@dereekb/firebase-server 13.28.0 → 13.30.0

package/src/lib/nest/controller/model/model.api.dispatch.d.ts

@@ -1,11 +1,12 @@
 import { type Maybe } from '@dereekb/util';
-import { type OnCallTypedModelParams } from '@dereekb/firebase';
+import { type FirestoreModelType, type OidcModelScopeRequirement, type OidcScopeTerm, type OnCallTypedModelParams } from '@dereekb/firebase';
 import { type INestApplicationContext } from '@nestjs/common';
 import { type Request } from 'express';
 import { type OnCallWithNestContext } from '../../function/call';
 import { type OnCallApiDetailsRef, type ModelApiDetailsResult } from '../../model/api.details';
 import { type MakeNestContext } from '../../nest.provider';
 import { type FirebaseServerAuthData } from '../auth.context.server';
+import { type ModelApiOidcScopeConfig } from './model.api.scope';
 /**
  * The combined type of the function returned by onCallModel() with _apiDetails attached.
  */
@@ -27,7 +28,7 @@ export type OnCallModelFnWithApiDetails = OnCallWithNestContext<unknown, OnCallT
  * }
  * ```
  */
-export declare abstract class ModelApiDispatchConfig {
+export declare abstract class ModelApiDispatchConfig implements ModelApiOidcScopeConfig {
     /**
      * The onCallModel() return value with _apiDetails attached.
      */
@@ -36,6 +37,17 @@ export declare abstract class ModelApiDispatchConfig {
      * Factory to create typed nest context from INestApplicationContext.
      */
     readonly makeNestContext: MakeNestContext<unknown>;
+    /**
+     * Optional model-api-layer OIDC group-scope default. See {@link ModelApiOidcScopeConfig.defaultRequiredScope}.
+     * This is the home for the callModel group-scope default; providing it here enforces it across
+     * dispatch AND the `/get` reads.
+     */
+    readonly defaultRequiredScope?: OidcScopeTerm;
+    /**
+     * Optional per-model OIDC group-scope overrides. See {@link ModelApiOidcScopeConfig.modelRequiredScopes}.
+     * The only place a plain `/get` read (no per-function handler) can be scope-gated beyond `model.read`.
+     */
+    readonly modelRequiredScopes?: Record<FirestoreModelType, OidcModelScopeRequirement>;
 }
 /**
  * Injection token for providing the NestJS application context to the dispatch service.

package/src/lib/nest/controller/model/model.api.get.service.d.ts

@@ -61,8 +61,22 @@ export declare function modelAccessReadErrorFromUseMultipleModelsFailure(entry:
  */
 export declare class ModelApiGetService {
     private readonly _nestContext;
+    private readonly _defaultRequiredScope;
+    private readonly _modelRequiredScopes;
     private _identityByModelType;
     constructor(config: ModelApiDispatchConfig, nestApplication: INestApplicationContext);
+    /**
+     * Enforces the OIDC read-scope requirement for a direct document read before it hits Firestore.
+     *
+     * A direct `/get` read is the `read` verb: it requires the per-verb `model.read` scope AND any
+     * effective group term for the target model (per-model requirement > module default). This is the
+     * ONLY gate on the direct-read path — it does not touch the callModel dispatch chain — so without it
+     * an OIDC client scoped to a subset could read any model through `/get`. Non-OIDC callers bypass.
+     *
+     * @param modelType - The Firestore model type being read.
+     * @param auth - The request's auth data (OIDC scopes are read from it).
+     */
+    private _assertReadScope;
     /**
      * Returns the registered {@link FirestoreModelIdentity} for the given `modelType` string, or
      * `undefined` when no model of that type is registered.

