@dereekb/firebase-server 13.25.0 → 13.26.0

package/mcp/index.esm.js

@@ -2,7 +2,7 @@ import { Injectable, Inject, Optional, Logger, Post, Req, Res, Controller, Get }
 import { existsSync, readFileSync } from 'node:fs';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
-import { getOidcScopesFromRequest } from '@dereekb/firebase-server/oidc';
+import { getOidcScopesFromRequest, OidcProviderConfigService } from '@dereekb/firebase-server/oidc';
 import { makeValuesGroupMap, IMPERSONATION_URL_QUERY_PARAM, performAsyncTasks, authRolesSetHasRoles } from '@dereekb/util';
 import { ModelApiCallModelDispatchService, ModelApiGetService, FirebaseServerStorageService, FirebaseServerEnvService, FirebaseServerAnalyticsService } from '@dereekb/firebase-server';
 import { inspect } from 'node:util';
@@ -95,6 +95,24 @@ function _define_property$9(obj, key, value) {
      *
      * @example 'https://api.example.com/mcp'
      */ _define_property$9(this, "mcpUrl", void 0);
+    /**
+     * Optional filter applied to the OIDC provider's scope list when building the
+     * protected-resource discovery document's `scopes_supported` (RFC 9728 §2).
+     *
+     * The base list is pulled automatically from the OIDC provider config via the
+     * injected {@link OidcProviderConfigService.scopesSupported} (i.e.
+     * `Object.keys(providerConfig.claims)`), so the MCP resource advertises exactly
+     * the scopes the issuer supports without the app restating them. Provide this
+     * only to narrow that set — it receives every scope the provider issues and
+     * returns the subset to advertise. When unset, all of them are advertised.
+     *
+     * Advertising these matters because dynamic-registration MCP clients (the Claude
+     * Code CLI) read `scopes_supported` to decide which scopes to request on the
+     * authorization call; with none advertised they authorize with no `scope`, leaving
+     * the OIDC provider nothing to grant and ending the interaction in `access_denied`.
+     *
+     * @example (allScopes) => allScopes.filter((scope) => scope === 'openid' || scope.startsWith('model.'))
+     */ _define_property$9(this, "scopesSupported", void 0);
     /**
      * Optional name advertised on the MCP `initialize` handshake. Defaults to
      * {@link DEFAULT_MCP_SERVER_NAME}.
@@ -172,13 +190,13 @@ typeof SuppressedError === "function" ? SuppressedError : function(error, suppre
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 };
 
