key, value) {
+function _define_property$b(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2686,7 +2808,7 @@ function _instanceof$2(left, right) {
         return left instanceof right;
     }
 }
-function _object_spread$3(target) {
+function _object_spread$4(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2696,7 +2818,7 @@ function _object_spread$3(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$a(target, key, source[key]);
+            _define_property$b(target, key, source[key]);
         });
     }
     return target;
@@ -2830,13 +2952,13 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
  */ function createAdapterFactory(collections, encryptionService) {
     var FirestoreAdapter = /*#__PURE__*/ function() {
         function FirestoreAdapter(name) {
-            _class_call_check$9(this, FirestoreAdapter);
-            _define_property$a(this, "name", void 0);
-            _define_property$a(this, "collection", void 0);
+            _class_call_check$b(this, FirestoreAdapter);
+            _define_property$b(this, "name", void 0);
+            _define_property$b(this, "collection", void 0);
             this.name = name;
             this.collection = collections.oidcEntryCollection;
         }
-        _create_class$8(FirestoreAdapter, [
+        _create_class$9(FirestoreAdapter, [
             {
                 key: "upsert",
                 value: function upsert(id, payload, expiresIn) {
@@ -2867,7 +2989,7 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
                                     } else if (createdAtIso) {
                                         createdAt = safeToJsDate(createdAtIso);
                                     }
-                                    data = _object_spread$3({
+                                    data = _object_spread$4({
                                         type: this.name,
                                         payload: encryptionService.encryptAdapterPayload(payload),
                                         o: o,
@@ -3101,20 +3223,20 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
     return FirestoreAdapter;
 }
 
-function _array_like_to_array$4(arr, len) {
+function _array_like_to_array$5(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$3(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
 }
-function _class_call_check$8(instance, Constructor) {
+function _class_call_check$a(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$7(target, props) {
+function _defineProperties$8(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3123,11 +3245,11 @@ function _defineProperties$7(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$7(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$7(Constructor.prototype, protoProps);
+function _create_class$8(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$9(obj, key, value) {
+function _define_property$a(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3140,22 +3262,22 @@ function _define_property$9(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$3(iter) {
+function _iterable_to_array$5(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$3() {
+function _non_iterable_spread$5() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$3(arr) {
-    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$3();
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
 }
-function _unsupported_iterable_to_array$4(o, minLen) {
+function _unsupported_iterable_to_array$5(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
 }
 // MARK: Encrypted Fields
 /**
@@ -3177,16 +3299,16 @@ function _unsupported_iterable_to_array$4(o, minLen) {
  * the OIDC model server actions.
  */ var OidcEncryptionService = /*#__PURE__*/ function() {
     function OidcEncryptionService(config) {
-        _class_call_check$8(this, OidcEncryptionService);
-        _define_property$9(this, "provider", void 0);
-        _define_property$9(this, "adapterPayloadEncryptor", void 0);
+        _class_call_check$a(this, OidcEncryptionService);
+        _define_property$a(this, "provider", void 0);
+        _define_property$a(this, "adapterPayloadEncryptor", void 0);
         this.provider = createAesStringEncryptionProvider(config.jwksKeyConverterConfig.encryptionSecret);
         this.adapterPayloadEncryptor = selectiveFieldEncryptor({
             provider: this.provider,
-            fields: _to_consumable_array$3(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
+            fields: _to_consumable_array$5(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
         });
     }
-    _create_class$7(OidcEncryptionService, [
+    _create_class$8(OidcEncryptionService, [
         {
             /**
      * Encrypts sensitive fields in an adapter payload and returns it as a {@link JsonSerializableObject}
@@ -3219,20 +3341,20 @@ OidcEncryptionService = __decorate([
     __param(0, Inject(OidcModuleConfig))
 ], OidcEncryptionService);
 
-function _array_like_to_array$3(arr, len) {
+function _array_like_to_array$4(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$2(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
+function _array_without_holes$4(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
 }
-function _class_call_check$7(instance, Constructor) {
+function _class_call_check$9(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$6(target, props) {
+function _defineProperties$7(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3241,11 +3363,11 @@ function _defineProperties$6(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$6(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$6(Constructor.prototype, protoProps);
+function _create_class$7(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$7(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$8(obj, key, value) {
+function _define_property$9(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3258,22 +3380,22 @@ function _define_property$8(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$2(iter) {
+function _iterable_to_array$4(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$2() {
+function _non_iterable_spread$4() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$2(arr) {
-    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$2();
+function _to_consumable_array$4(arr) {
+    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$4();
 }
-function _unsupported_iterable_to_array$3(o, minLen) {
+function _unsupported_iterable_to_array$4(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
 }
 // MARK: Routes
 /**
@@ -3321,36 +3443,36 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
  * Injected into {@link OidcService} and {@link OidcWellKnownController}.
  */ var OidcProviderConfigService = /*#__PURE__*/ function() {
     function OidcProviderConfigService(config, accountService, envService) {
-        _class_call_check$7(this, OidcProviderConfigService);
+        _class_call_check$9(this, OidcProviderConfigService);
         var _this_config_tokenEndpointAuthMethods;
-        _define_property$8(this, "config", void 0);
-        _define_property$8(this, "routes", DEFAULT_OIDC_ROUTES);
+        _define_property$9(this, "config", void 0);
+        _define_property$9(this, "routes", DEFAULT_OIDC_ROUTES);
         /**
      * If the OIDC registration route is enabled.
-     */ _define_property$8(this, "oidcRegistrationRouteEnabled", void 0);
+     */ _define_property$9(this, "oidcRegistrationRouteEnabled", void 0);
         /**
      * The url to the front-end login page.
-     */ _define_property$8(this, "appLoginUrl", void 0);
+     */ _define_property$9(this, "appLoginUrl", void 0);
         /**
      * The url to the front-end consent page.
-     */ _define_property$8(this, "appConsentUrl", void 0);
+     */ _define_property$9(this, "appConsentUrl", void 0);
         /**
      * The app-provided provider config from the delegate.
-     */ _define_property$8(this, "providerConfig", void 0);
+     */ _define_property$9(this, "providerConfig", void 0);
         /**
      * Scopes derived from the claims configuration keys.
-     */ _define_property$8(this, "scopesSupported", void 0);
+     */ _define_property$9(this, "scopesSupported", void 0);
         /**
      * Flat list of all unique claim names from the claims configuration.
-     */ _define_property$8(this, "claimsSupported", void 0);
+     */ _define_property$9(this, "claimsSupported", void 0);
         /**
      * Token endpoint authentication methods from config or defaults.
-     */ _define_property$8(this, "tokenEndpointAuthMethodsSupported", void 0);
+     */ _define_property$9(this, "tokenEndpointAuthMethodsSupported", void 0);
         this.config = config;
         this.providerConfig = accountService.providerConfig;
         this.scopesSupported = Object.keys(this.providerConfig.claims);
         this.claimsSupported = Array.from(new Set(Object.values(this.providerConfig.claims).flat()));
-        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$2(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
+        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$4(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
         var appUrl = envService.appUrl;
         this.appLoginUrl = websiteUrlFromPaths(appUrl, [
             this.config.appOAuthInteractionPath,
@@ -3362,7 +3484,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
         ]);
         this.oidcRegistrationRouteEnabled = config.registrationEnabled === true;
     }
-    _create_class$6(OidcProviderConfigService, [
+    _create_class$7(OidcProviderConfigService, [
         {
             /**
      * Builds the OpenID Connect Discovery metadata document.
