@dereekb/firebase-server 13.25.0 → 13.26.0

package/mcp/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dereekb/firebase-server/mcp",
-  "version": "13.25.0",
+  "version": "13.26.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.25.0",
-    "@dereekb/date": "13.25.0",
-    "@dereekb/firebase": "13.25.0",
-    "@dereekb/firebase-server": "13.25.0",
-    "@dereekb/firebase-server/oidc": "13.25.0",
-    "@dereekb/model": "13.25.0",
-    "@dereekb/nestjs": "13.25.0",
-    "@dereekb/rxjs": "13.25.0",
-    "@dereekb/util": "13.25.0",
-    "@dereekb/zoho": "13.25.0",
+    "@dereekb/analytics": "13.26.0",
+    "@dereekb/date": "13.26.0",
+    "@dereekb/firebase": "13.26.0",
+    "@dereekb/firebase-server": "13.26.0",
+    "@dereekb/firebase-server/oidc": "13.26.0",
+    "@dereekb/model": "13.26.0",
+    "@dereekb/nestjs": "13.26.0",
+    "@dereekb/rxjs": "13.26.0",
+    "@dereekb/util": "13.26.0",
+    "@dereekb/zoho": "13.26.0",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/core": "^11.1.19",

package/mcp/src/lib/controller/mcp.wellknown.controller.d.ts

@@ -1,4 +1,6 @@
+import { OidcProviderConfigService } from '@dereekb/firebase-server/oidc';
 import { McpModuleConfig } from '../mcp.config';
+import { type OidcScope } from '@dereekb/firebase';
 /**
  * Discovery document body for the OAuth protected-resource indicator.
  *
@@ -7,6 +9,12 @@ import { McpModuleConfig } from '../mcp.config';
 export interface OAuthProtectedResourceMetadata {
     readonly resource: string;
     readonly authorization_servers: ReadonlyArray<string>;
+    /**
+     * Scopes the resource accepts (RFC 9728 §2). Advertised so dynamic-registration
+     * MCP clients (e.g. the Claude Code CLI) know which scopes to request on the
+     * authorization call. Omitted when {@link McpModuleConfig.scopesSupported} is unset.
+     */
+    readonly scopes_supported?: ReadonlyArray<OidcScope>;
 }
 /**
  * Serves the `GET /.well-known/oauth-protected-resource` metadata document so
@@ -20,6 +28,7 @@ export interface OAuthProtectedResourceMetadata {
  */
 export declare class McpWellKnownController {
     private readonly mcpConfig;
-    constructor(mcpConfig: McpModuleConfig);
+    private readonly oidcProviderConfigService;
+    constructor(mcpConfig: McpModuleConfig, oidcProviderConfigService: OidcProviderConfigService);
     getProtectedResourceMetadata(): OAuthProtectedResourceMetadata;
 }

package/mcp/src/lib/mcp.config.d.ts

@@ -1,4 +1,5 @@
 import { type AuthClaims, type AuthRoleSet } from '@dereekb/util';
+import { type OidcScope } from '@dereekb/firebase';
 /**
  * Default path the MCP Streamable HTTP transport is mounted at.
  *
@@ -79,6 +80,13 @@ export interface McpReasonParameterConfig {
      */
     readonly parameterName?: string;
 }
+/**
+ * Filter applied to the OIDC provider's advertised scope list when building the MCP
+ * protected-resource metadata's `scopes_supported`. Receives every scope the provider
+ * issues (from `OidcProviderConfigService.scopesSupported`) and returns the subset to
+ * advertise. Supplied via {@link McpModuleConfig.scopesSupported}; when unset, all are advertised.
+ */
+export type McpScopesSupportedFilter = (allScopes: readonly OidcScope[]) => readonly OidcScope[];
 /**
  * Configuration for the firebase-server/mcp module.
  *
@@ -114,6 +122,25 @@ export declare abstract class McpModuleConfig {
      * @example 'https://api.example.com/mcp'
      */
     readonly mcpUrl: string;
+    /**
+     * Optional filter applied to the OIDC provider's scope list when building the
+     * protected-resource discovery document's `scopes_supported` (RFC 9728 §2).
+     *
+     * The base list is pulled automatically from the OIDC provider config via the
+     * injected {@link OidcProviderConfigService.scopesSupported} (i.e.
+     * `Object.keys(providerConfig.claims)`), so the MCP resource advertises exactly
+     * the scopes the issuer supports without the app restating them. Provide this
+     * only to narrow that set — it receives every scope the provider issues and
+     * returns the subset to advertise. When unset, all of them are advertised.
+     *
+     * Advertising these matters because dynamic-registration MCP clients (the Claude
+     * Code CLI) read `scopes_supported` to decide which scopes to request on the
+     * authorization call; with none advertised they authorize with no `scope`, leaving
+     * the OIDC provider nothing to grant and ending the interaction in `access_denied`.
+     *
+     * @example (allScopes) => allScopes.filter((scope) => scope === 'openid' || scope.startsWith('model.'))
+     */
+    readonly scopesSupported?: McpScopesSupportedFilter;
     /**
      * Optional name advertised on the MCP `initialize` handshake. Defaults to
      * {@link DEFAULT_MCP_SERVER_NAME}.