-function _array_like_to_array$a(arr, len) {
+function _array_like_to_array$b(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$7(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$a(arr);
+function _array_without_holes$8(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$b(arr);
 }
 function _define_property$8(obj, key, value) {
     if (key in obj) {
@@ -193,13 +211,13 @@ function _define_property$8(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$7(iter) {
+function _iterable_to_array$8(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$7() {
+function _non_iterable_spread$8() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$5(target) {
+function _object_spread$6(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -233,20 +251,20 @@ function _object_spread_props$3(target, source) {
     }
     return target;
 }
-function _to_consumable_array$7(arr) {
-    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$a(arr) || _non_iterable_spread$7();
+function _to_consumable_array$8(arr) {
+    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$b(arr) || _non_iterable_spread$8();
 }
 function _type_of$4(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$a(o, minLen) {
+function _unsupported_iterable_to_array$b(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$a(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$b(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$a(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$b(o, minLen);
 }
 /**
  * Normalizes the app-supplied {@link McpModuleConfig.reasonParameter} value (object / boolean /
@@ -319,9 +337,9 @@ function _unsupported_iterable_to_array$a(o, minLen) {
         var _base_type;
         var base = (typeof inputSchema === "undefined" ? "undefined" : _type_of$4(inputSchema)) === 'object' && inputSchema != null ? inputSchema : {};
         var existingProperties = _type_of$4(base.properties) === 'object' && base.properties != null ? base.properties : {};
-        var next = _object_spread_props$3(_object_spread$5({}, base), {
+        var next = _object_spread_props$3(_object_spread$6({}, base), {
             type: (_base_type = base.type) !== null && _base_type !== void 0 ? _base_type : 'object',
-            properties: _object_spread_props$3(_object_spread$5({}, existingProperties), _define_property$8({}, resolved.parameterName, {
+            properties: _object_spread_props$3(_object_spread$6({}, existingProperties), _define_property$8({}, resolved.parameterName, {
                 type: 'string',
                 maxLength: resolved.maxLength,
                 description: resolved.description
@@ -329,7 +347,7 @@ function _unsupported_iterable_to_array$a(o, minLen) {
         });
         if (resolved.required) {
             var existingRequired = Array.isArray(base.required) ? base.required : [];
-            next.required = existingRequired.includes(resolved.parameterName) ? _to_consumable_array$7(existingRequired) : _to_consumable_array$7(existingRequired).concat([
+            next.required = existingRequired.includes(resolved.parameterName) ? _to_consumable_array$8(existingRequired) : _to_consumable_array$8(existingRequired).concat([
                 resolved.parameterName
             ]);
         }
@@ -355,7 +373,7 @@ function _unsupported_iterable_to_array$a(o, minLen) {
     var result;
     if (resolved.enabled && !toolDeclaresOwnReason && Object.prototype.hasOwnProperty.call(args, resolved.parameterName)) {
         var rawValue = args[resolved.parameterName];
-        var nextArgs = _object_spread$5({}, args);
+        var nextArgs = _object_spread$6({}, args);
         delete nextArgs[resolved.parameterName];
         var stringValue = rawValue == null ? '' : String(rawValue);
         var clamped = stringValue.length > resolved.maxLength ? stringValue.slice(0, resolved.maxLength) : stringValue;
@@ -427,7 +445,7 @@ function _class_call_check$4(instance, Constructor) {
     return isDefault ? "".concat(modelType, ".").concat(call, "._") : "".concat(modelType, ".").concat(call, ".").concat(specifier);
 }
 
-function _array_like_to_array$9(arr, len) {
+function _array_like_to_array$a(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
@@ -463,15 +481,15 @@ function _non_iterable_rest$5() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _sliced_to_array$5(arr, i) {
-    return _array_with_holes$5(arr) || _iterable_to_array_limit$5(arr, i) || _unsupported_iterable_to_array$9(arr, i) || _non_iterable_rest$5();
+    return _array_with_holes$5(arr) || _iterable_to_array_limit$5(arr, i) || _unsupported_iterable_to_array$a(arr, i) || _non_iterable_rest$5();
 }
-function _unsupported_iterable_to_array$9(o, minLen) {
+function _unsupported_iterable_to_array$a(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$9(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$a(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$9(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$a(o, minLen);
 }
 /**
  * Runtime mirror of the build-time route manifest schema + a ported URL matcher.
@@ -1063,7 +1081,7 @@ function stringifyResult(result) {
     return callModelOidcScopeForCallType(callType);
 }
 
-function _array_like_to_array$8(arr, len) {
+function _array_like_to_array$9(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
@@ -1099,19 +1117,19 @@ function _non_iterable_rest$4() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _sliced_to_array$4(arr, i) {
-    return _array_with_holes$4(arr) || _iterable_to_array_limit$4(arr, i) || _unsupported_iterable_to_array$8(arr, i) || _non_iterable_rest$4();
+    return _array_with_holes$4(arr) || _iterable_to_array_limit$4(arr, i) || _unsupported_iterable_to_array$9(arr, i) || _non_iterable_rest$4();
 }
 function _type_of$3(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$8(o, minLen) {
+function _unsupported_iterable_to_array$9(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$8(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$9(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$8(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$9(o, minLen);
 }
 /**
  * Default `toJsonSchema()` options.
@@ -1714,13 +1732,13 @@ function resolveInputSchema(context) {
     return result;
 }
 