@@ -3383,16 +3505,16 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
                     jwks_uri: jwksUri !== null && jwksUri !== void 0 ? jwksUri : "".concat(issuer).concat(routes.jwks),
                     registration_endpoint: this.oidcRegistrationRouteEnabled ? "".concat(issuer).concat(routes.registration) : undefined,
                     scopes_supported: this.scopesSupported,
-                    response_types_supported: _to_consumable_array$2(providerConfig.responseTypes),
+                    response_types_supported: _to_consumable_array$4(providerConfig.responseTypes),
                     response_modes_supported: [
                         'query'
                     ],
-                    grant_types_supported: _to_consumable_array$2(providerConfig.grantTypes),
-                    subject_types_supported: _to_consumable_array$2(DEFAULT_OIDC_SUBJECT_TYPES),
-                    id_token_signing_alg_values_supported: _to_consumable_array$2(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
-                    token_endpoint_auth_methods_supported: _to_consumable_array$2(this.tokenEndpointAuthMethodsSupported),
+                    grant_types_supported: _to_consumable_array$4(providerConfig.grantTypes),
+                    subject_types_supported: _to_consumable_array$4(DEFAULT_OIDC_SUBJECT_TYPES),
+                    id_token_signing_alg_values_supported: _to_consumable_array$4(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
+                    token_endpoint_auth_methods_supported: _to_consumable_array$4(this.tokenEndpointAuthMethodsSupported),
                     claims_supported: this.claimsSupported,
-                    code_challenge_methods_supported: _to_consumable_array$2(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
+                    code_challenge_methods_supported: _to_consumable_array$4(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
                 };
             }
         }
@@ -3406,13 +3528,13 @@ OidcProviderConfigService = __decorate([
     __param(2, Inject(FirebaseServerEnvService))
 ], OidcProviderConfigService);
 
-function _array_like_to_array$2(arr, len) {
+function _array_like_to_array$3(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$1(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
+function _array_without_holes$3(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
 }
 function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -3443,12 +3565,12 @@ function _async_to_generator$5(fn) {
         });
     };
 }
-function _class_call_check$6(instance, Constructor) {
+function _class_call_check$8(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$5(target, props) {
+function _defineProperties$6(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3457,11 +3579,11 @@ function _defineProperties$5(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$5(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$5(Constructor.prototype, protoProps);
+function _create_class$6(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$6(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$7(obj, key, value) {
+function _define_property$8(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3474,13 +3596,13 @@ function _define_property$7(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$1(iter) {
+function _iterable_to_array$3(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$1() {
+function _non_iterable_spread$3() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$2(target) {
+function _object_spread$3(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3490,7 +3612,7 @@ function _object_spread$2(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$7(target, key, source[key]);
+            _define_property$8(target, key, source[key]);
         });
     }
     return target;
@@ -3550,16 +3672,16 @@ function _object_without_properties_loose(source, excluded) {
     }
     return target;
 }
-function _to_consumable_array$1(arr) {
-    return _array_without_holes$1(arr) || _iterable_to_array$1(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$1();
+function _to_consumable_array$3(arr) {
+    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$3();
 }
-function _unsupported_iterable_to_array$2(o, minLen) {
+function _unsupported_iterable_to_array$3(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
 }
 function _ts_generator$5(thisArg, body) {
     var f, y, t, _ = {
@@ -3667,14 +3789,14 @@ function _ts_generator$5(thisArg, body) {
  */ var OidcService = /*#__PURE__*/ function() {
     function OidcService(config, providerConfigService, jwksService, accountService, collections, encryptionService) {
         var _this = this;
-        _class_call_check$6(this, OidcService);
-        _define_property$7(this, "config", void 0);
-        _define_property$7(this, "providerConfigService", void 0);
-        _define_property$7(this, "jwksService", void 0);
-        _define_property$7(this, "accountService", void 0);
-        _define_property$7(this, "collections", void 0);
-        _define_property$7(this, "encryptionService", void 0);
-        _define_property$7(this, "_getProvider", cachedGetter(function() {
+        _class_call_check$8(this, OidcService);
+        _define_property$8(this, "config", void 0);
+        _define_property$8(this, "providerConfigService", void 0);
+        _define_property$8(this, "jwksService", void 0);
+        _define_property$8(this, "accountService", void 0);
+        _define_property$8(this, "collections", void 0);
+        _define_property$8(this, "encryptionService", void 0);
+        _define_property$8(this, "_getProvider", cachedGetter(function() {
             return _this._buildProvider();
         }));
         this.config = config;
@@ -3684,7 +3806,7 @@ function _ts_generator$5(thisArg, body) {
         this.collections = collections;
         this.encryptionService = encryptionService;
     }
-    _create_class$5(OidcService, [
+    _create_class$6(OidcService, [
         {
             /**
      * Returns the oidc-provider instance, initializing it on first access.
@@ -3706,14 +3828,27 @@ function _ts_generator$5(thisArg, body) {
      *
      * Mirrors the resolution used by the `Grant`/`Session` TTL functions in {@link buildProviderConfiguration}.
      *
+     * The `serverMaxSeconds` ceiling is tiered by {@link resolveTieredServerMaxSeconds}: a non-admin
+     * caps at the non-admin tier, an admin at the admin tier, and an admin whose grant carries a
+     * service-token scope at the (highest) service-token tier. This tiered value replaces the flat
+     * {@link OidcModuleConfig.maxRequestedLoginDuration} ceiling so a service token can intentionally
+     * exceed it.
+     *
      * @param requestedRawTtl - The raw `dbx_session_ttl` value from `interaction.params`, if any.
      * @param clientPayload - The persisted client metadata, used to read the per-client `dbx_max_session_ttl` cap.
+     * @param tier - Whether the resolving user is an admin and whether the grant carries a service-token scope.
      * @returns The resolved Grant TTL in seconds.
      */ key: "resolveLoginDurationForGrant",
-            value: function resolveLoginDurationForGrant(requestedRawTtl, clientPayload) {
-                var _config_maxRequestedLoginDuration, _config_minRequestedLoginDuration, _config_defaultRequestedLoginDuration;
+            value: function resolveLoginDurationForGrant(requestedRawTtl, clientPayload, tier) {
+                var _config_maxRequestedLoginDurationNonAdmin, _config_maxRequestedLoginDurationAdmin, _config_maxRequestedLoginDurationServiceToken, _config_minRequestedLoginDuration, _config_defaultRequestedLoginDuration;
                 var config = this.config;
-                var serverMaxSeconds = (_config_maxRequestedLoginDuration = config.maxRequestedLoginDuration) !== null && _config_maxRequestedLoginDuration !== void 0 ? _config_maxRequestedLoginDuration : DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS;
+                var serverMaxSeconds = resolveTieredServerMaxSeconds({
+                    isAdmin: tier.isAdmin,
+                    hasServiceScope: tier.hasServiceScope,
+                    nonAdminMax: (_config_maxRequestedLoginDurationNonAdmin = config.maxRequestedLoginDurationNonAdmin) !== null && _config_maxRequestedLoginDurationNonAdmin !== void 0 ? _config_maxRequestedLoginDurationNonAdmin : DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS,
+                    adminMax: (_config_maxRequestedLoginDurationAdmin = config.maxRequestedLoginDurationAdmin) !== null && _config_maxRequestedLoginDurationAdmin !== void 0 ? _config_maxRequestedLoginDurationAdmin : DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS,
+                    serviceTokenMax: (_config_maxRequestedLoginDurationServiceToken = config.maxRequestedLoginDurationServiceToken) !== null && _config_maxRequestedLoginDurationServiceToken !== void 0 ? _config_maxRequestedLoginDurationServiceToken : DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS
+                });
                 var serverMinSeconds = (_config_minRequestedLoginDuration = config.minRequestedLoginDuration) !== null && _config_minRequestedLoginDuration !== void 0 ? _config_minRequestedLoginDuration : DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS;
                 var defaultSeconds = (_config_defaultRequestedLoginDuration = config.defaultRequestedLoginDuration) !== null && _config_defaultRequestedLoginDuration !== void 0 ? _config_defaultRequestedLoginDuration : config.tokenLifetimes.grant;
                 return resolveLoginDurationSeconds({
@@ -3760,7 +3895,7 @@ function _ts_generator$5(thisArg, body) {
                                     // (e.g., `a` for admin, `o` for onboarded) based on the granted scopes.
                                     // Read the account claims baked into the token at issuance time via extraAccessTokenClaims.