package/mcp/src/lib/mcp.module.d.ts

@@ -16,10 +16,14 @@ export interface McpModuleMetadataConfig extends Pick<ModuleMetadata, 'imports'
      * Must provide:
      * - {@link ModelApiDispatchConfig} — so the MCP server can reuse the call model dispatch chain.
      * - {@link McpModuleConfig} — issuer + resource URLs for protected-resource discovery.
+     * - `OidcProviderConfigService` (from `@dereekb/firebase-server/oidc`) — the `McpWellKnownController`
+     *   reads the provider's `scopesSupported` to advertise them on the protected-resource document.
      *
      * In practice, downstream apps typically import their own `*ModelApiModule` first (which provides
      * `ModelApiCallModelDispatchService` + `MODEL_API_NEST_APPLICATION_CONTEXT`) and add the
-     * `McpModuleConfig` provider in the dependency module passed here.
+     * `McpModuleConfig` provider in the dependency module passed here. The `OidcProviderConfigService`
+     * export is satisfied by re-exporting the app's `*OidcModule` from the dependency module (the shared
+     * `oidcModuleMetadata` exports the service, so re-exporting the module propagates it to the controller).
      */
     readonly dependencyModule: ClassType;
 }

package/model/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.25.0",
+  "version": "13.26.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.25.0",
-    "@dereekb/date": "13.25.0",
-    "@dereekb/firebase": "13.25.0",
-    "@dereekb/firebase-server": "13.25.0",
-    "@dereekb/model": "13.25.0",
-    "@dereekb/nestjs": "13.25.0",
-    "@dereekb/rxjs": "13.25.0",
-    "@dereekb/util": "13.25.0",
+    "@dereekb/analytics": "13.26.0",
+    "@dereekb/date": "13.26.0",
+    "@dereekb/firebase": "13.26.0",
+    "@dereekb/firebase-server": "13.26.0",
+    "@dereekb/model": "13.26.0",
+    "@dereekb/nestjs": "13.26.0",
+    "@dereekb/rxjs": "13.26.0",
+    "@dereekb/util": "13.26.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.1",

package/oidc/index.cjs.js

@@ -7447,6 +7447,7 @@ function _unsupported_iterable_to_array(o, minLen) {
         exports: [
             OidcClientService,
             exports.OidcService,
+            exports.OidcProviderConfigService,
             OidcModuleConfig,
             OidcAuthMiddlewareConfig,
             OidcServerFirestoreCollections

package/oidc/index.esm.js

@@ -7445,6 +7445,7 @@ function _unsupported_iterable_to_array(o, minLen) {
         exports: [
             OidcClientService,
             OidcService,
+            OidcProviderConfigService,
             OidcModuleConfig,
             OidcAuthMiddlewareConfig,
             OidcServerFirestoreCollections