-function _array_like_to_array$7(arr, len) {
+function _array_like_to_array$8(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$6(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
+function _array_without_holes$7(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$8(arr);
 }
 function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -1751,22 +1769,22 @@ function _async_to_generator$5(fn) {
         });
     };
 }
-function _iterable_to_array$6(iter) {
+function _iterable_to_array$7(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$6() {
+function _non_iterable_spread$7() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$6(arr) {
-    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$6();
+function _to_consumable_array$7(arr) {
+    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$8(arr) || _non_iterable_spread$7();
 }
-function _unsupported_iterable_to_array$7(o, minLen) {
+function _unsupported_iterable_to_array$8(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$8(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$8(o, minLen);
 }
 function _ts_generator$5(thisArg, body) {
     var f, y, t, _ = {
@@ -2062,8 +2080,8 @@ function readInChunks$1(input) {
                     ];
                 case 2:
                     partial = _state.sent();
-                    (_merged_results = merged.results).push.apply(_merged_results, _to_consumable_array$6(partial.results));
-                    (_merged_errors = merged.errors).push.apply(_merged_errors, _to_consumable_array$6(partial.errors));
+                    (_merged_results = merged.results).push.apply(_merged_results, _to_consumable_array$7(partial.results));
+                    (_merged_errors = merged.errors).push.apply(_merged_errors, _to_consumable_array$7(partial.errors));
                     _state.label = 3;
                 case 3:
                     offset += MCP_MODEL_GET_BATCH_SIZE;
@@ -2154,13 +2172,13 @@ var MODEL_GET_OUTPUT_SCHEMA = {
     }
 };
 
-function _array_like_to_array$6(arr, len) {
+function _array_like_to_array$7(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$5(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
+function _array_without_holes$6(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
 }
 function _define_property$7(obj, key, value) {
     if (key in obj) {
@@ -2175,13 +2193,13 @@ function _define_property$7(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$5(iter) {
+function _iterable_to_array$6(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$5() {
+function _non_iterable_spread$6() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$4(target) {
+function _object_spread$5(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2215,16 +2233,16 @@ function _object_spread_props$2(target, source) {
     }
     return target;
 }
-function _to_consumable_array$5(arr) {
-    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$5();
+function _to_consumable_array$6(arr) {
+    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$6();
 }
-function _unsupported_iterable_to_array$6(o, minLen) {
+function _unsupported_iterable_to_array$7(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
 }
 // MARK: Constants
 /**
@@ -2391,7 +2409,7 @@ function resolveModelInfoOutput(input, manifest) {
             }
         }
         if (tables.length > 0) {
-            result = _object_spread_props$2(_object_spread$4({}, output), {
+            result = _object_spread_props$2(_object_spread$5({}, output), {
                 enums: tables
             });
         }
@@ -2410,7 +2428,7 @@ function resolveModelInfoOutput(input, manifest) {
         rows.push(output.model);
     } else if (output.mode === 'list' || output.mode === 'multiple') {
         var _rows;
-        (_rows = rows).push.apply(_rows, _to_consumable_array$5(output.models));
+        (_rows = rows).push.apply(_rows, _to_consumable_array$6(output.models));
     }
     return rows.filter(function(row) {
         return Array.isArray(row.fields);
@@ -2445,7 +2463,7 @@ function parseModelInfoInput(args) {
     var modelGroup = parseModelGroupArg(args['modelGroup']);
     var all = parseBooleanArg(args['all'], 'all');
     var fields = parseBooleanArg(args['fields'], 'fields');
-    return _object_spread$4(_object_spread_props$2(_object_spread$4(_object_spread_props$2(_object_spread$4({}, modelQueries == null ? {} : {
+    return _object_spread$5(_object_spread_props$2(_object_spread$5(_object_spread_props$2(_object_spread$5({}, modelQueries == null ? {} : {
         modelQueries: modelQueries
     }), {
         modelIsArray: Array.isArray(args['model'])
@@ -2608,7 +2626,7 @@ function toModelRow(entry, detailed) {
     return detailed ? entry : toSummaryRow(entry);
 }
 function toSummaryRow(entry) {
-    return _object_spread$4({
+    return _object_spread$5({
         modelType: entry.modelType,
         modelName: entry.modelName,
         identityConst: entry.identityConst,
@@ -2636,7 +2654,7 @@ function toSummaryRow(entry) {
  *
  * @__NO_SIDE_EFFECTS__
  */ function computeGroupCounts(manifest) {
-    var grouped = makeValuesGroupMap(_to_consumable_array$5(manifest), function(entry) {
+    var grouped = makeValuesGroupMap(_to_consumable_array$6(manifest), function(entry) {
         var _entry_modelGroup;
         return (_entry_modelGroup = entry.modelGroup) !== null && _entry_modelGroup !== void 0 ? _entry_modelGroup : MODEL_INFO_UNGROUPED_LABEL;
     });
@@ -2943,7 +2961,7 @@ var MODEL_INFO_OUTPUT_SCHEMA = {
             type: 'string',
             description: 'Present when `mode` is `"list"` from a `modelGroup` filter. The canonical group name.'
         },
-        model: _object_spread_props$2(_object_spread$4({}, MODEL_ROW_SCHEMA), {
+        model: _object_spread_props$2(_object_spread$5({}, MODEL_ROW_SCHEMA), {
             description: 'Present when `mode` is `"single"`. The matched model entry (full detail unless `fields:false`).'
         }),
         notFound: {
@@ -3029,7 +3047,7 @@ function _define_property$6(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$3(target) {
+function _object_spread$4(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3168,7 +3186,7 @@ function parseModelDecodeInput(args) {
     };
 }
 function toSegment(prefix, id, entry) {
-    var segment = entry ? _object_spread$3({
+    var segment = entry ? _object_spread$4({
         prefix: prefix,
         id: id,
         modelType: entry.modelType,
@@ -3458,7 +3476,7 @@ var ENUM_INFO_OUTPUT_SCHEMA = {
     }
 };
 