                                     accountClaims = (_accessToken_extra = accessToken.extra) !== null && _accessToken_extra !== void 0 ? _accessToken_extra : {};
-                                    token = _object_spread_props(_object_spread$2({}, accountClaims), {
+                                    token = _object_spread_props(_object_spread$3({}, accountClaims), {
                                         // Standard JWT claims — sourced from the access token
                                         aud: firstValue(accessToken.aud),
                                         iss: this.config.issuer,
@@ -3783,7 +3918,7 @@ function _ts_generator$5(thisArg, body) {
                                         uid: accessToken.accountId,
                                         token: token,
                                         rawToken: rawToken,
-                                        oidcValidatedToken: _object_spread$2({
+                                        oidcValidatedToken: _object_spread$3({
                                             sub: accessToken.accountId,
                                             scope: accessToken.scope,
                                             client_id: accessToken.clientId
@@ -3937,10 +4072,10 @@ function _ts_generator$5(thisArg, body) {
                         defaultSeconds: overrideDefaultSeconds !== null && overrideDefaultSeconds !== void 0 ? overrideDefaultSeconds : perModelDefaultSeconds
                     });
                 };
-                return _object_spread_props(_object_spread$2({
-                    routes: _object_spread$2({}, this.providerConfigService.routes),
-                    claims: _object_spread$2({}, providerConfig.claims),
-                    responseTypes: _to_consumable_array$1(providerConfig.responseTypes),
+                return _object_spread_props(_object_spread$3({
+                    routes: _object_spread$3({}, this.providerConfigService.routes),
+                    claims: _object_spread$3({}, providerConfig.claims),
+                    responseTypes: _to_consumable_array$3(providerConfig.responseTypes),
                     pkce: {
                         required: function required() {
                             return true;
@@ -3975,7 +4110,7 @@ function _ts_generator$5(thisArg, body) {
                                         }
                                         return [
                                             2,
-                                            _object_spread$2({
+                                            _object_spread$3({
                                                 scope: info.scope
                                             }, info.audience === undefined ? {} : {
                                                 audience: info.audience
@@ -4069,7 +4204,7 @@ function _ts_generator$5(thisArg, body) {
                                                     logo_uri: client.logo_uri,
                                                     scopes: scopes
                                                 };
-                                                paramsToEncode = _object_spread$2({}, paramsToEncode, interactionLoginDetails);
+                                                paramsToEncode = _object_spread$3({}, paramsToEncode, interactionLoginDetails);
                                             }
                                             _state.label = 3;
                                         case 3:
@@ -4091,11 +4226,29 @@ function _ts_generator$5(thisArg, body) {
                 }, config.renderError ? {
                     renderError: config.renderError
                 } : {}), {
+                    // Setting `rotateRefreshToken` disables oidc-provider's built-in default, so we both honor the
+                    // dbx-components `nonRotatingScopes` extension (service tokens never rotate, keeping a stable
+                    // refresh token for server env consumption) AND replicate the library default for every other
+                    // grant. See `shouldRotateRefreshToken` — keep it in sync on oidc-provider upgrades.
+                    rotateRefreshToken: function rotateRefreshToken(ctx) {
+                        var _providerConfig_nonRotatingScopes, _ref, _ref1, _ref2;
+                        var _refreshToken_totalLifetime, _refreshToken_isSenderConstrained, _refreshToken_ttlPercentagePassed;
+                        var refreshToken = ctx.oidc.entities.RefreshToken;
+                        var client = ctx.oidc.entities.Client;
+                        return shouldRotateRefreshToken({
+                            scope: refreshToken === null || refreshToken === void 0 ? void 0 : refreshToken.scope,
+                            nonRotatingScopes: (_providerConfig_nonRotatingScopes = providerConfig.nonRotatingScopes) !== null && _providerConfig_nonRotatingScopes !== void 0 ? _providerConfig_nonRotatingScopes : [],
+                            totalLifetimeSeconds: (_ref = refreshToken === null || refreshToken === void 0 ? void 0 : (_refreshToken_totalLifetime = refreshToken.totalLifetime) === null || _refreshToken_totalLifetime === void 0 ? void 0 : _refreshToken_totalLifetime.call(refreshToken)) !== null && _ref !== void 0 ? _ref : 0,
+                            clientAuthMethod: client === null || client === void 0 ? void 0 : client.clientAuthMethod,
+                            isSenderConstrained: (_ref1 = refreshToken === null || refreshToken === void 0 ? void 0 : (_refreshToken_isSenderConstrained = refreshToken.isSenderConstrained) === null || _refreshToken_isSenderConstrained === void 0 ? void 0 : _refreshToken_isSenderConstrained.call(refreshToken)) !== null && _ref1 !== void 0 ? _ref1 : false,
+                            ttlPercentagePassed: (_ref2 = refreshToken === null || refreshToken === void 0 ? void 0 : (_refreshToken_ttlPercentagePassed = refreshToken.ttlPercentagePassed) === null || _refreshToken_ttlPercentagePassed === void 0 ? void 0 : _refreshToken_ttlPercentagePassed.call(refreshToken)) !== null && _ref2 !== void 0 ? _ref2 : 0
+                        });
+                    },
                     // Bake account claims into the access token at issuance time so they're
                     // available via `accessToken.extra` during verification without an extra DB call.
                     extraTokenClaims: function extraTokenClaims(_ctx, token) {
                         return _async_to_generator$5(function() {
-                            var accountId, scope, result, account, claims, extraClaims;
+                            var accountId, scope, result, account, claims, extraClaims, _providerConfig_nonRotatingScopes, nonRotatingScopes, scopeSet, provider, grant;
                             return _ts_generator$5(this, function(_state) {
                                 switch(_state.label){
                                     case 0:
@@ -4126,9 +4279,40 @@ function _ts_generator$5(thisArg, body) {
                                             "sub"
                                         ]);
                                         // Filter out undefined values — the Firestore adapter cannot serialize them.
-                                        result = filterUndefinedValues(extraClaims);
+                                        Object.assign(result, filterUndefinedValues(extraClaims));
                                         _state.label = 3;
                                     case 3:
+                                        // Surface the resolved session lifetime + rotation status so clients (e.g. the CLI) can show
+                                        // "valid until <date>, rotation: disabled" without decoding the opaque access token. These ride
+                                        // on `accessToken.extra` and are read back by `verifyAccessToken` and the `GET /oidc/session` route.
+                                        if (scope != null) {
+                                            nonRotatingScopes = (_providerConfig_nonRotatingScopes = providerConfig.nonRotatingScopes) !== null && _providerConfig_nonRotatingScopes !== void 0 ? _providerConfig_nonRotatingScopes : [];
+                                            scopeSet = new Set(scope.split(' ').filter(Boolean));
+                                            result[DBX_FIREBASE_SERVER_OIDC_ROTATION_DISABLED_CLAIM] = nonRotatingScopes.some(function(nonRotatingScope) {
+                                                return scopeSet.has(nonRotatingScope);
+                                            });
+                                        }
+                                        if (!token.grantId) return [
+                                            3,
+                                            6
+                                        ];
+                                        return [
+                                            4,
+                                            this.getProvider()
+                                        ];
+                                    case 4:
+                                        provider = _state.sent();
+                                        return [
+                                            4,
+                                            provider.Grant.find(token.grantId)
+                                        ];
+                                    case 5:
+                                        grant = _state.sent();
+                                        if ((grant === null || grant === void 0 ? void 0 : grant.exp) != null && Number.isFinite(grant.exp)) {
+                                            result[DBX_FIREBASE_SERVER_OIDC_SESSION_EXPIRES_AT_CLAIM] = grant.exp;
+                                        }
+                                        _state.label = 6;
+                                    case 6:
                                         return [
                                             2,
                                             result
@@ -4187,7 +4371,7 @@ function _ts_generator$5(thisArg, body) {
                                 ];
                             case 4:
                                 _ref = _state.sent(), ProviderClass = _ref.default;
-                                provider = new ProviderClass(config.issuer, _object_spread_props(_object_spread$2({}, providerConfiguration), {
+                                provider = new ProviderClass(config.issuer, _object_spread_props(_object_spread$3({}, providerConfiguration), {
                                     adapter: adapterFactory,
                                     findAccount: findAccount,
                                     jwks: {
@@ -4225,12 +4409,12 @@ OidcService = __decorate([
     __param(5, Inject(OidcEncryptionService))
 ], OidcService);
 
-function _class_call_check$5(instance, Constructor) {
+function _class_call_check$7(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _define_property$6(obj, key, value) {
+function _define_property$7(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4268,14 +4452,14 @@ function _define_property$6(obj, key, value) {
  * export class MyApiModule {}
  * ```
  */ var OidcAuthMiddlewareConfig = function OidcAuthMiddlewareConfig() {
-    _class_call_check$5(this, OidcAuthMiddlewareConfig);
+    _class_call_check$7(this, OidcAuthMiddlewareConfig);
     /**
      * Path prefixes that require OAuth bearer token verification.