package/src/lib/nest/controller/model/model.api.scope.d.ts

@@ -0,0 +1,102 @@
+import { type Maybe } from '@dereekb/util';
+import { type FirestoreModelType, type OidcModelScopeRequirement, type OidcScope, type OidcScopeTerm, type OnCallFunctionType } from '@dereekb/firebase';
+import { type FirebaseServerAuthData } from '../auth.context.server';
+/**
+ * OIDC scope-grouping configuration for the model-api layer, mixed into {@link ModelApiDispatchConfig}
+ * and read by both {@link ModelApiCallModelDispatchService} and {@link ModelApiGetService}.
+ *
+ * This is the model-api-layer home for the callModel group-scope requirements. Providing them here
+ * enforces them uniformly across ALL three `ModelApiController` access patterns — path/direct
+ * dispatch AND the `/get` direct reads — and
+ * (via the MCP server routing through the same services) the MCP surface, without riding the shared
+ * callModel function that also serves the app's first-party Firebase `onCall` path.
+ *
+ * With NEITHER field supplied, enforcement is byte-for-byte the pre-grouping behavior: an OIDC caller
+ * still needs the per-verb `model.<call>` scope (plus any per-function `requiredScope` on dispatch),
+ * and non-OIDC callers bypass entirely.
+ */
+export interface ModelApiOidcScopeConfig {
+    /**
+     * Group term required on EVERY model-api op unless a finer term overrides it (a per-function
+     * `requiredScope`, then a {@link ModelApiOidcScopeConfig.modelRequiredScopes} entry). Lets an app
+     * require e.g. `'hellosubs'` across all models without editing individual handlers. Set this to the
+     * SAME value passed to the MCP `McpModuleConfig.defaultRequiredScope` so tool listing == callability.
+     */
+    readonly defaultRequiredScope?: OidcScopeTerm;
+    /**
+     * Per-model group-term overrides keyed by {@link FirestoreModelType}. The ONLY place a plain `/get`
+     * read (which has no per-function handler) can be scope-gated beyond the per-verb `model.read` scope.
+     * A verb-keyed entry can require different terms per verb (e.g. `lms` reads, `hellosubs` writes). Set
+     * this to the SAME value passed to the MCP `McpModuleConfig.modelRequiredScopes` so tool listing ==
+     * callability.
+     */
+    readonly modelRequiredScopes?: Record<FirestoreModelType, OidcModelScopeRequirement>;
+}
+/**
+ * Reads the set of OIDC scopes carried by a model-api request's auth, or `undefined` for a non-OIDC
+ * (regular Firebase ID-token) caller.
+ *
+ * The OIDC bearer-token middleware attaches the validated access-token claims at
+ * `auth.oidcValidatedToken` (with the space-delimited `scope` string); a non-OIDC caller has neither
+ * that field nor a `scope` on `auth.token`. Reading is defensive (the auth shape is only typed as
+ * {@link FirebaseServerAuthData} here — the OIDC-specific `oidcValidatedToken` lives in the
+ * `@dereekb/firebase-server/oidc` sub-package this core layer cannot import), delegating the actual
+ * parse to the shared {@link oidcScopesFromScopeClaim} so there is no drift with `getOidcScopesFromRequest`.
+ *
+ * @param auth - The request auth data, or undefined for unauthenticated requests.
+ * @returns The granted scope set, or `undefined` when the request carries no OIDC `scope` claim.
+ */
+export declare function oidcScopesFromModelApiAuth(auth: Maybe<FirebaseServerAuthData>): Maybe<Set<OidcScope>>;
+/**
+ * Inputs to {@link assertModelApiOidcScope}.
+ *
+ * Standalone (not extending {@link ModelApiOidcScopeConfig}) because the group fields here receive the
+ * services' stored config values, which are {@link Maybe} (nullable) — matching the shipped
+ * `ResolveEffectiveOidcScopeTermsInput` — whereas the config surface exposes them as plain optionals.
+ */
+export interface AssertModelApiOidcScopeInput {
+    /**
+     * The call verb being enforced (e.g. `create`, `read`). `/get` direct reads pass `'read'`.