-function _array_like_to_array$5(arr, len) {
+function _array_like_to_array$6(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
@@ -3466,8 +3484,8 @@ function _array_like_to_array$5(arr, len) {
 function _array_with_holes$3(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$4(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
 }
 function _define_property$5(obj, key, value) {
     if (key in obj) {
@@ -3482,7 +3500,7 @@ function _define_property$5(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$4(iter) {
+function _iterable_to_array$5(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
 function _iterable_to_array_limit$3(arr, i) {
@@ -3512,10 +3530,10 @@ function _iterable_to_array_limit$3(arr, i) {
 function _non_iterable_rest$3() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$4() {
+function _non_iterable_spread$5() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$2(target) {
+function _object_spread$3(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3531,18 +3549,18 @@ function _object_spread$2(target) {
     return target;
 }
 function _sliced_to_array$3(arr, i) {
-    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$5(arr, i) || _non_iterable_rest$3();
+    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$6(arr, i) || _non_iterable_rest$3();
 }
-function _to_consumable_array$4(arr) {
-    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$4();
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$5();
 }
-function _unsupported_iterable_to_array$5(o, minLen) {
+function _unsupported_iterable_to_array$6(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
 }
 // MARK: Constants
 /**
@@ -3610,7 +3628,7 @@ function whoamiToolHandler(args, ctx, deps) {
         return key;
     });
     var roleSet = deps.roleReader == null ? new Set() : deps.roleReader(token);
-    var roles = _to_consumable_array$4(roleSet).sort(function(a, b) {
+    var roles = _to_consumable_array$5(roleSet).sort(function(a, b) {
         return a.localeCompare(b);
     });
     var claimsByKey = new Map();
@@ -3644,7 +3662,7 @@ function whoamiToolHandler(args, ctx, deps) {
             if (claim1 == null) {
                 unknownClaimKeys.push(key);
             } else {
-                claimDetails.push(_object_spread$2({
+                claimDetails.push(_object_spread$3({
                     key: claim1.key,
                     description: claim1.description,
                     grantedRoles: claim1.mapping.roles,
@@ -3669,7 +3687,7 @@ function whoamiToolHandler(args, ctx, deps) {
             }
         }
     }
-    var output = _object_spread$2({
+    var output = _object_spread$3({
         authenticated: true,
         uid: auth.uid,
         roles: roles,
@@ -3681,7 +3699,7 @@ function whoamiToolHandler(args, ctx, deps) {
     }, token.email_verified == null ? {} : {
         emailVerified: token.email_verified
     }, detail === 'summary' ? {} : {
-        claims: _object_spread$2({}, token)
+        claims: _object_spread$3({}, token)
     }, detail === 'full' ? {
         claimDetails: claimDetails,
         unknownClaimKeys: unknownClaimKeys
@@ -3922,7 +3940,7 @@ var WHOAMI_OUTPUT_SCHEMA = {
     }
 };
 