      *
      * Only requests matching one of these prefixes will be checked.
      * Paths under the global API route prefix should not be included
      * since those are protected by AppCheck.
-     */ _define_property$6(this, "protectedPaths", void 0);
+     */ _define_property$7(this, "protectedPaths", void 0);
     /**
      * Absolute URL of the OAuth 2.0 Protected Resource Metadata document
      * (RFC 9728). When set, included as the `resource_metadata` parameter
@@ -4283,7 +4467,7 @@ function _define_property$6(obj, key, value) {
      * clients can locate the discovery doc explicitly rather than relying on
      * origin-rooted path-walkback (which fails when the function isn't
      * mounted at `/` — e.g. behind the Firebase Functions emulator URL prefix).
-     */ _define_property$6(this, "resourceMetadataUrl", void 0);
+     */ _define_property$7(this, "resourceMetadataUrl", void 0);
 };
 // MARK: WWW-Authenticate
 /**
@@ -4423,12 +4607,12 @@ function _async_to_generator$4(fn) {
         });
     };
 }
-function _class_call_check$4(instance, Constructor) {
+function _class_call_check$6(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
-function _defineProperties$4(target, props) {
+function _defineProperties$5(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -4437,11 +4621,11 @@ function _defineProperties$4(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$4(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$4(Constructor.prototype, protoProps);
+function _create_class$5(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$5(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$5(obj, key, value) {
+function _define_property$6(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4591,14 +4775,14 @@ function _ts_generator$4(thisArg, body) {
  * @throws {UnauthorizedException} When the Authorization header is missing, malformed, or the token is invalid/expired.
  */ var OidcAuthBearerTokenMiddleware = /*#__PURE__*/ function() {
     function OidcAuthBearerTokenMiddleware(oidcService, config) {
-        _class_call_check$4(this, OidcAuthBearerTokenMiddleware);
-        _define_property$5(this, "oidcService", void 0);
-        _define_property$5(this, "config", void 0);
-        _define_property$5(this, "logger", new Logger('OidcAuthBearerTokenMiddleware'));
+        _class_call_check$6(this, OidcAuthBearerTokenMiddleware);
+        _define_property$6(this, "oidcService", void 0);
+        _define_property$6(this, "config", void 0);
+        _define_property$6(this, "logger", new Logger('OidcAuthBearerTokenMiddleware'));
         this.oidcService = oidcService;
         this.config = config;
     }
-    _create_class$4(OidcAuthBearerTokenMiddleware, [
+    _create_class$5(OidcAuthBearerTokenMiddleware, [
         {
             key: "use",
             value: function use(req, res, next) {
@@ -4719,19 +4903,328 @@ OidcAuthBearerTokenMiddleware = __decorate([
     });
 }
 
-// MARK: Scopes
 /**
- * Reads the set of OIDC scopes carried by a callable request's bearer token.
+ * Default prefix prepended to every resolved OIDC analytics event name forwarded
+ * to the downstream analytics pipeline (e.g. `'OIDC ' + 'Login'` → `'OIDC Login'`).
+ */ var DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX = 'OIDC ';
+/**
+ * Default per-type downstream event name parts (the {@link DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX}
+ * is prepended at send time).
+ */ var DEFAULT_OIDC_ANALYTICS_EVENT_NAMES = {
+    login: 'Login',
+    consent: 'Consent'
+};
+/**
+ * NestJS injection token for the optional {@link FirebaseServerOidcAnalyticsConfig} provider.
  *
- * The `ModelApiCallModelDispatchService` builds a synthetic `CallableRequest` with
- * `auth.token = oidcValidatedToken ?? {}`, so the OIDC scope string lives at
- * `request.auth.token.scope` for OIDC callers and is `undefined` for non-OIDC
- * (regular Firebase ID-token) callers.
+ * @example
+ * ```typescript
+ * @Module(appOidcAnalyticsModuleMetadata({ oidcAnalyticsConfig: { eventNamePrefix: 'OIDC ', logEvents: true } }))
+ * export class AppOidcAnalyticsModule {}
+ * ```
+ */ var FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG = 'FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG';
+
+function _class_call_check$5(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+/**
+ * Abstract analytics service that apps implement to process OIDC analytics events.
  *
- * Returning `undefined` for non-OIDC callers lets callers (e.g. `oidcCallModelScopePreAssert`)
- * skip scope enforcement instead of falsely treating the missing claim as "no scopes granted".
+ * Analogous to the MCP `McpAnalyticsService` but scoped to the OIDC/OAuth transport.
+ * Apps extend this class and provide it via {@link OIDC_ANALYTICS_SERVICE}.
+ */ var OidcAnalyticsService = function OidcAnalyticsService() {
+    _class_call_check$5(this, OidcAnalyticsService);
+};
+/**
+ * Injection token for the OIDC analytics service.
  *
- * The parameter is intentionally typed as `unknown` because `DecodedIdToken` (Firebase
+ * Apps provide this (typically via {@link appOidcAnalyticsModuleMetadata} on a `@Global()`
+ * module) to enable analytics in the OIDC dispatch chain. When absent, the OIDC emitters
+ * fall back to {@link noopOidcAnalyticsService}.
+ */ var OIDC_ANALYTICS_SERVICE = 'OIDC_ANALYTICS_SERVICE';
+/**
+ * Creates a no-op {@link OidcAnalyticsService} that silently discards all events.
+ *
+ * Used as the default fallback by the OIDC emitters when no analytics service is registered.
+ *
+ * @returns An {@link OidcAnalyticsService} that discards all analytics events.
+ * @__NO_SIDE_EFFECTS__
+ */ function noopOidcAnalyticsService() {
+    return {
+        handleOidcAnalyticsEvent: function handleOidcAnalyticsEvent() {
+            return undefined;
+        }
+    };
+}
+/**
+ * Forwards an {@link OidcAnalyticsEvent} to the given service, fail-soft.
+ *
+ * A throwing analytics handler must never break the underlying OIDC operation, so the
+ * handler invocation is wrapped — on error a warning is logged and the error is swallowed.
+ * Mirrors the MCP `_emitMcpAnalytics` discipline, factored to a free function because the
+ * OIDC events fire from several emitters.
+ *
+ * @param service - The analytics service to forward to.
+ * @param event - The event to emit.
+ * @param logger - The emitter's logger, used to warn when the handler throws.