package/oidc/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/oidc",
-  "version": "13.25.0",
+  "version": "13.26.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.25.0",
-    "@dereekb/date": "13.25.0",
-    "@dereekb/firebase": "13.25.0",
-    "@dereekb/firebase-server": "13.25.0",
-    "@dereekb/model": "13.25.0",
-    "@dereekb/nestjs": "13.25.0",
-    "@dereekb/rxjs": "13.25.0",
-    "@dereekb/util": "13.25.0",
-    "@dereekb/zoho": "13.25.0",
+    "@dereekb/analytics": "13.26.0",
+    "@dereekb/date": "13.26.0",
+    "@dereekb/firebase": "13.26.0",
+    "@dereekb/firebase-server": "13.26.0",
+    "@dereekb/model": "13.26.0",
+    "@dereekb/nestjs": "13.26.0",
+    "@dereekb/rxjs": "13.26.0",
+    "@dereekb/util": "13.26.0",
+    "@dereekb/zoho": "13.26.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "express": "^5.2.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase-server",
-  "version": "13.25.0",
+  "version": "13.26.0",
   "sideEffects": false,
   "exports": {
     "./test": {
@@ -57,15 +57,15 @@
   "types": "./src/index.d.ts",
   "peerDependencies": {
     "@cantoo/pdf-lib": "^2.6.5",
-    "@dereekb/analytics": "13.25.0",
-    "@dereekb/date": "13.25.0",
-    "@dereekb/dbx-core": "13.25.0",
-    "@dereekb/firebase": "13.25.0",
-    "@dereekb/model": "13.25.0",
-    "@dereekb/nestjs": "13.25.0",
-    "@dereekb/rxjs": "13.25.0",
-    "@dereekb/util": "13.25.0",
-    "@dereekb/zoho": "13.25.0",
+    "@dereekb/analytics": "13.26.0",
+    "@dereekb/date": "13.26.0",
+    "@dereekb/dbx-core": "13.26.0",
+    "@dereekb/firebase": "13.26.0",
+    "@dereekb/model": "13.26.0",
+    "@dereekb/nestjs": "13.26.0",
+    "@dereekb/rxjs": "13.26.0",
+    "@dereekb/util": "13.26.0",
+    "@dereekb/zoho": "13.26.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@modelcontextprotocol/sdk": "1.29.0",

package/test/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.25.0",
+  "version": "13.26.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.25.0",
-    "@dereekb/date": "13.25.0",
-    "@dereekb/firebase": "13.25.0",
-    "@dereekb/firebase-server": "13.25.0",
-    "@dereekb/firebase-server/oidc": "13.25.0",
-    "@dereekb/model": "13.25.0",
-    "@dereekb/nestjs": "13.25.0",
-    "@dereekb/rxjs": "13.25.0",
-    "@dereekb/util": "13.25.0",
+    "@dereekb/analytics": "13.26.0",
+    "@dereekb/date": "13.26.0",
+    "@dereekb/firebase": "13.26.0",
+    "@dereekb/firebase-server": "13.26.0",
+    "@dereekb/firebase-server/oidc": "13.26.0",
+    "@dereekb/model": "13.26.0",
+    "@dereekb/nestjs": "13.26.0",
+    "@dereekb/rxjs": "13.26.0",
+    "@dereekb/util": "13.26.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,7 +23,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.25.0"
+    "@dereekb/nestjs": "13.26.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/twilio/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/firebase-server/twilio",
-  "version": "13.25.0",
+  "version": "13.26.0",
   "peerDependencies": {
-    "@dereekb/date": "13.25.0",
-    "@dereekb/firebase": "13.25.0",
-    "@dereekb/firebase-server": "13.25.0",
-    "@dereekb/model": "13.25.0",
-    "@dereekb/nestjs": "13.25.0",
-    "@dereekb/rxjs": "13.25.0",
-    "@dereekb/util": "13.25.0"
+    "@dereekb/date": "13.26.0",
+    "@dereekb/firebase": "13.26.0",
+    "@dereekb/firebase-server": "13.26.0",
+    "@dereekb/model": "13.26.0",
+    "@dereekb/nestjs": "13.26.0",
+    "@dereekb/rxjs": "13.26.0",
+    "@dereekb/util": "13.26.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/zoho/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/zoho",
-  "version": "13.25.0",
+  "version": "13.26.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.25.0",
-    "@dereekb/date": "13.25.0",
-    "@dereekb/model": "13.25.0",
-    "@dereekb/nestjs": "13.25.0",
-    "@dereekb/rxjs": "13.25.0",
-    "@dereekb/firebase": "13.25.0",
-    "@dereekb/util": "13.25.0",
-    "@dereekb/zoho": "13.25.0"
+    "@dereekb/analytics": "13.26.0",
+    "@dereekb/date": "13.26.0",
+    "@dereekb/model": "13.26.0",
+    "@dereekb/nestjs": "13.26.0",
+    "@dereekb/rxjs": "13.26.0",
+    "@dereekb/firebase": "13.26.0",
+    "@dereekb/util": "13.26.0",
+    "@dereekb/zoho": "13.26.0"
   },
   "exports": {
     "./package.json": "./package.json",