-function _array_like_to_array$4(arr, len) {
+function _array_like_to_array$5(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
@@ -3930,8 +3948,8 @@ function _array_like_to_array$4(arr, len) {
 function _array_with_holes$2(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$3(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
+function _array_without_holes$4(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
 }
 function asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -3975,7 +3993,7 @@ function _define_property$4(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$3(iter) {
+function _iterable_to_array$4(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
 function _iterable_to_array_limit$2(arr, i) {
@@ -4005,10 +4023,10 @@ function _iterable_to_array_limit$2(arr, i) {
 function _non_iterable_rest$2() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$3() {
+function _non_iterable_spread$4() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$1(target) {
+function _object_spread$2(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4043,18 +4061,18 @@ function _object_spread_props$1(target, source) {
     return target;
 }
 function _sliced_to_array$2(arr, i) {
-    return _array_with_holes$2(arr) || _iterable_to_array_limit$2(arr, i) || _unsupported_iterable_to_array$4(arr, i) || _non_iterable_rest$2();
+    return _array_with_holes$2(arr) || _iterable_to_array_limit$2(arr, i) || _unsupported_iterable_to_array$5(arr, i) || _non_iterable_rest$2();
 }
-function _to_consumable_array$3(arr) {
-    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$3();
+function _to_consumable_array$4(arr) {
+    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$4();
 }
-function _unsupported_iterable_to_array$4(o, minLen) {
+function _unsupported_iterable_to_array$5(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
 }
 function _ts_generator$4(thisArg, body) {
     var f, y, t, _ = {
@@ -4311,7 +4329,7 @@ function parseUrlModelsInput(args) {
         }
         currentUserUid = args.currentUserUid;
     }
-    return _object_spread$1(_object_spread_props$1(_object_spread$1({
+    return _object_spread$2(_object_spread_props$1(_object_spread$2({
         url: url
     }, models === undefined ? {} : {
         models: models
@@ -4440,7 +4458,7 @@ function buildMatchedPayload(args) {
                     loaded = _tmp;
                     return [
                         2,
-                        _object_spread$1({
+                        _object_spread$2({
                             state: {
                                 name: match.state.name,
                                 fullUrl: match.state.fullUrl,
@@ -4463,7 +4481,7 @@ function resolveModelEntry(input) {
     var base = keysOnly ? {
         modelType: entry.modelType,
         kind: entry.kind
-    } : _object_spread$1({
+    } : _object_spread$2({
         modelType: entry.modelType,
         kind: entry.kind
     }, entry.keyTemplate === undefined ? {} : {
@@ -4477,11 +4495,11 @@ function resolveModelEntry(input) {
     if (entry.kind === 'list') {
         result = base;
     } else if (entry.kind === 'id') {
-        result = _object_spread$1({}, base, resolveIdKey(input));
+        result = _object_spread$2({}, base, resolveIdKey(input));
     } else if (entry.kind === 'flatKey') {
-        result = _object_spread$1({}, base, resolveFlatKey(input));
+        result = _object_spread$2({}, base, resolveFlatKey(input));
     } else {
-        result = _object_spread$1({}, base, resolveFullKey(input));
+        result = _object_spread$2({}, base, resolveFullKey(input));
     }
     return result;
 }
@@ -4782,8 +4800,8 @@ function readInChunks(input) {
                     ];
                 case 2:
                     partial = _state.sent();
-                    (_merged_results = merged.results).push.apply(_merged_results, _to_consumable_array$3(partial.results));
-                    (_merged_errors = merged.errors).push.apply(_merged_errors, _to_consumable_array$3(partial.errors));
+                    (_merged_results = merged.results).push.apply(_merged_results, _to_consumable_array$4(partial.results));
+                    (_merged_errors = merged.errors).push.apply(_merged_errors, _to_consumable_array$4(partial.errors));
                     _state.label = 3;
                 case 3:
                     offset += MCP_MODEL_GET_BATCH_SIZE;
@@ -4896,7 +4914,7 @@ var URL_MODELS_OUTPUT_SCHEMA = {
     }
 };
 
-function _array_like_to_array$3(arr, len) {
+function _array_like_to_array$4(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
@@ -4969,19 +4987,19 @@ function _non_iterable_rest$1() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _sliced_to_array$1(arr, i) {
-    return _array_with_holes$1(arr) || _iterable_to_array_limit$1(arr, i) || _unsupported_iterable_to_array$3(arr, i) || _non_iterable_rest$1();
+    return _array_with_holes$1(arr) || _iterable_to_array_limit$1(arr, i) || _unsupported_iterable_to_array$4(arr, i) || _non_iterable_rest$1();
 }
 function _type_of$2(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$3(o, minLen) {
+function _unsupported_iterable_to_array$4(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
 }
 function _ts_generator$3(thisArg, body) {
     var f, y, t, _ = {
@@ -5744,7 +5762,7 @@ var BATCH_EXECUTE_OUTPUT_SCHEMA = {
     }
 };
 
-function _array_like_to_array$2(arr, len) {
+function _array_like_to_array$3(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
@@ -5752,8 +5770,8 @@ function _array_like_to_array$2(arr, len) {
 function _array_with_holes(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$2(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
+function _array_without_holes$3(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
 }
 function asyncGeneratorStep$2(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -5815,7 +5833,7 @@ function _define_property$3(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$2(iter) {
+function _iterable_to_array$3(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
 function _iterable_to_array_limit(arr, i) {
@@ -5845,10 +5863,10 @@ function _iterable_to_array_limit(arr, i) {
 function _non_iterable_rest() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$2() {
+function _non_iterable_spread$3() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread(target) {
+function _object_spread$1(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -5883,22 +5901,22 @@ function _object_spread_props(target, source) {
     return target;
 }
 function _sliced_to_array(arr, i) {
-    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array$2(arr, i) || _non_iterable_rest();
+    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array$3(arr, i) || _non_iterable_rest();
 }
-function _to_consumable_array$2(arr) {
-    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$2();
+function _to_consumable_array$3(arr) {
+    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$3();
 }
 function _type_of$1(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$2(o, minLen) {
+function _unsupported_iterable_to_array$3(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
 }
 function _ts_generator$2(thisArg, body) {
     var f, y, t, _ = {
@@ -6062,7 +6080,7 @@ var McpServerFactoryService_1;
                 var staticTools = this._resolveStaticTools();
                 var scopes = this._resolveScopes(ctx);
                 var authRoles = this._resolveAuthRoles(ctx);
-                var combinedTools = _to_consumable_array$2(toolGeneration.tools).concat(_to_consumable_array$2(staticTools));
+                var combinedTools = _to_consumable_array$3(toolGeneration.tools).concat(_to_consumable_array$3(staticTools));
                 var visibleTools = this._filterToolsForRequest(combinedTools, {
                     ctx: ctx,
                     scopes: scopes,
@@ -6080,7 +6098,7 @@ var McpServerFactoryService_1;
                 var listedTools = visibleTools;
                 if (batchTool != null) {
                     definitionsByName.set(batchTool.name, batchTool);
-                    listedTools = _to_consumable_array$2(visibleTools).concat([
+                    listedTools = _to_consumable_array$3(visibleTools).concat([
                         batchTool
                     ]);
                 }
@@ -6317,7 +6335,7 @@ var McpServerFactoryService_1;
                     var modelManifest = this._cachedManifestModels;
                     var enumManifest = this._cachedManifestEnums;
                     if (modelManifest != null && modelManifest.length > 0) {
-                        staticTools.push(createModelInfoTool(_object_spread({
+                        staticTools.push(createModelInfoTool(_object_spread$1({
                             manifest: modelManifest
                         }, enumManifest == null ? {} : {
                             enums: enumManifest
@@ -6776,7 +6794,7 @@ var McpServerFactoryService_1;
                         // applyMcpReasonParameterToSchema self-skips (returns the same reference) on collision, so the
                         // frozen-verbatim hot path still holds for tools that already declare the parameter name.
                         if (reasoned !== tool.staticWireEntry.inputSchema) {
-                            result = _object_spread_props(_object_spread({}, tool.staticWireEntry), {
+                            result = _object_spread_props(_object_spread$1({}, tool.staticWireEntry), {
                                 inputSchema: reasoned
                             });
                         }
@@ -7474,6 +7492,14 @@ McpController = McpController_1 = __decorate([
     __param(0, Inject(McpServerFactoryService))
 ], McpController);
 