+ */ function emitOidcAnalyticsEvent(service, event, logger) {
+    try {
+        service.handleOidcAnalyticsEvent(event);
+    } catch (error) {
+        logger.warn("OIDC analytics handler threw for event ".concat(event.type, "; ignoring: ").concat(error));
+    }
+}
+
+function _assert_this_initialized(self) {
+    if (self === void 0) {
+        throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
+    }
+    return self;
+}
+function _call_super(_this, derived, args) {
+    derived = _get_prototype_of(derived);
+    return _possible_constructor_return(_this, _is_native_reflect_construct() ? Reflect.construct(derived, [], _get_prototype_of(_this).constructor) : derived.apply(_this, args));
+}
+function _class_call_check$4(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties$4(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class$4(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$4(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$5(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _get_prototype_of(o) {
+    _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
+        return o.__proto__ || Object.getPrototypeOf(o);
+    };
+    return _get_prototype_of(o);
+}
+function _inherits(subClass, superClass) {
+    if (typeof superClass !== "function" && superClass !== null) {
+        throw new TypeError("Super expression must either be null or a function");
+    }
+    subClass.prototype = Object.create(superClass && superClass.prototype, {
+        constructor: {
+            value: subClass,
+            writable: true,
+            configurable: true
+        }
+    });
+    if (superClass) _set_prototype_of(subClass, superClass);
+}
+function _object_spread$2(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$5(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function _possible_constructor_return(self, call) {
+    if (call && (_type_of(call) === "object" || typeof call === "function")) {
+        return call;
+    }
+    return _assert_this_initialized(self);
+}
+function _set_prototype_of(o, p) {
+    _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o, p) {
+        o.__proto__ = p;
+        return o;
+    };
+    return _set_prototype_of(o, p);
+}
+function _type_of(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+function _is_native_reflect_construct() {
+    try {
+        var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {}));
+    } catch (_) {}
+    return (_is_native_reflect_construct = function() {
+        return !!result;
+    })();
+}
+var FirebaseServerOidcAnalyticsService_1;
+/**
+ * Reusable {@link OidcAnalyticsService} that forwards each high-level OIDC event to the app's
+ * {@link FirebaseServerAnalyticsService}, so OIDC-transport analytics feed the same downstream
+ * pipeline (e.g. Segment) as model and MCP analytics.
+ *
+ * Each {@link OidcAnalyticsEvent.type} resolves to a distinct downstream event name
+ * (`eventNamePrefix` + per-type name, e.g. `'OIDC Login'`). Registered globally via
+ * {@link appOidcAnalyticsModuleMetadata}; tuned via {@link FirebaseServerOidcAnalyticsConfig}.
+ * When no analytics service is available the call is a no-op aside from the optional log line.
+ */ var FirebaseServerOidcAnalyticsService = FirebaseServerOidcAnalyticsService_1 = /*#__PURE__*/ function(OidcAnalyticsService) {
+    _inherits(FirebaseServerOidcAnalyticsService, OidcAnalyticsService);
+    function FirebaseServerOidcAnalyticsService(firebaseServerEnvService, analyticsService, config) {
+        _class_call_check$4(this, FirebaseServerOidcAnalyticsService);
+        var _this;
+        var _ref, _ref1;
+        _this = _call_super(this, FirebaseServerOidcAnalyticsService), _define_property$5(_this, "firebaseServerEnvService", void 0), _define_property$5(_this, "analyticsService", void 0), _define_property$5(_this, "_logger", new Logger(FirebaseServerOidcAnalyticsService_1.name)), _define_property$5(_this, "_eventNamePrefix", void 0), _define_property$5(_this, "_eventNames", void 0), _define_property$5(_this, "_logEvents", void 0);
+        _this.firebaseServerEnvService = firebaseServerEnvService;
+        _this.analyticsService = analyticsService;
+        _this._eventNamePrefix = (_ref = config === null || config === void 0 ? void 0 : config.eventNamePrefix) !== null && _ref !== void 0 ? _ref : DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX;
+        _this._eventNames = _object_spread$2({}, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, config === null || config === void 0 ? void 0 : config.eventNames);
+        _this._logEvents = (_ref1 = config === null || config === void 0 ? void 0 : config.logEvents) !== null && _ref1 !== void 0 ? _ref1 : !_this.firebaseServerEnvService.isProduction;
+        return _this;
+    }
+    _create_class$4(FirebaseServerOidcAnalyticsService, [
+        {
+            key: "handleOidcAnalyticsEvent",
+            value: function handleOidcAnalyticsEvent(event) {
+                var _this__eventNames_event_type;
+                var name = "".concat(this._eventNamePrefix).concat((_this__eventNames_event_type = this._eventNames[event.type]) !== null && _this__eventNames_event_type !== void 0 ? _this__eventNames_event_type : event.type);
+                if (this._logEvents) {
+                    var uidSuffix = event.uid ? " uid=".concat(event.uid) : '';
+                    var durationSuffix = event.durationMs != null ? " (".concat(event.durationMs, "ms)") : '';
+                    var outcome = event.isSuccessful ? 'Succeeded' : 'Failed';
+                    var reasonSuffix = event.reason ? " reason=".concat(event.reason) : '';
+                    this._logger.log("".concat(name, " ").concat(outcome).concat(uidSuffix).concat(reasonSuffix).concat(durationSuffix));
+                }
+                if (this.analyticsService != null) {
+                    var _event_clientId, _event_serviceToken, _event_isAdmin, _event_denied, _event_reason;
+                    // Drop undefined values so the downstream payload stays clean.
+                    var data = filterUndefinedValues({
+                        clientId: (_event_clientId = event.clientId) !== null && _event_clientId !== void 0 ? _event_clientId : undefined,
+                        scopes: event.scopes != null && event.scopes.length > 0 ? event.scopes.join(' ') : undefined,
+                        serviceToken: (_event_serviceToken = event.serviceToken) !== null && _event_serviceToken !== void 0 ? _event_serviceToken : undefined,
+                        isAdmin: (_event_isAdmin = event.isAdmin) !== null && _event_isAdmin !== void 0 ? _event_isAdmin : undefined,
+                        denied: (_event_denied = event.denied) !== null && _event_denied !== void 0 ? _event_denied : undefined,
+                        reason: (_event_reason = event.reason) !== null && _event_reason !== void 0 ? _event_reason : undefined,
+                        success: event.isSuccessful
+                    });
+                    this.analyticsService.sendEventData(event.uid, name, data);
+                }
+            }
+        }
+    ]);
+    return FirebaseServerOidcAnalyticsService;
+}(OidcAnalyticsService);
+FirebaseServerOidcAnalyticsService = FirebaseServerOidcAnalyticsService_1 = __decorate([
+    Injectable(),
+    __param(0, Inject(FirebaseServerEnvService)),
+    __param(1, Optional()),
+    __param(1, Inject(FirebaseServerAnalyticsService)),
+    __param(2, Optional()),
+    __param(2, Inject(FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG))
+], FirebaseServerOidcAnalyticsService);
+
+function _array_like_to_array$2(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$2(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
+}
+function _iterable_to_array$2(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$2() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array$2(arr) {
+    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$2();
+}
+function _unsupported_iterable_to_array$2(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
+}
+/**
+ * Generates NestJS module metadata that registers {@link FirebaseServerOidcAnalyticsService} as the
+ * OIDC analytics consumer, aliased to {@link OIDC_ANALYTICS_SERVICE}.
+ *
+ * Mirrors the convention used by `appMcpAnalyticsModuleMetadata`. Requires no dependency module —
+ * `FirebaseServerAnalyticsService` is resolved optionally and is expected to be supplied globally by
+ * the app's analytics module.
+ *
+ * Decorate a `@Global()` module with the result so the `OIDC_ANALYTICS_SERVICE` token is visible to
+ * the OIDC controllers and services provided by the app's OIDC module.
+ *
+ * @param config - Optional metadata + analytics config to merge in.
+ * @returns NestJS module metadata providing + exporting the OIDC analytics service and token.