+     */
+    readonly call: OnCallFunctionType;
+    /**
+     * The Firestore model type being targeted.
+     */
+    readonly modelType: FirestoreModelType;
+    /**
+     * The per-function `requiredScope` declared via `withApiDetails`, if resolvable (dispatch only — a
+     * plain `/get` read has no per-function handler). The finest (highest-precedence) group term.
+     */
+    readonly requiredScope?: Maybe<OidcScopeTerm>;
+    /**
+     * The module-level default group term (see {@link ModelApiOidcScopeConfig.defaultRequiredScope}).
+     */
+    readonly defaultRequiredScope?: Maybe<OidcScopeTerm>;
+    /**
+     * The per-model group-term overrides (see {@link ModelApiOidcScopeConfig.modelRequiredScopes}).
+     */
+    readonly modelRequiredScopes?: Maybe<Record<FirestoreModelType, OidcModelScopeRequirement>>;
+    /**
+     * The scopes the caller was granted, or `undefined` for a non-OIDC caller (bypasses enforcement).
+     */
+    readonly grantedScopes: Maybe<ReadonlySet<OidcScope>>;
+}
+/**
+ * Enforces the OIDC scope requirement for a single model-api op, throwing a `403`
+ * {@link CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE} error when the caller does not satisfy it.
+ *
+ * The single home of callModel OIDC scope enforcement. It reuses the shipped composition + evaluation
+ * (`resolveEffectiveOidcScopeTerms` / `oidcScopeTermsSatisfied`) so enforcement and the MCP
+ * tool-visibility filter never drift. Enforcement is AND-of-ORs across the per-verb `model.<call>`
+ * scope and the effective GROUP term (per-function `requiredScope` > per-model requirement >
+ * configured default).
+ *
+ * Bypasses (no-op) when `grantedScopes` is `undefined` — i.e. a non-OIDC caller — and short-circuits
+ * without any check when the op resolves no requirement at all (a custom, non-CRUD verb with no
+ * per-function/model/default term).
+ *
+ * @param input - The verb, model type, per-function scope, group config, and the caller's granted scopes.
+ * @throws A `403` forbidden error (code {@link CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE}) when an OIDC
+ *   caller does not satisfy the effective requirement.
+ */
+export declare function assertModelApiOidcScope(input: AssertModelApiOidcScopeInput): void;

package/src/lib/nest/model/api.details.d.ts

@@ -1,5 +1,5 @@
 import { type AuthRole, type Maybe, type PromiseOrValue } from '@dereekb/util';
-import { type OnCallFunctionType, type OnCallTypedModelParams, type FirestoreModelType, type ModelFirebaseCrudFunctionSpecifier } from '@dereekb/firebase';
+import { type OnCallFunctionType, type OnCallTypedModelParams, type FirestoreModelType, type ModelFirebaseCrudFunctionSpecifier, type OidcScopeTerm } from '@dereekb/firebase';
 import { type FirebaseServerAuthData } from '../controller/auth.context.server';
 import { type OnCallModelFunctionAnalyticsDetails } from './analytics.details';
 /**
@@ -74,7 +74,7 @@ export interface McpVisibilityContext {
     readonly auth?: FirebaseServerAuthData;
     /**
      * The caller's OIDC scopes, when the request was authenticated with a `scope`-bearing token.
-     * `undefined` for non-OIDC callers — treated the same as `oidcCallModelScopePreAssert` bypass.
+     * `undefined` for non-OIDC callers — treated the same as the model-api scope gate's non-OIDC bypass.
      */
     readonly scopes?: ReadonlySet<string>;
     /**
@@ -302,6 +302,21 @@ export interface OnCallModelFunctionApiDetails<R = unknown, M = unknown> {
      * When provided, the dispatch chain will call lifecycle hooks around handler execution.
      */
     readonly analytics?: OnCallModelFunctionAnalyticsDetails;
+    /**
+     * Optional per-function OIDC scope TERM an OIDC-authenticated caller must additionally hold to
+     * invoke this handler, on top of the per-verb `model.<call>` scope.