+function _array_like_to_array$2(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$2(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
+}
 function _class_call_check$1(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
@@ -7505,6 +7531,38 @@ function _define_property$1(obj, key, value) {
     }
     return obj;
 }
+function _iterable_to_array$2(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$2() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$1(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function _to_consumable_array$2(arr) {
+    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$2();
+}
+function _unsupported_iterable_to_array$2(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
+}
 /**
  * Serves the `GET /.well-known/oauth-protected-resource` metadata document so
  * Claude (and other MCP clients) can discover which OIDC issuer guards this
@@ -7515,21 +7573,30 @@ function _define_property$1(obj, key, value) {
  * from any global API route prefix (see `FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE`
  * in `firebase-server/oidc` for the corresponding OIDC excludes).
  */ var McpWellKnownController = /*#__PURE__*/ function() {
-    function McpWellKnownController(mcpConfig) {
+    function McpWellKnownController(mcpConfig, oidcProviderConfigService) {
         _class_call_check$1(this, McpWellKnownController);
         _define_property$1(this, "mcpConfig", void 0);
+        _define_property$1(this, "oidcProviderConfigService", void 0);
         this.mcpConfig = mcpConfig;
+        this.oidcProviderConfigService = oidcProviderConfigService;
     }
     _create_class$1(McpWellKnownController, [
         {
             key: "getProtectedResourceMetadata",
             value: function getProtectedResourceMetadata() {
-                return {
-                    resource: this.mcpConfig.mcpUrl,
+                var _this_mcpConfig = this.mcpConfig, mcpUrl = _this_mcpConfig.mcpUrl, oidcIssuer = _this_mcpConfig.oidcIssuer, scopesFilter = _this_mcpConfig.scopesSupported;
+                // Base scope list is the OIDC provider's own `scopes_supported`, so the resource
+                // advertises exactly what the issuer grants; the optional filter narrows it.
+                var providerScopes = this.oidcProviderConfigService.scopesSupported;
+                var scopes = scopesFilter ? scopesFilter(providerScopes) : providerScopes;
+                return _object_spread({
+                    resource: mcpUrl,
                     authorization_servers: [
-                        this.mcpConfig.oidcIssuer
+                        oidcIssuer
                     ]
-                };
+                }, scopes.length ? {
+                    scopes_supported: _to_consumable_array$2(scopes)
+                } : undefined);
             }
         }
     ]);
@@ -7540,7 +7607,8 @@ __decorate([
 ], McpWellKnownController.prototype, "getProtectedResourceMetadata", null);
 McpWellKnownController = __decorate([
     Controller('.well-known'),
-    __param(0, Inject(McpModuleConfig))
+    __param(0, Inject(McpModuleConfig)),
+    __param(1, Inject(OidcProviderConfigService))
 ], McpWellKnownController);
 
 function _array_like_to_array$1(arr, len) {