+ *
+ * @example
+ * ```typescript
+ * @Global()
+ * @Module(appOidcAnalyticsModuleMetadata())
+ * export class AppOidcAnalyticsModule {}
+ * ```
+ */ function appOidcAnalyticsModuleMetadata() {
+    var config = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
+    var oidcAnalyticsConfig = config.oidcAnalyticsConfig, imports = config.imports, exports = config.exports, providers = config.providers;
+    var configProviders = oidcAnalyticsConfig ? [
+        {
+            provide: FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG,
+            useValue: oidcAnalyticsConfig
+        }
+    ] : [];
+    return {
+        imports: _to_consumable_array$2(imports !== null && imports !== void 0 ? imports : []),
+        exports: [
+            OIDC_ANALYTICS_SERVICE,
+            FirebaseServerOidcAnalyticsService
+        ].concat(_to_consumable_array$2(exports !== null && exports !== void 0 ? exports : [])),
+        providers: [
+            FirebaseServerOidcAnalyticsService,
+            {
+                provide: OIDC_ANALYTICS_SERVICE,
+                useExisting: FirebaseServerOidcAnalyticsService
+            }
+        ].concat(_to_consumable_array$2(configProviders), _to_consumable_array$2(providers !== null && providers !== void 0 ? providers : []))
+    };
+}
+
+// MARK: Scopes
+/**
+ * Reads the set of OIDC scopes carried by a callable request's bearer token.
+ *
+ * The `ModelApiCallModelDispatchService` builds a synthetic `CallableRequest` with
+ * `auth.token = oidcValidatedToken ?? {}`, so the OIDC scope string lives at
+ * `request.auth.token.scope` for OIDC callers and is `undefined` for non-OIDC
+ * (regular Firebase ID-token) callers.
+ *
+ * Returning `undefined` for non-OIDC callers lets callers (e.g. `oidcCallModelScopePreAssert`)
+ * skip scope enforcement instead of falsely treating the missing claim as "no scopes granted".
+ *
+ * The parameter is intentionally typed as `unknown` because `DecodedIdToken` (Firebase
  * Auth's typed token shape) does not declare a `scope` field, while OIDC bearer-token
  * callers attach one at runtime. Reading is done defensively.
  *
@@ -5017,7 +5510,7 @@ function _ts_generator$3(thisArg, body) {
      * @param result - The interaction results to apply.
      * @param options - Optional settings for merging with the last submission.
      * @param options.mergeWithLastSubmission - Whether to merge with the last submission (defaults to true)
-     * @returns The `returnTo` URL that the client should redirect to.
+     * @returns The interaction that was completed. It includes the returnTo property for the next step of the interaction.
      */ function finishInteractionByUid(uid, result, options) {
                 return _async_to_generator$3(function() {
                     var _ref, interaction, mergeWithLastSubmission;
@@ -5044,7 +5537,7 @@ function _ts_generator$3(thisArg, body) {
                                 _state.sent();
                                 return [
                                     2,
-                                    interaction.returnTo
+                                    interaction
                                 ];
                         }
                     });
@@ -5134,6 +5627,9 @@ function _array_like_to_array$1(arr, len) {
 function _array_with_holes(arr) {
     if (Array.isArray(arr)) return arr;
 }
+function _array_without_holes$1(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$1(arr);
+}
 function asyncGeneratorStep$2(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -5202,6 +5698,9 @@ function _instanceof(left, right) {
         return left instanceof right;
     }
 }
+function _iterable_to_array$1(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
 function _iterable_to_array_limit(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
@@ -5229,9 +5728,15 @@ function _iterable_to_array_limit(arr, i) {
 function _non_iterable_rest() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
+function _non_iterable_spread$1() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
 function _sliced_to_array(arr, i) {
     return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array$1(arr, i) || _non_iterable_rest();
 }
+function _to_consumable_array$1(arr) {
+    return _array_without_holes$1(arr) || _iterable_to_array$1(arr) || _unsupported_iterable_to_array$1(arr) || _non_iterable_spread$1();
+}
 function _unsupported_iterable_to_array$1(o, minLen) {
     if (!o) return;
     if (typeof o === "string") return _array_like_to_array$1(o, minLen);
@@ -5339,6 +5844,7 @@ function _ts_generator$2(thisArg, body) {
         };
     }
 }
+var OidcInteractionController_1;
 /**
  * OIDC scopes that the server always grants on consent when they were
  * requested, regardless of whether the frontend included them in
@@ -5357,17 +5863,20 @@ function _ts_generator$2(thisArg, body) {
  * The POST endpoints are called by the frontend app. They verify the user's
  * Firebase Auth ID token and bypass the oidc-provider interaction cookie
  * (which is scoped to the frontend path set by `interactions.url`).
- */ var OidcInteractionController = /*#__PURE__*/ function() {
-    function OidcInteractionController(oidcInteractionService, oidcProviderConfigService, accountService, oidcService) {
+ */ var OidcInteractionController = OidcInteractionController_1 = /*#__PURE__*/ function() {
+    function OidcInteractionController(oidcInteractionService, oidcProviderConfigService, accountService, oidcService, analytics) {
         _class_call_check$2(this, OidcInteractionController);
         _define_property$3(this, "oidcInteractionService", void 0);
         _define_property$3(this, "oidcProviderConfigService", void 0);
         _define_property$3(this, "accountService", void 0);
         _define_property$3(this, "oidcService", void 0);
+        _define_property$3(this, "_logger", new Logger(OidcInteractionController_1.name));
+        _define_property$3(this, "_analytics", void 0);
         this.oidcInteractionService = oidcInteractionService;
         this.oidcProviderConfigService = oidcProviderConfigService;
         this.accountService = accountService;
         this.oidcService = oidcService;
+        this._analytics = analytics !== null && analytics !== void 0 ? analytics : noopOidcAnalyticsService();
     }
     _create_class$2(OidcInteractionController, [
         {
@@ -5433,23 +5942,45 @@ function _ts_generator$2(thisArg, body) {
      * @throws {HttpException} HTTP 400 when the login interaction cannot be completed.
      */ function postLogin(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var accountId, redirectTo;
+                    var startedAt, accountId, err, interaction, err1;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
+                                startedAt = Date.now();
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
                                 return [
                                     4,
                                     this._verifyIdToken(body.idToken)
                                 ];
-                            case 1:
-                                accountId = _state.sent();
-                                _state.label = 2;
                             case 2:
+                                accountId = _state.sent();
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 3:
+                                err = _state.sent();
+                                emitOidcAnalyticsEvent(this._analytics, {
+                                    type: 'login',
+                                    isSuccessful: false,
+                                    reason: 'invalid_id_token',
+                                    error: err,
+                                    durationMs: Date.now() - startedAt
+                                }, this._logger);
+                                throw err;
+                            case 4:
                                 _state.trys.push([
-                                    2,
                                     4,
+                                    6,
                                     ,
-                                    5
+                                    7
                                 ]);
                                 return [
                                     4,
@@ -5461,19 +5992,33 @@ function _ts_generator$2(thisArg, body) {
                                         mergeWithLastSubmission: false
                                     })
                                 ];
-                            case 3:
-                                redirectTo = _state.sent();
+                            case 5:
+                                interaction = _state.sent();
+                                emitOidcAnalyticsEvent(this._analytics, {
+                                    type: 'login',
+                                    isSuccessful: true,
+                                    uid: accountId,
+                                    durationMs: Date.now() - startedAt
+                                }, this._logger);
                                 res.json({
-                                    redirectTo: redirectTo
+                                    redirectTo: interaction.returnTo
                                 });
                                 return [
                                     3,
-                                    5
+                                    7
                                 ];
-                            case 4:
-                                _state.sent();
+                            case 6:
+                                err1 = _state.sent();
+                                emitOidcAnalyticsEvent(this._analytics, {
+                                    type: 'login',
+                                    isSuccessful: false,
+                                    uid: accountId,
+                                    reason: 'login_interaction_failed',
+                                    error: err1,
+                                    durationMs: Date.now() - startedAt
+                                }, this._logger);
                                 throw new HttpException('Login interaction failed', HttpStatus.BAD_REQUEST);
-                            case 5:
+                            case 7:
                                 return [
                                     2
                                 ];
@@ -5496,10 +6041,11 @@ function _ts_generator$2(thisArg, body) {
      * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var _ref, _ref1, _prompt_details_missingOIDCScope, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, redirectTo, interaction, prompt, params, session, clientId, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, encounteredOIDCScopes, missingOIDCScope, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, redirectTo1, err;
+                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref3, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, requestedOIDCScopeSet, adminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref4, redirectTo1, requestedRawTtl, clientPayload, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref5, redirectTo2, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
+                                startedAt = Date.now();
                                 return [
                                     4,
                                     this._verifyIdToken(body.idToken)
@@ -5510,9 +6056,9 @@ function _ts_generator$2(thisArg, body) {
                             case 2:
                                 _state.trys.push([
                                     2,
-                                    10,
+                                    20,
                                     ,
-                                    11
+                                    21
                                 ]);
                                 if (!!body.approved) return [
                                     3,
@@ -5528,7 +6074,7 @@ function _ts_generator$2(thisArg, body) {
                                     })
                                 ];
                             case 3:
-                                redirectTo = _state.sent();
+                                _ref3 = _state.sent(), redirectTo = _ref3.returnTo;
                                 res.json({
                                     redirectTo: redirectTo
                                 });
@@ -5544,35 +6090,131 @@ function _ts_generator$2(thisArg, body) {
                                 interaction = _state.sent();
                                 prompt = interaction.prompt, params = interaction.params, session = interaction.session;
                                 clientId = params.client_id;
+                                accountId = (_ref = session === null || session === void 0 ? void 0 : session.accountId) !== null && _ref !== void 0 ? _ref : '';
+                                missingOIDCScope = (_prompt_details_missingOIDCScope = prompt.details.missingOIDCScope) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [];
+                                if (!interaction.grantId) return [
+                                    3,
+                                    7
+                                ];
+                                return [
+                                    4,
+                                    this.oidcInteractionService.findOrCreateGrant(interaction.grantId, accountId, clientId)
+                                ];
+                            case 6:
+                                _tmp = _state.sent();
+                                return [
+                                    3,
+                                    8
+                                ];
+                            case 7:
+                                _tmp = undefined;
+                                _state.label = 8;
+                            case 8:
+                                existingGrant = _tmp;
+                                // Encountered = scopes/claims already granted (or rejected) on the existing Grant. oidc-provider
+                                // excludes these from `missingOIDCScope` etc. when the consent prompt is re-shown via `prompt=consent`,
+                                // but the consent UI sources its checkbox list from the auth URL's `scope=` param (the full request set)
+                                // and re-submits them all. We accept already-encountered values as silent no-ops so a re-consent on a
+                                // client the user has previously authorized doesn't fail validation.
