@dereekb/firebase-server 13.28.0 → 13.30.0

package/index.cjs.js

@@ -5486,6 +5486,31 @@ function resolveAnalyticsFromApiDetails(apiDetails, call, modelType, specifier)
     }
     return result;
 }
+// MARK: Required Scope Resolution
+/**
+ * Resolves the leaf-level per-function required OIDC scope from the aggregated _apiDetails tree.
+ *
+ * Walks: call -> modelType -> specifier (if specifier-level), then reads the `requiredScope`
+ * field from the handler-level {@link OnCallModelFunctionApiDetails}. Mirrors
+ * {@link resolveAnalyticsFromApiDetails}.
+ *
+ * @param apiDetails - The top-level aggregated API details.
+ * @param call - The CRUD operation type to look up.
+ * @param modelType - The Firestore model type to look up.
+ * @param specifier - Optional specifier key for variant handlers.
+ * @returns The per-function required scope for the resolved handler, or undefined.
+ */ // eslint-disable-next-line @typescript-eslint/max-params
+function resolveRequiredScopeFromApiDetails(apiDetails, call, modelType, specifier) {
+    var _apiDetails_call;
+    var modelDetails = (_apiDetails_call = apiDetails[call]) === null || _apiDetails_call === void 0 ? void 0 : _apiDetails_call.modelTypes[modelType];
+    var result;
+    if (modelDetails) {
+        var _modelDetails_specifiers_key;
+        var key = specifier !== null && specifier !== void 0 ? specifier : '_';
+        result = (_modelDetails_specifiers_key = modelDetails.specifiers[key]) === null || _modelDetails_specifiers_key === void 0 ? void 0 : _modelDetails_specifiers_key.requiredScope;
+    }
+    return result;
+}
 /**
  * @deprecated Use {@link isOnCallModelTypeApiDetails} instead.
  */ var isOnCallSpecifierApiDetails = isOnCallModelTypeApiDetails;
@@ -5774,7 +5799,12 @@ function _object_spread_props$c(target, source) {
             data: request.data.data,
             request: request
         };
-        preAssert(context);
+        // Resolve the leaf handler's per-function requiredScope (if any) so the preAssert can enforce
+        // it additively with the per-verb OIDC scope. Same call -> modelType -> specifier walk as analytics.
+        var requiredScope = resolveRequiredScopeFromApiDetails(modelApiDetails, call, modelType, specifier);
+        preAssert(_object_spread_props$c(_object_spread$h({}, context), {
+            requiredScope: requiredScope
+        }));
         var result;
         // Resolve analytics from _apiDetails tree — callWithAnalytics handles undefined details
         var analyticsService = getAnalyticsService(request);
@@ -7029,6 +7059,78 @@ exports.FirebaseServerAuthModule = __decorate([
     return claims[firebase.FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY] != null;
 }
 
+// MARK: Scope Reading
+/**
+ * Reads the set of OIDC scopes carried by a model-api request's auth, or `undefined` for a non-OIDC
+ * (regular Firebase ID-token) caller.
+ *
+ * The OIDC bearer-token middleware attaches the validated access-token claims at
+ * `auth.oidcValidatedToken` (with the space-delimited `scope` string); a non-OIDC caller has neither
+ * that field nor a `scope` on `auth.token`. Reading is defensive (the auth shape is only typed as
+ * {@link FirebaseServerAuthData} here — the OIDC-specific `oidcValidatedToken` lives in the
+ * `@dereekb/firebase-server/oidc` sub-package this core layer cannot import), delegating the actual
+ * parse to the shared {@link oidcScopesFromScopeClaim} so there is no drift with `getOidcScopesFromRequest`.
+ *
+ * @param auth - The request auth data, or undefined for unauthenticated requests.
+ * @returns The granted scope set, or `undefined` when the request carries no OIDC `scope` claim.
+ */ function oidcScopesFromModelApiAuth(auth) {
+    var _auth_oidcValidatedToken, _auth_token;
+    var oidcScope = auth === null || auth === void 0 ? void 0 : (_auth_oidcValidatedToken = auth.oidcValidatedToken) === null || _auth_oidcValidatedToken === void 0 ? void 0 : _auth_oidcValidatedToken.scope;
+    var tokenScope = auth === null || auth === void 0 ? void 0 : (_auth_token = auth.token) === null || _auth_token === void 0 ? void 0 : _auth_token.scope;
+    var scope = oidcScope !== null && oidcScope !== void 0 ? oidcScope : tokenScope;
+    return firebase.oidcScopesFromScopeClaim(scope);
+}
+/**
+ * Enforces the OIDC scope requirement for a single model-api op, throwing a `403`
+ * {@link CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE} error when the caller does not satisfy it.
+ *
+ * The single home of callModel OIDC scope enforcement. It reuses the shipped composition + evaluation
+ * (`resolveEffectiveOidcScopeTerms` / `oidcScopeTermsSatisfied`) so enforcement and the MCP
+ * tool-visibility filter never drift. Enforcement is AND-of-ORs across the per-verb `model.<call>`
+ * scope and the effective GROUP term (per-function `requiredScope` > per-model requirement >
+ * configured default).
+ *
+ * Bypasses (no-op) when `grantedScopes` is `undefined` — i.e. a non-OIDC caller — and short-circuits
+ * without any check when the op resolves no requirement at all (a custom, non-CRUD verb with no
+ * per-function/model/default term).
+ *
+ * @param input - The verb, model type, per-function scope, group config, and the caller's granted scopes.
+ * @throws A `403` forbidden error (code {@link CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE}) when an OIDC
+ *   caller does not satisfy the effective requirement.
+ */ function assertModelApiOidcScope(input) {
+    var call = input.call, modelType = input.modelType, requiredScope = input.requiredScope, defaultRequiredScope = input.defaultRequiredScope, modelRequiredScopes = input.modelRequiredScopes, grantedScopes = input.grantedScopes;
+    var terms = firebase.resolveEffectiveOidcScopeTerms({
+        perVerbScope: firebase.callModelOidcScopeForCallType(call),
+        requiredScope: requiredScope,
+        modelRequirement: modelRequiredScopes === null || modelRequiredScopes === void 0 ? void 0 : modelRequiredScopes[modelType],
+        call: call,
+        defaultRequiredScope: defaultRequiredScope
+    });
+    if (terms.length > 0 && grantedScopes != null && !firebase.oidcScopeTermsSatisfied(terms, grantedScopes)) {
+        var missingTerms = terms.filter(function(term) {
+            return !firebase.oidcScopeTermSatisfied(term, grantedScopes);
+        });
+        throw forbiddenError({
+            status: 403,
+            code: firebase.CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE,
+            message: "Missing required OIDC scope for callModel: ".concat(missingTerms.map(formatModelApiScopeTerm).join(', ')),
+            data: {
+                requiredScopes: missingTerms,
+                call: call
+            }
+        });
+    }
+}
+/**
+ * Renders a scope term for the human-readable error message: a single scope as-is, an OR-group as its
+ * alternatives joined by `|` (so a single-scope term reads as itself).
+ *
+ * @param term - The unsatisfied scope term.
+ * @returns The display string for the term.
+ */ function formatModelApiScopeTerm(term) {
+    return typeof term === 'string' ? term : term.join('|');
+}
+
 function _define_property$n(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -7305,6 +7407,15 @@ function _ts_generator$a(thisArg, body) {
     /**
      * Factory to create typed nest context from INestApplicationContext.
      */ _define_property$m(this, "makeNestContext", void 0);
+    /**
+     * Optional model-api-layer OIDC group-scope default. See {@link ModelApiOidcScopeConfig.defaultRequiredScope}.
+     * This is the home for the callModel group-scope default; providing it here enforces it across
+     * dispatch AND the `/get` reads.
+     */ _define_property$m(this, "defaultRequiredScope", void 0);
+    /**
+     * Optional per-model OIDC group-scope overrides. See {@link ModelApiOidcScopeConfig.modelRequiredScopes}.
+     * The only place a plain `/get` read (no per-function handler) can be scope-gated beyond `model.read`.
+     */ _define_property$m(this, "modelRequiredScopes", void 0);
 };
 /**
  * Injection token for providing the NestJS application context to the dispatch service.
@@ -7339,8 +7450,25 @@ function _ts_generator$a(thisArg, body) {
      * @returns The handler's return value.
      */ function dispatch(params, auth, rawRequest) {
                 return _async_to_generator$a(function() {
-                    var callableRequest, appRequest, contextRequest;
+                    var call, modelType, specifier, apiDetails, requiredScope, callableRequest, appRequest, contextRequest;
                     return _ts_generator$a(this, function(_state) {
+                        // Enforce OIDC scope BEFORE dispatching — the relocated home of the callModel scope check.
+                        // AND-of-ORs across the per-verb `model.<call>` scope and the effective group term (per-function
+                        // `requiredScope` > per-model requirement > module default), bypassing non-OIDC callers. A nullish
+                        // `call` is a malformed request the callModel chain rejects downstream (no model op to authorize).
+                        call = params.call, modelType = params.modelType, specifier = params.specifier;
+                        if (call != null) {
+                            apiDetails = this.config.callModelFn._apiDetails;
+                            requiredScope = apiDetails == null ? undefined : resolveRequiredScopeFromApiDetails(apiDetails, call, modelType, specifier);
+                            assertModelApiOidcScope({
+                                call: call,
+                                modelType: modelType,
+                                requiredScope: requiredScope,
+                                defaultRequiredScope: this.config.defaultRequiredScope,
+                                modelRequiredScopes: this.config.modelRequiredScopes,
+                                grantedScopes: oidcScopesFromModelApiAuth(auth)
+                            });
+                        }
                         // Build a synthetic CallableRequest that the dispatch chain expects. Layer the
                         // OIDC-validated claim subset over the base token so standard JWT claims
                         // (`iat`, `auth_time`, `email`, …) survive — the callModel chain and any
@@ -7627,12 +7755,38 @@ function _ts_generator$9(thisArg, body) {
     function ModelApiGetService(config, nestApplication) {
         _class_call_check$e(this, ModelApiGetService);
         _define_property$l(this, "_nestContext", void 0);
+        _define_property$l(this, "_defaultRequiredScope", void 0);
+        _define_property$l(this, "_modelRequiredScopes", void 0);
         _define_property$l(this, "_identityByModelType", void 0);
         this._nestContext = config.makeNestContext(nestApplication);
+        this._defaultRequiredScope = config.defaultRequiredScope;
+        this._modelRequiredScopes = config.modelRequiredScopes;
     }
     _create_class$9(ModelApiGetService, [
         {
             /**
+     * Enforces the OIDC read-scope requirement for a direct document read before it hits Firestore.
+     *
+     * A direct `/get` read is the `read` verb: it requires the per-verb `model.read` scope AND any
+     * effective group term for the target model (per-model requirement > module default). This is the
+     * ONLY gate on the direct-read path — it does not touch the callModel dispatch chain — so without it
+     * an OIDC client scoped to a subset could read any model through `/get`. Non-OIDC callers bypass.
+     *
+     * @param modelType - The Firestore model type being read.
+     * @param auth - The request's auth data (OIDC scopes are read from it).
+     */ key: "_assertReadScope",
+            value: function _assertReadScope(modelType, auth) {
+                assertModelApiOidcScope({
+                    call: 'read',
+                    modelType: modelType,
+                    defaultRequiredScope: this._defaultRequiredScope,
+                    modelRequiredScopes: this._modelRequiredScopes,
+                    grantedScopes: oidcScopesFromModelApiAuth(auth)
+                });
+            }
+        },
+        {
+            /**
      * Returns the registered {@link FirestoreModelIdentity} for the given `modelType` string, or
      * `undefined` when no model of that type is registered.
      *
@@ -7704,6 +7858,7 @@ function _ts_generator$9(thisArg, body) {
                     return _ts_generator$9(this, function(_state) {
                         switch(_state.label){
                             case 0:
+                                this._assertReadScope(modelType, auth);
                                 authRef = this._makeAuthRef(auth);
                                 return [
                                     4,
@@ -7752,6 +7907,7 @@ function _ts_generator$9(thisArg, body) {
                 return _async_to_generator$9(function() {
                     var authRef;
                     return _ts_generator$9(this, function(_state) {
+                        this._assertReadScope(modelType, auth);
                         authRef = this._makeAuthRef(auth);
                         return [
                             2,
@@ -13155,6 +13311,7 @@ exports.assertHasSignedTosInRequest = assertHasSignedTosInRequest;
 exports.assertIsAdminInRequest = assertIsAdminInRequest;
 exports.assertIsAdminOrTargetUserInRequestData = assertIsAdminOrTargetUserInRequestData;
 exports.assertIsContextWithAuthData = assertIsContextWithAuthData;
+exports.assertModelApiOidcScope = assertModelApiOidcScope;
 exports.assertRequestRequiresAuthForFunction = assertRequestRequiresAuthForFunction;
 exports.assertSnapshotData = assertSnapshotData;
 exports.assertSnapshotDataWithKey = assertSnapshotDataWithKey;
@@ -13252,6 +13409,7 @@ exports.noRunNameSpecifiedForScheduledFunctionDevelopmentFunction = noRunNameSpe
 exports.noopFirebaseServerAnalyticsServiceListener = noopFirebaseServerAnalyticsServiceListener;
 exports.noopOnCallModelAnalyticsService = noopOnCallModelAnalyticsService;
 exports.notFoundError = notFoundError;
+exports.oidcScopesFromModelApiAuth = oidcScopesFromModelApiAuth;
 exports.onCallAnalyticsEmitterInstance = onCallAnalyticsEmitterInstance;
 exports.onCallCreateModel = onCallCreateModel;
 exports.onCallDeleteModel = onCallDeleteModel;
@@ -13282,6 +13440,7 @@ exports.readApiDetails = readApiDetails;
 exports.readModelUnknownModelTypeError = readModelUnknownModelTypeError;
 exports.resolveAdminOnlyValue = resolveAdminOnlyValue;
 exports.resolveAnalyticsFromApiDetails = resolveAnalyticsFromApiDetails;
+exports.resolveRequiredScopeFromApiDetails = resolveRequiredScopeFromApiDetails;
 exports.setNestContextOnRequest = setNestContextOnRequest;
 exports.setNestContextOnScheduleRequest = setNestContextOnScheduleRequest;
 exports.taskQueueFunctionHandlerWithNestContextFactory = taskQueueFunctionHandlerWithNestContextFactory;

package/index.esm.js

@@ -1,5 +1,5 @@
 import { timingSafeEqual } from 'node:crypto';
-import { DBX_FIREBASE_SERVER_NO_AUTH_ERROR_CODE, UNAUTHENTICATED_ERROR_CODE, FORBIDDEN_ERROR_CODE, PERMISSION_DENIED_ERROR_CODE, NOT_FOUND_ERROR_CODE, MODEL_NOT_AVAILABLE_ERROR_CODE, BAD_REQUEST_ERROR_CODE, CONFLICT_ERROR_CODE, ALREADY_EXISTS_ERROR_CODE, UNAVAILABLE_ERROR_CODE, UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE, INTERNAL_SERVER_ERROR_CODE, FIREBASE_AUTH_USER_NOT_FOUND_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_EMAIL_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_INVALID_PHONE_NUMBER_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, setIdAndKeyFromKeyIdRefOnDocumentData, DBX_FIREBASE_SERVER_PASSWORD_RESET_INVALID_CODE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_NO_CONFIG_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_SEND_ONCE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_THROTTLE_ERROR_CODE, FirestoreDocumentContextType, streamFromOnSnapshot, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, makeFirestoreQueryConstraintFunctionsDriver, firestoreContextFactory, firestoreField, optionalFirestoreField, DEFAULT_MODEL_FUNCTION_FIREBASE_CRUD_FUNCTION_SPECIFIER, UNKNOWN_MODEL_TYPE_ERROR_CODE, BAD_DOCUMENT_QUERY_CURSOR_ERROR_CODE, limit, startAfter, DEFAULT_ON_CALL_QUERY_MODEL_LIMIT, MAX_ON_CALL_QUERY_MODEL_LIMIT, ScheduledFunctionDevelopmentFunctionTypeEnum, SCHEDULED_FUNCTION_DEV_FUNCTION_SPECIFIER, storageListFilesResultFactory, assertStorageUploadOptionsStringFormat, firebaseStorageContextFactory, inContextFirebaseModelsServiceFactory, useFirebaseModelsService } from '@dereekb/firebase';
+import { DBX_FIREBASE_SERVER_NO_AUTH_ERROR_CODE, UNAUTHENTICATED_ERROR_CODE, FORBIDDEN_ERROR_CODE, PERMISSION_DENIED_ERROR_CODE, NOT_FOUND_ERROR_CODE, MODEL_NOT_AVAILABLE_ERROR_CODE, BAD_REQUEST_ERROR_CODE, CONFLICT_ERROR_CODE, ALREADY_EXISTS_ERROR_CODE, UNAVAILABLE_ERROR_CODE, UNAVAILABLE_OR_DEACTIVATED_FUNCTION_ERROR_CODE, INTERNAL_SERVER_ERROR_CODE, FIREBASE_AUTH_USER_NOT_FOUND_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_RESET_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_LAST_COM_DATE_KEY, FIREBASE_SERVER_AUTH_CLAIMS_RESET_EXPIRES_AT_KEY, FIREBASE_AUTH_PHONE_NUMBER_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_EMAIL_ALREADY_EXISTS_ERROR, FIREBASE_AUTH_INVALID_PHONE_NUMBER_ERROR, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY, FIREBASE_SERVER_AUTH_CLAIMS_SETUP_LAST_COM_DATE_KEY, setIdAndKeyFromKeyIdRefOnDocumentData, DBX_FIREBASE_SERVER_PASSWORD_RESET_INVALID_CODE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_NO_CONFIG_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_SEND_ONCE_ERROR_CODE, DBX_FIREBASE_SERVER_PASSWORD_RESET_THROTTLE_ERROR_CODE, FirestoreDocumentContextType, streamFromOnSnapshot, FIRESTORE_LIMIT_QUERY_CONSTRAINT_TYPE, FIRESTORE_LIMIT_TO_LAST_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_QUERY_CONSTRAINT_TYPE, FIRESTORE_ORDER_BY_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_QUERY_CONSTRAINT_TYPE, FIRESTORE_WHERE_DOCUMENT_ID_QUERY_CONSTRAINT_TYPE, FIRESTORE_OFFSET_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_START_AFTER_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_AT_VALUE_QUERY_CONSTRAINT_TYPE, FIRESTORE_END_BEFORE_QUERY_CONSTRAINT_TYPE, makeFirestoreQueryConstraintFunctionsDriver, firestoreContextFactory, firestoreField, optionalFirestoreField, DEFAULT_MODEL_FUNCTION_FIREBASE_CRUD_FUNCTION_SPECIFIER, UNKNOWN_MODEL_TYPE_ERROR_CODE, BAD_DOCUMENT_QUERY_CURSOR_ERROR_CODE, limit, startAfter, DEFAULT_ON_CALL_QUERY_MODEL_LIMIT, MAX_ON_CALL_QUERY_MODEL_LIMIT, resolveEffectiveOidcScopeTerms, callModelOidcScopeForCallType, oidcScopeTermsSatisfied, oidcScopeTermSatisfied, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, oidcScopesFromScopeClaim, ScheduledFunctionDevelopmentFunctionTypeEnum, SCHEDULED_FUNCTION_DEV_FUNCTION_SPECIFIER, storageListFilesResultFactory, assertStorageUploadOptionsStringFormat, firebaseStorageContextFactory, inContextFirebaseModelsServiceFactory, useFirebaseModelsService } from '@dereekb/firebase';
 import { partialServerError, isServerError, randomNumberFactory, cachedGetter, filterNullAndUndefinedValues, asSet, AUTH_ADMIN_ROLE, AUTH_TOS_SIGNED_ROLE, forEachKeyValue, KeyValueTypleValueFilter, filterUndefinedValues, isThrottled, mapObjectMap, batch, objectToMap, serverError, asArray, containsAllValues, websiteUrlDetails, mergeObjects, cronExpressionRepeatingEveryNMinutes, mapIdentityFunction, slashPathName, toRelativeSlashPathStartType, fixMultiSlashesInSlashPath, SLASH_PATH_SEPARATOR, objectHasNoKeys, websiteUrlFromPaths, pushItemOrArrayItemsIntoArray, makeGetter, asGetter, build, performAsyncTasks } from '@dereekb/util';
 import { HttpsError } from 'firebase-functions/https';
 import { hoursToMs, minutesToMs, toISODateString } from '@dereekb/date';
@@ -5484,6 +5484,31 @@ function resolveAnalyticsFromApiDetails(apiDetails, call, modelType, specifier)
     }
     return result;
 }
+// MARK: Required Scope Resolution
+/**
+ * Resolves the leaf-level per-function required OIDC scope from the aggregated _apiDetails tree.
+ *
+ * Walks: call -> modelType -> specifier (if specifier-level), then reads the `requiredScope`
+ * field from the handler-level {@link OnCallModelFunctionApiDetails}. Mirrors
+ * {@link resolveAnalyticsFromApiDetails}.
+ *
+ * @param apiDetails - The top-level aggregated API details.
+ * @param call - The CRUD operation type to look up.
+ * @param modelType - The Firestore model type to look up.
+ * @param specifier - Optional specifier key for variant handlers.
+ * @returns The per-function required scope for the resolved handler, or undefined.
+ */ // eslint-disable-next-line @typescript-eslint/max-params
+function resolveRequiredScopeFromApiDetails(apiDetails, call, modelType, specifier) {
+    var _apiDetails_call;
+    var modelDetails = (_apiDetails_call = apiDetails[call]) === null || _apiDetails_call === void 0 ? void 0 : _apiDetails_call.modelTypes[modelType];
+    var result;
+    if (modelDetails) {
+        var _modelDetails_specifiers_key;
+        var key = specifier !== null && specifier !== void 0 ? specifier : '_';
+        result = (_modelDetails_specifiers_key = modelDetails.specifiers[key]) === null || _modelDetails_specifiers_key === void 0 ? void 0 : _modelDetails_specifiers_key.requiredScope;
+    }
+    return result;
+}
 /**
  * @deprecated Use {@link isOnCallModelTypeApiDetails} instead.
  */ var isOnCallSpecifierApiDetails = isOnCallModelTypeApiDetails;
@@ -5772,7 +5797,12 @@ function _object_spread_props$c(target, source) {
             data: request.data.data,
             request: request
         };
-        preAssert(context);
+        // Resolve the leaf handler's per-function requiredScope (if any) so the preAssert can enforce
+        // it additively with the per-verb OIDC scope. Same call -> modelType -> specifier walk as analytics.
+        var requiredScope = resolveRequiredScopeFromApiDetails(modelApiDetails, call, modelType, specifier);
+        preAssert(_object_spread_props$c(_object_spread$h({}, context), {
+            requiredScope: requiredScope
+        }));
         var result;
         // Resolve analytics from _apiDetails tree — callWithAnalytics handles undefined details
         var analyticsService = getAnalyticsService(request);
@@ -7027,6 +7057,78 @@ FirebaseServerAuthModule = __decorate([
     return claims[FIREBASE_SERVER_AUTH_CLAIMS_SETUP_PASSWORD_KEY] != null;
 }
 
+// MARK: Scope Reading
+/**
+ * Reads the set of OIDC scopes carried by a model-api request's auth, or `undefined` for a non-OIDC
+ * (regular Firebase ID-token) caller.
+ *
+ * The OIDC bearer-token middleware attaches the validated access-token claims at
+ * `auth.oidcValidatedToken` (with the space-delimited `scope` string); a non-OIDC caller has neither
+ * that field nor a `scope` on `auth.token`. Reading is defensive (the auth shape is only typed as
+ * {@link FirebaseServerAuthData} here — the OIDC-specific `oidcValidatedToken` lives in the
+ * `@dereekb/firebase-server/oidc` sub-package this core layer cannot import), delegating the actual
+ * parse to the shared {@link oidcScopesFromScopeClaim} so there is no drift with `getOidcScopesFromRequest`.
+ *
+ * @param auth - The request auth data, or undefined for unauthenticated requests.
+ * @returns The granted scope set, or `undefined` when the request carries no OIDC `scope` claim.
+ */ function oidcScopesFromModelApiAuth(auth) {
+    var _auth_oidcValidatedToken, _auth_token;
+    var oidcScope = auth === null || auth === void 0 ? void 0 : (_auth_oidcValidatedToken = auth.oidcValidatedToken) === null || _auth_oidcValidatedToken === void 0 ? void 0 : _auth_oidcValidatedToken.scope;
+    var tokenScope = auth === null || auth === void 0 ? void 0 : (_auth_token = auth.token) === null || _auth_token === void 0 ? void 0 : _auth_token.scope;
+    var scope = oidcScope !== null && oidcScope !== void 0 ? oidcScope : tokenScope;
+    return oidcScopesFromScopeClaim(scope);
+}
+/**
+ * Enforces the OIDC scope requirement for a single model-api op, throwing a `403`
+ * {@link CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE} error when the caller does not satisfy it.
+ *
+ * The single home of callModel OIDC scope enforcement. It reuses the shipped composition + evaluation
+ * (`resolveEffectiveOidcScopeTerms` / `oidcScopeTermsSatisfied`) so enforcement and the MCP
+ * tool-visibility filter never drift. Enforcement is AND-of-ORs across the per-verb `model.<call>`
+ * scope and the effective GROUP term (per-function `requiredScope` > per-model requirement >
+ * configured default).
+ *
+ * Bypasses (no-op) when `grantedScopes` is `undefined` — i.e. a non-OIDC caller — and short-circuits
+ * without any check when the op resolves no requirement at all (a custom, non-CRUD verb with no
+ * per-function/model/default term).
+ *
+ * @param input - The verb, model type, per-function scope, group config, and the caller's granted scopes.
+ * @throws A `403` forbidden error (code {@link CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE}) when an OIDC
+ *   caller does not satisfy the effective requirement.
+ */ function assertModelApiOidcScope(input) {
+    var call = input.call, modelType = input.modelType, requiredScope = input.requiredScope, defaultRequiredScope = input.defaultRequiredScope, modelRequiredScopes = input.modelRequiredScopes, grantedScopes = input.grantedScopes;
+    var terms = resolveEffectiveOidcScopeTerms({
+        perVerbScope: callModelOidcScopeForCallType(call),
+        requiredScope: requiredScope,
+        modelRequirement: modelRequiredScopes === null || modelRequiredScopes === void 0 ? void 0 : modelRequiredScopes[modelType],
+        call: call,
+        defaultRequiredScope: defaultRequiredScope
+    });
+    if (terms.length > 0 && grantedScopes != null && !oidcScopeTermsSatisfied(terms, grantedScopes)) {
+        var missingTerms = terms.filter(function(term) {
+            return !oidcScopeTermSatisfied(term, grantedScopes);
+        });
+        throw forbiddenError({
+            status: 403,
+            code: CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE,
+            message: "Missing required OIDC scope for callModel: ".concat(missingTerms.map(formatModelApiScopeTerm).join(', ')),
+            data: {
+                requiredScopes: missingTerms,
+                call: call
+            }
+        });
+    }
+}
+/**
+ * Renders a scope term for the human-readable error message: a single scope as-is, an OR-group as its
+ * alternatives joined by `|` (so a single-scope term reads as itself).
+ *
+ * @param term - The unsatisfied scope term.
+ * @returns The display string for the term.
+ */ function formatModelApiScopeTerm(term) {
+    return typeof term === 'string' ? term : term.join('|');
+}
+
 function _define_property$n(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -7303,6 +7405,15 @@ function _ts_generator$a(thisArg, body) {
     /**
      * Factory to create typed nest context from INestApplicationContext.
      */ _define_property$m(this, "makeNestContext", void 0);
+    /**
+     * Optional model-api-layer OIDC group-scope default. See {@link ModelApiOidcScopeConfig.defaultRequiredScope}.
+     * This is the home for the callModel group-scope default; providing it here enforces it across
+     * dispatch AND the `/get` reads.
+     */ _define_property$m(this, "defaultRequiredScope", void 0);
+    /**
+     * Optional per-model OIDC group-scope overrides. See {@link ModelApiOidcScopeConfig.modelRequiredScopes}.
+     * The only place a plain `/get` read (no per-function handler) can be scope-gated beyond `model.read`.
+     */ _define_property$m(this, "modelRequiredScopes", void 0);
 };
 /**
  * Injection token for providing the NestJS application context to the dispatch service.
@@ -7337,8 +7448,25 @@ function _ts_generator$a(thisArg, body) {
      * @returns The handler's return value.
      */ function dispatch(params, auth, rawRequest) {
                 return _async_to_generator$a(function() {
-                    var callableRequest, appRequest, contextRequest;
+                    var call, modelType, specifier, apiDetails, requiredScope, callableRequest, appRequest, contextRequest;
                     return _ts_generator$a(this, function(_state) {
+                        // Enforce OIDC scope BEFORE dispatching — the relocated home of the callModel scope check.
+                        // AND-of-ORs across the per-verb `model.<call>` scope and the effective group term (per-function
+                        // `requiredScope` > per-model requirement > module default), bypassing non-OIDC callers. A nullish
+                        // `call` is a malformed request the callModel chain rejects downstream (no model op to authorize).
+                        call = params.call, modelType = params.modelType, specifier = params.specifier;
+                        if (call != null) {
+                            apiDetails = this.config.callModelFn._apiDetails;
+                            requiredScope = apiDetails == null ? undefined : resolveRequiredScopeFromApiDetails(apiDetails, call, modelType, specifier);
+                            assertModelApiOidcScope({
+                                call: call,
+                                modelType: modelType,
+                                requiredScope: requiredScope,
+                                defaultRequiredScope: this.config.defaultRequiredScope,
+                                modelRequiredScopes: this.config.modelRequiredScopes,
+                                grantedScopes: oidcScopesFromModelApiAuth(auth)
+                            });
+                        }
                         // Build a synthetic CallableRequest that the dispatch chain expects. Layer the
                         // OIDC-validated claim subset over the base token so standard JWT claims
                         // (`iat`, `auth_time`, `email`, …) survive — the callModel chain and any
@@ -7625,12 +7753,38 @@ function _ts_generator$9(thisArg, body) {
     function ModelApiGetService(config, nestApplication) {
         _class_call_check$e(this, ModelApiGetService);
         _define_property$l(this, "_nestContext", void 0);
+        _define_property$l(this, "_defaultRequiredScope", void 0);
+        _define_property$l(this, "_modelRequiredScopes", void 0);
         _define_property$l(this, "_identityByModelType", void 0);
         this._nestContext = config.makeNestContext(nestApplication);
+        this._defaultRequiredScope = config.defaultRequiredScope;
+        this._modelRequiredScopes = config.modelRequiredScopes;
     }
     _create_class$9(ModelApiGetService, [
         {
             /**
+     * Enforces the OIDC read-scope requirement for a direct document read before it hits Firestore.
+     *
+     * A direct `/get` read is the `read` verb: it requires the per-verb `model.read` scope AND any
+     * effective group term for the target model (per-model requirement > module default). This is the
+     * ONLY gate on the direct-read path — it does not touch the callModel dispatch chain — so without it
+     * an OIDC client scoped to a subset could read any model through `/get`. Non-OIDC callers bypass.
+     *
+     * @param modelType - The Firestore model type being read.
+     * @param auth - The request's auth data (OIDC scopes are read from it).
+     */ key: "_assertReadScope",
+            value: function _assertReadScope(modelType, auth) {
+                assertModelApiOidcScope({
+                    call: 'read',
+                    modelType: modelType,
+                    defaultRequiredScope: this._defaultRequiredScope,
+                    modelRequiredScopes: this._modelRequiredScopes,
+                    grantedScopes: oidcScopesFromModelApiAuth(auth)
+                });
+            }
+        },
+        {
+            /**
      * Returns the registered {@link FirestoreModelIdentity} for the given `modelType` string, or
      * `undefined` when no model of that type is registered.
      *
@@ -7702,6 +7856,7 @@ function _ts_generator$9(thisArg, body) {
                     return _ts_generator$9(this, function(_state) {
                         switch(_state.label){
                             case 0:
+                                this._assertReadScope(modelType, auth);
                                 authRef = this._makeAuthRef(auth);
                                 return [
                                     4,
@@ -7750,6 +7905,7 @@ function _ts_generator$9(thisArg, body) {
                 return _async_to_generator$9(function() {
                     var authRef;
                     return _ts_generator$9(this, function(_state) {
+                        this._assertReadScope(modelType, auth);
                         authRef = this._makeAuthRef(auth);
                         return [
                             2,
@@ -13086,4 +13242,4 @@ function _define_property(obj, key, value) {
 } 
 ();
 
-export { AbstractFirebaseNestContext, AbstractFirebaseServerActionsContext, AbstractFirebaseServerAuthContext, AbstractFirebaseServerAuthService, AbstractFirebaseServerAuthUserContext, AbstractFirebaseServerNewUserService, AbstractFirebaseServerUserPasswordResetService, AbstractNestContext, AbstractServerFirebaseNestContext, ConfigureFirebaseAppCheckMiddlewareModule, ConfigureFirebaseWebhookMiddlewareModule, DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR, DEFAULT_RESET_CODE_EXPIRES_IN, DEFAULT_RESET_COM_THROTTLE_TIME, DEFAULT_SERVER_ASSETS_BASE_PATH, DEFAULT_SETUP_COM_THROTTLE_TIME, DefaultFirebaseServerEnvService, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_SERVER_ENV_TOKEN, FIREBASE_SERVER_VALIDATION_ERROR_CODE, FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN, FIREBASE_STORAGE_CONTEXT_TOKEN, FIREBASE_STORAGE_TOKEN, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FirebaseAppCheckMiddleware, FirebaseAppCheckMiddlewareConfig, FirebaseNestServerRootModule, FirebaseRawBodyMiddleware, FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsSegmentModule, FirebaseServerAnalyticsService, FirebaseServerAnalyticsServiceListener, FirebaseServerAuthModule, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, FirebaseServerAuthPasswordResetInvalidCodeError, FirebaseServerAuthPasswordResetNoResetConfigError, FirebaseServerAuthPasswordResetSendOnceError, FirebaseServerAuthPasswordResetThrottleError, FirebaseServerAuthService, FirebaseServerAuthUserBadInputError, FirebaseServerAuthUserExistsError, FirebaseServerEnvService, FirebaseServerFirestoreContextModule, FirebaseServerFirestoreModule, FirebaseServerStorageContextModule, FirebaseServerStorageModule, FirebaseServerStorageService, GlobalRoutePrefixConfig, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MODEL_API_NEST_APPLICATION_CONTEXT, ModelApiCallModelDispatchService, ModelApiController, ModelApiDispatchConfig, ModelApiGetService, NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE, NoContentFirebaseServerUserPasswordResetService, NoSetupContentFirebaseServerNewUserService, ON_CALL_MODEL_ANALYTICS_HANDLER, ON_CALL_MODEL_ANALYTICS_SERVICE, OnCallModelAnalyticsService, PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE, SkipAppCheck, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE, _onCallWithCallTypeFunction, aggregateCrudModelApiDetails, aggregateModelApiDetails, aggregateSpecifierApiDetails, alreadyExistsError, appAnalyticsModuleMetadata, appFirestoreModuleMetadata, assertContextHasAuth, assertDocumentExists, assertHasRolesInRequest, assertHasSignedTosInRequest, assertIsAdminInRequest, assertIsAdminOrTargetUserInRequestData, assertIsContextWithAuthData, assertRequestRequiresAuthForFunction, assertSnapshotData, assertSnapshotDataWithKey, authServicePasswordResetInvalidCodeError, authServicePasswordResetNoConfigError, authServicePasswordResetSendOnceError, authServicePasswordResetThrottleError, badRequestError, blockingFunctionHandlerWithNestContextFactory, buildNestServerRootModule, callWithAnalytics, catchAndThrowPasswordResetServerErrors, cloudEventHandlerWithNestContextFactory, collectionRefForPath, createModelUnknownModelTypeError, decodeFirebaseServerUserPasswordResetOobCode, defaultFirebaseServerActionsTransformFactoryLogErrorFunction, defaultProvideFirebaseServerStorageServiceSimple, deleteModelUnknownModelTypeError, developmentUnknownSpecifierError, docRefForPath, documentModelNotAvailableError, encodeFirebaseServerUserPasswordResetOobCode, executeOnCallQuery, firebaseAuthTokenFromDecodedIdToken, firebaseServerActionsContext, firebaseServerActionsTransformContext, firebaseServerActionsTransformFactory, firebaseServerAppTokenProvider, firebaseServerAuthModuleMetadata, firebaseServerDevFunctions, firebaseServerEnvTokenProvider, firebaseServerEnvTokenProviders, firebaseServerErrorInfo, firebaseServerErrorInfoCodePair, firebaseServerErrorInfoServerErrorCodePair, firebaseServerErrorInfoServerErrorPair, firebaseServerFirestoreContextModuleMetadata, firebaseServerStorageDefaultBucketIdTokenProvider, firebaseServerStorageModuleMetadata, firebaseServerValidationError