+     *
+     * A single scope string requires that exact scope; a `readonly` array is an OR-group the caller
+     * satisfies by holding ANY member (see {@link OidcScopeTerm}). This term is the finest (highest
+     * precedence) source for the effective group requirement — it overrides any model-level or default
+     * requirement configured on the model-api layer (`ModelApiDispatchConfig`).
+     *
+     * Composes with the CRUD-verb scope enforced by the model-api scope gate (`assertModelApiOidcScope`) as AND-of-ORs: an
+     * OIDC caller still needs `model.<call>` AND this term. Non-OIDC callers (Firebase ID tokens)
+     * bypass scope enforcement entirely and are unaffected. Also folded into the MCP tool-list
+     * visibility filter, so a tool the caller cannot satisfy this term for is neither listed nor callable.
+     */
+    readonly requiredScope?: OidcScopeTerm;
 }
 /**
  * Ref interface for objects (functions) that carry handler-level _apiDetails.
@@ -564,6 +579,20 @@ export declare function getModelApiDetails(callModelFn: Maybe<OnCallApiDetailsRe
  * @returns The analytics details for the resolved handler, or undefined.
  */
 export declare function resolveAnalyticsFromApiDetails(apiDetails: OnCallModelApiDetails, call: OnCallFunctionType, modelType: FirestoreModelType, specifier?: ModelFirebaseCrudFunctionSpecifier): Maybe<OnCallModelFunctionAnalyticsDetails>;
+/**
+ * Resolves the leaf-level per-function required OIDC scope from the aggregated _apiDetails tree.
+ *
+ * Walks: call -> modelType -> specifier (if specifier-level), then reads the `requiredScope`
+ * field from the handler-level {@link OnCallModelFunctionApiDetails}. Mirrors
+ * {@link resolveAnalyticsFromApiDetails}.
+ *
+ * @param apiDetails - The top-level aggregated API details.
+ * @param call - The CRUD operation type to look up.
+ * @param modelType - The Firestore model type to look up.
+ * @param specifier - Optional specifier key for variant handlers.
+ * @returns The per-function required scope for the resolved handler, or undefined.
+ */
+export declare function resolveRequiredScopeFromApiDetails(apiDetails: OnCallModelApiDetails, call: OnCallFunctionType, modelType: FirestoreModelType, specifier?: ModelFirebaseCrudFunctionSpecifier): Maybe<OidcScopeTerm>;
 /**
  * @deprecated Use {@link OnCallModelTypeApiDetails} instead.
  */

package/src/lib/nest/model/crud.assert.function.d.ts

@@ -1,6 +1,6 @@
 import { type Maybe } from '@dereekb/util';
 import { type NestContextCallableRequest } from '../function/nest';
-import { type OnCallFunctionType, type FirestoreModelType } from '@dereekb/firebase';
+import { type OnCallFunctionType, type FirestoreModelType, type OidcScopeTerm } from '@dereekb/firebase';
 /**
  * Discriminator for the category of CRUD operation being asserted.
  *
@@ -34,6 +34,15 @@ export interface AssertModelCrudRequestFunctionContext<N, I = unknown> {
      * The optional sub-operation specifier (e.g., 'username', 'fromUpload').
      */
     readonly specifier: Maybe<string>;
+    /**
+     * The per-function required OIDC scope TERM declared via `withApiDetails({ requiredScope })`, when present.
+     *
+     * A single scope string, or a `readonly` array as an OR-group (see {@link OidcScopeTerm}). Resolved
+     * from the handler's `_apiDetails` at dispatch so the model-api scope gate (`assertModelApiOidcScope`)
+     * can enforce it as the finest group term (AND-ed with the per-verb `model.<call>` scope).
+     * `undefined` when the handler declares no extra scope.