+                                encounteredOIDCScopes = existingGrant ? existingGrant.getOIDCScopeEncountered().split(' ').filter(Boolean) : [];
+                                // Admin-only scope gate. The requested OIDC scope set is `missingOIDCScope ∪ encounteredOIDCScopes`
+                                // (a fresh consent has everything in `missing`; a re-consent may carry already-granted scopes in
+                                // `encountered`). If that set intersects the provider's `adminOnlyScopes` and the resolving user is
+                                // not an admin, hard-reject with `access_denied` rather than silently dropping the scope.
+                                requestedOIDCScopeSet = new Set(_to_consumable_array$1(missingOIDCScope).concat(_to_consumable_array$1(encounteredOIDCScopes)));
+                                adminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
+                                requestsServiceToken = adminOnlyScopes.some(function(scope) {
+                                    return requestedOIDCScopeSet.has(scope);
+                                });
+                                if (!accountId) return [
+                                    3,
+                                    10
+                                ];
+                                return [
+                                    4,
+                                    (_ref1 = (_this_accountService_delegate_isAdminUser = (_this_accountService_delegate = this.accountService.delegate).isAdminUser) === null || _this_accountService_delegate_isAdminUser === void 0 ? void 0 : _this_accountService_delegate_isAdminUser.call(_this_accountService_delegate, this.accountService.userContext(accountId).authUserContext)) !== null && _ref1 !== void 0 ? _ref1 : false
+                                ];
+                            case 9:
+                                _tmp1 = _state.sent();
+                                return [
+                                    3,
+                                    11
+                                ];
+                            case 10:
+                                _tmp1 = false;
+                                _state.label = 11;
+                            case 11:
+                                isAdmin = _tmp1;
+                                if (!(requestsServiceToken && !isAdmin)) return [
+                                    3,
+                                    13
+                                ];
+                                return [
+                                    4,
+                                    this.oidcInteractionService.finishInteractionByUid(uid, {
+                                        error: 'access_denied',
+                                        error_description: 'token.service is restricted to admins.'
+                                    }, {
+                                        mergeWithLastSubmission: true
+                                    })
+                                ];
+                            case 12:
+                                _ref4 = _state.sent(), redirectTo1 = _ref4.returnTo;
+                                emitOidcAnalyticsEvent(this._analytics, {
+                                    type: 'consent',
+                                    isSuccessful: false,
+                                    uid: accountId,
+                                    clientId: clientId,
+                                    serviceToken: true,
+                                    isAdmin: false,
+                                    reason: 'service_token_non_admin',
+                                    durationMs: Date.now() - startedAt
+                                }, this._logger);
+                                res.json({
+                                    redirectTo: redirectTo1
+                                });
+                                return [
+                                    2
+                                ];
+                            case 13:
                                 // Resolve the requested login duration up-front. The configured Grant TTL function (in
                                 // OidcService.buildProviderConfiguration) only fires when oidc-provider's koa middleware
                                 // drives `grant.save()`, so its `ctx.oidc.params` lookup of `dbx_session_ttl` returns
                                 // undefined when the consent submit runs in this controller. We pre-set `expiresIn` on
-                                // newly-created grants so they persist with the correct TTL.
+                                // newly-created grants so they persist with the correct (tiered) TTL.
                                 requestedRawTtl = params[DBX_FIREBASE_SERVER_OIDC_SESSION_TTL_PARAM];
                                 return [
                                     4,
                                     this.oidcService.findClientPayload(clientId)
                                 ];
-                            case 6:
+                            case 14:
                                 clientPayload = _state.sent();
-                                clientMaxSessionTtl = (_ref = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_max_session_ttl) !== null && _ref !== void 0 ? _ref : undefined;
+                                clientMaxSessionTtl = (_ref2 = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_max_session_ttl) !== null && _ref2 !== void 0 ? _ref2 : undefined;
                                 expiresInSeconds = this.oidcService.resolveLoginDurationForGrant(requestedRawTtl, {
                                     dbx_max_session_ttl: clientMaxSessionTtl
+                                }, {
+                                    isAdmin: isAdmin,
+                                    hasServiceScope: requestsServiceToken
                                 });
+                                if (!(existingGrant !== null && existingGrant !== void 0)) return [
+                                    3,
+                                    15
+                                ];
+                                _tmp2 = existingGrant;
+                                return [
+                                    3,
+                                    17
+                                ];
+                            case 15:
                                 return [
                                     4,
-                                    this.oidcInteractionService.findOrCreateGrant(interaction.grantId, (_ref1 = session === null || session === void 0 ? void 0 : session.accountId) !== null && _ref1 !== void 0 ? _ref1 : '', clientId, expiresInSeconds)
+                                    this.oidcInteractionService.findOrCreateGrant(interaction.grantId, accountId, clientId, expiresInSeconds)
                                 ];
-                            case 7:
-                                grant = _state.sent();
-                                // Encountered = scopes/claims already granted (or rejected) on the existing Grant. oidc-provider
-                                // excludes these from `missingOIDCScope` etc. when the consent prompt is re-shown via `prompt=consent`,
-                                // but the consent UI sources its checkbox list from the auth URL's `scope=` param (the full request set)
-                                // and re-submits them all. We accept already-encountered values as silent no-ops so a re-consent on a
-                                // client the user has previously authorized doesn't fail validation.