, firebaseServerValidationServerError, firestoreClientQueryConstraintFunctionsDriver, firestoreEncryptedField, firestoreServerIncrementUpdateToUpdateData, forbiddenError, getAuthUserOrUndefined, getModelApiDetails, googleCloudFileMetadataToStorageMetadata, googleCloudFirebaseStorageContextFactory, googleCloudFirebaseStorageDrivers, googleCloudFirestoreAccessorDriver, googleCloudFirestoreContextFactory, googleCloudFirestoreDrivers, googleCloudFirestoreQueryDriver, googleCloudStorageAccessorFile, googleCloudStorageAccessorFolder, googleCloudStorageBucketForStorageFilePath, googleCloudStorageFileForStorageFilePath, googleCloudStorageFirebaseStorageAccessorDriver, googleCloudStorageFromFirebaseAdminStorage, googleCloudStorageListFilesResultFactory, handleFirebaseAuthError, handleFirebaseError, hasAuthRolesInRequest, hasNewUserSetupPasswordInRequest, hasSignedTosInRequest, inAuthContext, injectNestApplicationContextIntoRequest, injectNestIntoRequest, internalServerError, invokeModelUnknownModelTypeError, isActualSpecifier, isAdminInRequest, isAdminOrTargetUserInRequestData, isContextWithAuthData, isFirebaseError, isFirebaseHttpsError, isOnCallCrudModelApiDetails, isOnCallHandlerApiDetails, isOnCallModelTypeApiDetails, isOnCallSpecifierApiDetails, makeBlockingFunctionWithHandler, makeOnScheduleHandlerWithNestApplicationRequest, makeScheduledFunctionDevelopmentFunction, modelAccessReadErrorFromUseMultipleModelsFailure, modelApiModuleMetadata, modelNotAvailableError, nestAppHasDevelopmentSchedulerEnabled, nestAppIsProductionEnvironment, nestFirebaseDoesNotExistError, nestFirebaseForbiddenPermissionError, nestServerInstance, noRunNameSpecifiedForScheduledFunctionDevelopmentFunction, noopFirebaseServerAnalyticsServiceListener, noopOnCallModelAnalyticsService, notFoundError, onCallAnalyticsEmitterInstance, onCallCreateModel, onCallDeleteModel, onCallDevelopmentFunction, onCallHandlerWithNestApplicationFactory, onCallHandlerWithNestContextFactory, onCallInvokeModel, onCallModel, onCallModelMissingCallTypeError, onCallModelUnknownCallTypeError, onCallQueryModel, onCallReadModel, onCallSpecifierHandler, onCallUpdateModel, onScheduleHandlerWithNestApplicationFactory, onScheduleHandlerWithNestContextFactory, optionalAuthContext, optionalFirestoreEncryptedField, permissionDeniedError, phoneNumberAlreadyExistsError, preconditionConflictError, provideAppFirestoreCollections, provideFirebaseServerAuthService, provideFirebaseServerStorageService, queryModelBadCursorError, queryModelUnknownModelTypeError, readApiDetails, readModelUnknownModelTypeError, resolveAdminOnlyValue, resolveAnalyticsFromApiDetails, setNestContextOnRequest, setNestContextOnScheduleRequest, taskQueueFunctionHandlerWithNestContextFactory, unauthenticatedContextHasNoAuthData, unauthenticatedContextHasNoUidError, unauthenticatedError, unavailableError, unavailableOrDeactivatedFunctionError, unknownModelCrudFunctionSpecifierError, unknownScheduledFunctionDevelopmentFunctionName, unknownScheduledFunctionDevelopmentFunctionType, updateModelUnknownModelTypeError, userContextFromUid, verifyAppCheckInRequest, withApiDetails };
+export { AbstractFirebaseNestContext, AbstractFirebaseServerActionsContext, AbstractFirebaseServerAuthContext, AbstractFirebaseServerAuthService, AbstractFirebaseServerAuthUserContext, AbstractFirebaseServerNewUserService, AbstractFirebaseServerUserPasswordResetService, AbstractNestContext, AbstractServerFirebaseNestContext, ConfigureFirebaseAppCheckMiddlewareModule, ConfigureFirebaseWebhookMiddlewareModule, DEFAULT_FIREBASE_PASSWORD_NUMBER_GENERATOR, DEFAULT_RESET_CODE_EXPIRES_IN, DEFAULT_RESET_COM_THROTTLE_TIME, DEFAULT_SERVER_ASSETS_BASE_PATH, DEFAULT_SETUP_COM_THROTTLE_TIME, DefaultFirebaseServerEnvService, FIREBASE_APP_TOKEN, FIREBASE_AUTH_TOKEN, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FIREBASE_FIRESTORE_TOKEN, FIREBASE_SERVER_ENV_TOKEN, FIREBASE_SERVER_VALIDATION_ERROR_CODE, FIREBASE_STORAGE_CONTEXT_FACTORY_CONFIG_TOKEN, FIREBASE_STORAGE_CONTEXT_TOKEN, FIREBASE_STORAGE_TOKEN, FIRESTORE_CLIENT_QUERY_CONSTRAINT_HANDLER_MAPPING, FirebaseAppCheckMiddleware, FirebaseAppCheckMiddlewareConfig, FirebaseNestServerRootModule, FirebaseRawBodyMiddleware, FirebaseServerAnalyticsSegmentListenerService, FirebaseServerAnalyticsSegmentModule, FirebaseServerAnalyticsService, FirebaseServerAnalyticsServiceListener, FirebaseServerAuthModule, FirebaseServerAuthNewUserSendSetupDetailsNoSetupConfigError, FirebaseServerAuthNewUserSendSetupDetailsSendOnceError, FirebaseServerAuthNewUserSendSetupDetailsThrottleError, FirebaseServerAuthPasswordResetInvalidCodeError, FirebaseServerAuthPasswordResetNoResetConfigError, FirebaseServerAuthPasswordResetSendOnceError, FirebaseServerAuthPasswordResetThrottleError, FirebaseServerAuthService, FirebaseServerAuthUserBadInputError, FirebaseServerAuthUserExistsError, FirebaseServerEnvService, FirebaseServerFirestoreContextModule, FirebaseServerFirestoreModule, FirebaseServerStorageContextModule, FirebaseServerStorageModule, FirebaseServerStorageService, GlobalRoutePrefixConfig, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MODEL_API_NEST_APPLICATION_CONTEXT, ModelApiCallModelDispatchService, ModelApiController, ModelApiDispatchConfig, ModelApiGetService, NO_RUN_NAME_SPECIFIED_FOR_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_CODE, NoContentFirebaseServerUserPasswordResetService, NoSetupContentFirebaseServerNewUserService, ON_CALL_MODEL_ANALYTICS_HANDLER, ON_CALL_MODEL_ANALYTICS_SERVICE, OnCallModelAnalyticsService, PHONE_NUMBER_ALREADY_EXISTS_ERROR_CODE, SkipAppCheck, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_NAME_CODE, UNKNOWN_SCHEDULED_FUNCTION_DEVELOPMENT_FUNCTION_TYPE_CODE, _onCallWithCallTypeFunction, aggregateCrudModelApiDetails, aggregateModelApiDetails, aggregateSpecifierApiDetails, alreadyExistsError, appAnalyticsModuleMetadata, appFirestoreModuleMetadata, assertContextHasAuth, assertDocumentExists, assertHasRolesInRequest, assertHasSignedTosInRequest, assertIsAdminInRequest, assertIsAdminOrTargetUserInRequestData, assertIsContextWithAuthData, assertModelApiOidcScope, assertRequestRequiresAuthForFunction, assertSnapshotData, assertSnapshotDataWithKey, authServicePasswordResetInvalidCodeError, authServicePasswordResetNoConfigError, authServicePasswordResetSendOnceError, authServicePasswordResetThrottleError, badRequestError, blockingFunctionHandlerWithNestContextFactory, buildNestServerRootModule, callWithAnalytics, catchAndThrowPasswordResetServerErrors, cloudEventHandlerWithNestContextFactory, collectionRefForPath, createModelUnknownModelTypeError, decodeFirebaseServerUserPasswordResetOobCode, defaultFirebaseServerActionsTransformFactoryLogErrorFunction, defaultProvideFirebaseServerStorageServiceSimple, deleteModelUnknownModelTypeError, developmentUnknownSpecifierError, docRefForPath, documentModelNotAvailableError, encodeFirebaseServerUserPasswordResetOobCode, executeOnCallQuery, firebaseAuthTokenFromDecodedIdToken, firebaseServerActionsContext, firebaseServerActionsTransformContext, firebaseServerActionsTransformFactory, firebaseServerAppTokenProvider, firebaseServerAuthModuleMetadata, firebaseServerDevFunctions, firebaseServerEnvTokenProvider, firebaseServerEnvTokenProviders, firebaseServerErrorInfo, firebaseServerErrorInfoCodePair, firebaseServerErrorInfoServerErrorCodePair, firebaseServerErrorInfoServerErrorPair, firebaseServerFirestoreContextModuleMetadata, firebaseServerStorageDefaultBucketIdTokenProvider, firebaseServerStorageModuleMetadata, firebaseServerValidationError, firebaseServerValidationServerError, firestoreClientQueryConstraintFunctionsDriver, firestoreEncryptedField, firestoreServerIncrementUpdateToUpdateData, forbiddenError, getAuthUserOrUndefined, getModelApiDetails, googleCloudFileMetadataToStorageMetadata, googleCloudFirebaseStorageContextFactory, googleCloudFirebaseStorageDrivers, googleCloudFirestoreAccessorDriver, googleCloudFirestoreContextFactory, googleCloudFirestoreDrivers, googleCloudFirestoreQueryDriver, googleCloudStorageAccessorFile, googleCloudStorageAccessorFolder, googleCloudStorageBucketForStorageFilePath, googleCloudStorageFileForStorageFilePath, googleCloudStorageFirebaseStorageAccessorDriver, googleCloudStorageFromFirebaseAdminStorage, googleCloudStorageListFilesResultFactory, handleFirebaseAuthError, handleFirebaseError, hasAuthRolesInRequest, hasNewUserSetupPasswordInRequest, hasSignedTosInRequest, inAuthContext, injectNestApplicationContextIntoRequest, injectNestIntoRequest, internalServerError, invokeModelUnknownModelTypeError, isActualSpecifier, isAdminInRequest, isAdminOrTargetUserInRequestData, isContextWithAuthData, isFirebaseError, isFirebaseHttpsError, isOnCallCrudModelApiDetails, isOnCallHandlerApiDetails, isOnCallModelTypeApiDetails, isOnCallSpecifierApiDetails, makeBlockingFunctionWithHandler, makeOnScheduleHandlerWithNestApplicationRequest, makeScheduledFunctionDevelopmentFunction, modelAccessReadErrorFromUseMultipleModelsFailure, modelApiModuleMetadata, modelNotAvailableError, nestAppHasDevelopmentSchedulerEnabled, nestAppIsProductionEnvironment, nestFirebaseDoesNotExistError, nestFirebaseForbiddenPermissionError, nestServerInstance, noRunNameSpecifiedForScheduledFunctionDevelopmentFunction, noopFirebaseServerAnalyticsServiceListener, noopOnCallModelAnalyticsService, notFoundError, oidcScopesFromModelApiAuth, onCallAnalyticsEmitterInstance, onCallCreateModel, onCallDeleteModel, onCallDevelopmentFunction, onCallHandlerWithNestApplicationFactory, onCallHandlerWithNestContextFactory, onCallInvokeModel, onCallModel, onCallModelMissingCallTypeError, onCallModelUnknownCallTypeError, onCallQueryModel, onCallReadModel, onCallSpecifierHandler, onCallUpdateModel, onScheduleHandlerWithNestApplicationFactory, onScheduleHandlerWithNestContextFactory, optionalAuthContext, optionalFirestoreEncryptedField, permissionDeniedError, phoneNumberAlreadyExistsError, preconditionConflictError, provideAppFirestoreCollections, provideFirebaseServerAuthService, provideFirebaseServerStorageService, queryModelBadCursorError, queryModelUnknownModelTypeError, readApiDetails, readModelUnknownModelTypeError, resolveAdminOnlyValue, resolveAnalyticsFromApiDetails, resolveRequiredScopeFromApiDetails, setNestContextOnRequest, setNestContextOnScheduleRequest, taskQueueFunctionHandlerWithNestContextFactory, unauthenticatedContextHasNoAuthData, unauthenticatedContextHasNoUidError, unauthenticatedError, unavailableError, unavailableOrDeactivatedFunctionError, unknownModelCrudFunctionSpecifierError, unknownScheduledFunctionDevelopmentFunctionName, unknownScheduledFunctionDevelopmentFunctionType, updateModelUnknownModelTypeError, userContextFromUid, verifyAppCheckInRequest, withApiDetails };

package/mailgun/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/mailgun",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.28.0",
-    "@dereekb/firebase": "13.28.0",
-    "@dereekb/firebase-server": "13.28.0",
-    "@dereekb/date": "13.28.0",
-    "@dereekb/nestjs": "13.28.0",
-    "@dereekb/model": "13.28.0",
-    "@dereekb/rxjs": "13.28.0",
-    "@dereekb/util": "13.28.0"
+    "@dereekb/analytics": "13.30.0",
+    "@dereekb/firebase": "13.30.0",
+    "@dereekb/firebase-server": "13.30.0",
+    "@dereekb/date": "13.30.0",
+    "@dereekb/nestjs": "13.30.0",
+    "@dereekb/model": "13.30.0",
+    "@dereekb/rxjs": "13.30.0",
+    "@dereekb/util": "13.30.0"
   },
   "exports": {
     "./package.json": "./package.json",