+     */
+    readonly requiredScope?: Maybe<OidcScopeTerm>;
 }
 /**
  * Pre-assertion hook invoked before a model CRUD handler executes.

package/test/index.cjs.js

@@ -4922,18 +4922,24 @@ function _ts_generator$1(thisArg, body) {
 }
 /**
  * Resolves the scopes string from config, or falls back to all registered scopes
- * from the provider config — excluding any `adminOnlyScopes`.
+ * from the provider config — excluding any `adminOnlyScopes` or provider-profile-gated scopes.
  *
  * Admin-only scopes (e.g. `token.service`) are dropped from the default "all scopes" request because
  * the provider hard-rejects them for non-admin users, and this default flow logs in an arbitrary
  * (often non-admin) user. Tests that need an admin-only scope pass it explicitly via `config.scopes`.
  *
+ * Provider-profile-gated scopes (e.g. `lms`, `reports`) are dropped for the same reason: they are
+ * unlocked only for a client an admin has assigned the corresponding profile to, and this flow creates
+ * a fresh client with no profiles — so the consent unlock gate hard-rejects them (finishing the
+ * interaction with `access_denied` and no `code`). Tests that need a gated scope create a client with
+ * the profile and pass the scope explicitly via `config.scopes`.
+ *
  * @param nestApp - Initialized NestJS application used to resolve {@link OidcAccountService} when no scopes override is given.
  * @param config - Optional flow config; when `config.scopes` is set, it is returned verbatim.
  * @returns The space-separated scope string to pass to the `/oidc/auth` endpoint.
  */ function resolveScopes(nestApp, config) {
     return _async_to_generator$1(function() {
-        var result, _providerConfig_adminOnlyScopes, accountService, providerConfig, adminOnlyScopes;
+        var result, _providerConfig_adminOnlyScopes, _providerConfig_providerProfiles, accountService, providerConfig, adminOnlyScopes, profileGatedScopes;
         return _ts_generator$1(this, function(_state) {
             if (config === null || config === void 0 ? void 0 : config.scopes) {
                 result = config.scopes;
@@ -4941,8 +4947,9 @@ function _ts_generator$1(thisArg, body) {
                 accountService = nestApp.get(oidc.OidcAccountService);
                 providerConfig = accountService.providerConfig;
                 adminOnlyScopes = new Set((_providerConfig_adminOnlyScopes = providerConfig.adminOnlyScopes) !== null && _providerConfig_adminOnlyScopes !== void 0 ? _providerConfig_adminOnlyScopes : []);
+                profileGatedScopes = firebase.scopesForOidcProviderProfiles((_providerConfig_providerProfiles = providerConfig.providerProfiles) !== null && _providerConfig_providerProfiles !== void 0 ? _providerConfig_providerProfiles : []);
                 result = Object.keys(providerConfig.claims).filter(function(scope) {
-                    return !adminOnlyScopes.has(scope);
+                    return !adminOnlyScopes.has(scope) && !profileGatedScopes.has(scope);
                 }).join(' ');
             }
             return [

package/test/index.esm.js

@@ -1,7 +1,7 @@
 import { randomEmailFactory, randomPhoneNumberFactory, mapGetter, incrementingNumberFactory, asGetter, getValueFromGetter, cachedGetter, asArray, mapObjectMap, unixDateTimeSecondsNumberForNow } from '@dereekb/util';
 import { useTestContextFixture, AbstractChildTestContextFixture, testContextBuilder, AbstractTestContextFixture, useTestFunctionFixture, useTestFunctionMapFixture, ExpectedErrorOfSpecificTypeError } from '@dereekb/util/test';
 import { decode } from 'jsonwebtoken';
-import { flatFirestoreModelKey, twoWayFlatFirestoreModelKey, firestoreContextFactory, firebaseStorageContextFactory } from '@dereekb/firebase';
+import { flatFirestoreModelKey, twoWayFlatFirestoreModelKey, firestoreContextFactory, firebaseStorageContextFactory, scopesForOidcProviderProfiles } from '@dereekb/firebase';
 import admin from 'firebase-admin';
 import functions from 'firebase-functions-test';
 import { makeTestingFirestoreDrivers, TestFirestoreInstance, TestFirestoreContextFixture, makeTestingFirebaseStorageDrivers, TestFirebaseStorageInstance, TestFirebaseStorageContextFixture, mockItemFirestoreCollection, testWithMockItemCollectionFixture, testWithMockItemStorageFixture } from '@dereekb/firebase/test';
@@ -4921,18 +4921,24 @@ function _ts_generator$1(thisArg, body) {
 }
 /**
  * Resolves the scopes string from config, or falls back to all registered scopes
- * from the provider config — excluding any `adminOnlyScopes`.
+ * from the provider config — excluding any `adminOnlyScopes` or provider-profile-gated scopes.
  *
  * Admin-only scopes (e.g. `token.service`) are dropped from the default "all scopes" request because
  * the provider hard-rejects them for non-admin users, and this default flow logs in an arbitrary
  * (often non-admin) user. Tests that need an admin-only scope pass it explicitly via `config.scopes`.
  *
+ * Provider-profile-gated scopes (e.g. `lms`, `reports`) are dropped for the same reason: they are
+ * unlocked only for a client an admin has assigned the corresponding profile to, and this flow creates
+ * a fresh client with no profiles — so the consent unlock gate hard-rejects them (finishing the
+ * interaction with `access_denied` and no `code`). Tests that need a gated scope create a client with
+ * the profile and pass the scope explicitly via `config.scopes`.
+ *
  * @param nestApp - Initialized NestJS application used to resolve {@link OidcAccountService} when no scopes override is given.
  * @param config - Optional flow config; when `config.scopes` is set, it is returned verbatim.
  * @returns The space-separated scope string to pass to the `/oidc/auth` endpoint.
  */ function resolveScopes(nestApp, config) {
     return _async_to_generator$1(function() {
-        var result, _providerConfig_adminOnlyScopes, accountService, providerConfig, adminOnlyScopes;
+        var result, _providerConfig_adminOnlyScopes, _providerConfig_providerProfiles, accountService, providerConfig, adminOnlyScopes, profileGatedScopes;
         return _ts_generator$1(this, function(_state) {
             if (config === null || config === void 0 ? void 0 : config.scopes) {
                 result = config.scopes;
@@ -4940,8 +4946,9 @@ function _ts_generator$1(thisArg, body) {
                 accountService = nestApp.get(OidcAccountService);
                 providerConfig = accountService.providerConfig;
                 adminOnlyScopes = new Set((_providerConfig_adminOnlyScopes = providerConfig.adminOnlyScopes) !== null && _providerConfig_adminOnlyScopes !== void 0 ? _providerConfig_adminOnlyScopes : []);
+                profileGatedScopes = scopesForOidcProviderProfiles((_providerConfig_providerProfiles = providerConfig.providerProfiles) !== null && _providerConfig_providerProfiles !== void 0 ? _providerConfig_providerProfiles : []);
                 result = Object.keys(providerConfig.claims).filter(function(scope) {
-                    return !adminOnlyScopes.has(scope);
+                    return !adminOnlyScopes.has(scope) && !profileGatedScopes.has(scope);
                 }).join(' ');
             }
             return [

package/test/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.28.0",
-    "@dereekb/date": "13.28.0",
-    "@dereekb/firebase": "13.28.0",
-    "@dereekb/firebase-server": "13.28.0",
-    "@dereekb/firebase-server/oidc": "13.28.0",
-    "@dereekb/model": "13.28.0",
-    "@dereekb/nestjs": "13.28.0",
-    "@dereekb/rxjs": "13.28.0",
-    "@dereekb/util": "13.28.0",
+    "@dereekb/analytics": "13.30.0",
+    "@dereekb/date": "13.30.0",
+    "@dereekb/firebase": "13.30.0",
+    "@dereekb/firebase-server": "13.30.0",
+    "@dereekb/firebase-server/oidc": "13.30.0",
+    "@dereekb/model": "13.30.0",
+    "@dereekb/nestjs": "13.30.0",
+    "@dereekb/rxjs": "13.30.0",
+    "@dereekb/util": "13.30.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.1.19",
@@ -23,7 +23,7 @@
     "supertest": "^7.2.2"
   },
   "devDependencies": {
-    "@dereekb/nestjs": "13.28.0"
+    "@dereekb/nestjs": "13.30.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/test/src/lib/oidc/oidc.test.flow.d.ts

@@ -1,5 +1,5 @@
 import { type INestApplication } from '@nestjs/common';
-import type { OidcTokenEndpointAuthMethod } from '@dereekb/firebase';
+import { type OidcTokenEndpointAuthMethod } from '@dereekb/firebase';
 import { OidcClientService } from '@dereekb/firebase-server/oidc';
 /**
  * Configuration for {@link performFullOAuthFlow}.

package/twilio/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/firebase-server/twilio",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "peerDependencies": {
-    "@dereekb/date": "13.28.0",
-    "@dereekb/firebase": "13.28.0",
-    "@dereekb/firebase-server": "13.28.0",
-    "@dereekb/model": "13.28.0",
-    "@dereekb/nestjs": "13.28.0",
-    "@dereekb/rxjs": "13.28.0",
-    "@dereekb/util": "13.28.0"
+    "@dereekb/date": "13.30.0",
+    "@dereekb/firebase": "13.30.0",
+    "@dereekb/firebase-server": "13.30.0",
+    "@dereekb/model": "13.30.0",
+    "@dereekb/nestjs": "13.30.0",
+    "@dereekb/rxjs": "13.30.0",
+    "@dereekb/util": "13.30.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/zoho/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/zoho",
-  "version": "13.28.0",
+  "version": "13.30.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.28.0",
-    "@dereekb/date": "13.28.0",
-    "@dereekb/model": "13.28.0",
-    "@dereekb/nestjs": "13.28.0",
-    "@dereekb/rxjs": "13.28.0",
-    "@dereekb/firebase": "13.28.0",
-    "@dereekb/util": "13.28.0",
-    "@dereekb/zoho": "13.28.0"
+    "@dereekb/analytics": "13.30.0",
+    "@dereekb/date": "13.30.0",
+    "@dereekb/model": "13.30.0",
+    "@dereekb/nestjs": "13.30.0",
+    "@dereekb/rxjs": "13.30.0",
+    "@dereekb/firebase": "13.30.0",
+    "@dereekb/util": "13.30.0",
+    "@dereekb/zoho": "13.30.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/oidc/src/lib/scope.d.ts

@@ -1,19 +0,0 @@
-import { type OnCallTypedModelParams } from '@dereekb/firebase';
-import { type AssertModelCrudRequestFunction } from '@dereekb/firebase-server';
-/**
- * Builds a {@link AssertModelCrudRequestFunction} that rejects callModel requests
- * lacking the OIDC scope mapped from the call type.
- *
- * Bypasses the check (no-op) when the request is not OIDC-authenticated — i.e.
- * when {@link getOidcScopesFromRequest} returns `undefined` because there is no
- * `auth.token.scope` claim on the request. Regular Firebase ID-token callers are
- * unaffected and continue to be gated by auth roles.
- *
- * Bypasses the check for custom (non-CRUD) call types so app-specific verbs
- * remain unrestricted unless an app wires its own assertion.
- *
- * Wire as the `preAssert` of {@link onCallModel}.
- *
- * @returns The pre-assertion function ready to plug into `OnCallModelConfig.preAssert`.
- */
-export declare function oidcCallModelScopePreAssert(): AssertModelCrudRequestFunction<unknown, OnCallTypedModelParams>;