-                                encounteredOIDCScopes = grant.getOIDCScopeEncountered().split(' ').filter(Boolean);
-                                missingOIDCScope = (_prompt_details_missingOIDCScope = prompt.details.missingOIDCScope) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [];
+                            case 16:
+                                _tmp2 = _state.sent();
+                                _state.label = 17;
+                            case 17:
+                                grant = _tmp2;
                                 if (missingOIDCScope.length > 0) {
                                     _resolveEffectiveSubset = resolveEffectiveSubset({
                                         missing: missingOIDCScope,
@@ -5674,7 +6316,7 @@ function _ts_generator$2(thisArg, body) {
                                     4,
                                     grant.save()
                                 ];
-                            case 8:
+                            case 18:
                                 grantId = _state.sent();
                                 return [
                                     4,
@@ -5686,22 +6328,41 @@ function _ts_generator$2(thisArg, body) {
                                         mergeWithLastSubmission: true
                                     })
                                 ];
-                            case 9:
-                                redirectTo1 = _state.sent();
+                            case 19:
+                                _ref5 = _state.sent(), redirectTo2 = _ref5.returnTo;
+                                emitOidcAnalyticsEvent(this._analytics, {
+                                    type: 'consent',
+                                    isSuccessful: true,
+                                    uid: accountId,
+                                    clientId: clientId,
+                                    scopes: Array.from(requestedOIDCScopeSet),
+                                    serviceToken: requestsServiceToken,
+                                    isAdmin: isAdmin,
+                                    durationMs: Date.now() - startedAt
+                                }, this._logger);
                                 res.json({
-                                    redirectTo: redirectTo1
+                                    redirectTo: redirectTo2
                                 });
                                 return [
                                     3,
-                                    11
+                                    21
                                 ];
-                            case 10:
+                            case 20:
                                 err = _state.sent();
+                                emitOidcAnalyticsEvent(this._analytics, {
+                                    type: 'consent',
+                                    isSuccessful: false,
+                                    uid: accountId,
+                                    clientId: clientId,
+                                    reason: 'consent_interaction_failed',
+                                    error: err,
+                                    durationMs: Date.now() - startedAt
+                                }, this._logger);
                                 if (_instanceof(err, HttpException)) {
                                     throw err;
                                 }
                                 throw new HttpException('Consent interaction failed', HttpStatus.BAD_REQUEST);
-                            case 11:
+                            case 21:
                                 return [
                                     2
                                 ];
@@ -5776,12 +6437,14 @@ __decorate([
     __param(1, Body()),
     __param(2, Res())
 ], OidcInteractionController.prototype, "postConsent", null);
-OidcInteractionController = __decorate([
+OidcInteractionController = OidcInteractionController_1 = __decorate([
     Controller('interaction'),
     __param(0, Inject(OidcInteractionService)),
     __param(1, Inject(OidcProviderConfigService)),
     __param(2, Inject(OidcAccountService)),
-    __param(3, Inject(OidcService))
+    __param(3, Inject(OidcService)),
+    __param(4, Optional()),
+    __param(4, Inject(OIDC_ANALYTICS_SERVICE))
 ], OidcInteractionController);
 /**
  * Resolves the effective set to grant — and the complementary set to
@@ -6092,6 +6755,69 @@ function _ts_generator$1(thisArg, body) {
                 }));
             }
         },
+        {
+            key: "getSession",
+            value: /**
+     * GET /oidc/session.
+     *
+     * Read route that verifies the presented bearer access token and returns its resolved session
+     * lifetime metadata: `{ sub, scope, expiresAt, rotationDisabled }`. `expiresAt` is the grant's
+     * expiry (unix seconds) and `rotationDisabled` flags a non-rotating (service) token. The values
+     * are sourced from the access token's baked-in `extra` claims (see `extraTokenClaims`), so this
+     * does not require decoding the opaque token client-side — cleaner than userinfo, which does not
+     * echo access-token `extra`.
+     *
+     * Declared ahead of the `@All('{*path}')` catch-all so it is matched here rather than proxied to
+     * the oidc-provider callback (mirrors `GET /oidc/login/client`).
+     *
+     * @param req - Inbound request; the `Authorization: Bearer <token>` header is read for the access token.
+     * @param res - Express response used to send the session JSON (401 when the token is missing/invalid).
+     */ function getSession(req, res) {
+                return _async_to_generator$1(function() {
+                    var _exec_, _exec, rawAuthHeader, authHeader, bearer, handled, authData, _token_scope, _token_DBX_FIREBASE_SERVER_OIDC_SESSION_EXPIRES_AT_CLAIM, _token_DBX_FIREBASE_SERVER_OIDC_ROTATION_DISABLED_CLAIM, token;
+                    return _ts_generator$1(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                rawAuthHeader = req.headers['authorization'];
+                                authHeader = Array.isArray(rawAuthHeader) ? rawAuthHeader[0] : rawAuthHeader;
+                                bearer = (_exec = /^Bearer\s+(.+)$/i.exec(authHeader !== null && authHeader !== void 0 ? authHeader : '')) === null || _exec === void 0 ? void 0 : (_exec_ = _exec[1]) === null || _exec_ === void 0 ? void 0 : _exec_.trim();
+                                handled = false;
+                                if (!bearer) return [
+                                    3,
+                                    2
+                                ];
+                                return [
+                                    4,
+                                    this.oidcService.verifyAccessToken(bearer)
+                                ];
+                            case 1:
+                                authData = _state.sent();
+                                if (authData) {
+                                    token = authData.token;
+                                    res.json({
+                                        sub: authData.uid,
+                                        scope: (_token_scope = token['scope']) !== null && _token_scope !== void 0 ? _token_scope : null,
+                                        expiresAt: (_token_DBX_FIREBASE_SERVER_OIDC_SESSION_EXPIRES_AT_CLAIM = token[DBX_FIREBASE_SERVER_OIDC_SESSION_EXPIRES_AT_CLAIM]) !== null && _token_DBX_FIREBASE_SERVER_OIDC_SESSION_EXPIRES_AT_CLAIM !== void 0 ? _token_DBX_FIREBASE_SERVER_OIDC_SESSION_EXPIRES_AT_CLAIM : null,
+                                        rotationDisabled: (_token_DBX_FIREBASE_SERVER_OIDC_ROTATION_DISABLED_CLAIM = token[DBX_FIREBASE_SERVER_OIDC_ROTATION_DISABLED_CLAIM]) !== null && _token_DBX_FIREBASE_SERVER_OIDC_ROTATION_DISABLED_CLAIM !== void 0 ? _token_DBX_FIREBASE_SERVER_OIDC_ROTATION_DISABLED_CLAIM : false
+                                    });
+                                    handled = true;
+                                }
+                                _state.label = 2;
+                            case 2:
+                                if (!handled) {
+                                    res.status(HttpStatus.UNAUTHORIZED).json({
+                                        error: 'invalid_token',
+                                        error_description: 'Missing or invalid bearer access token.'
+                                    });
+                                }
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
         {
             key: "handleOidcRequest",
             value: function handleOidcRequest(req, res) {
@@ -6125,6 +6851,11 @@ __decorate([
     __param(0, Req()),
     __param(1, Res())
 ], OidcProviderController.prototype, "redirectToClientLogin", null);
+__decorate([
+    Get('session'),
+    __param(0, Req()),
+    __param(1, Res())
+], OidcProviderController.prototype, "getSession", null);
 __decorate([
     All('{*path}'),
     __param(0, Req()),
@@ -6833,4 +7564,4 @@ function _unsupported_iterable_to_array(o, minLen) {
     return fn;
 }
 
-export { DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JSON_RENDER_ERROR_FUNCTION, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, allOidcScopesStringForProviderConfig, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, buildBearerChallenge, buildFirebaseServerMcpResourceServer, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, deriveResourceMetadataUrlFromEnv, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, oidcCallModelScopePreAssert, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, resolveEffectiveSubset, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };
+export { DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, FirebaseServerOidcAnalyticsService, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ANALYTICS_SERVICE, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JSON_RENDER_ERROR_FUNCTION, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAnalyticsService, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, activeJwksKeysQuery, allOidcScopesStringForProviderConfig, appOidcAnalyticsModuleMetadata, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, buildBearerChallenge, buildFirebaseServerMcpResourceServer, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, deriveResourceMetadataUrlFromEnv, emitOidcAnalyticsEvent, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, noopOidcAnalyticsService, oidcCallModelScopePreAssert, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, resolveEffectiveSubset, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };