@dereekb/firebase-server 13.30.0 → 13.32.0

package/model/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.30.0",
+  "version": "13.32.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.30.0",
-    "@dereekb/date": "13.30.0",
-    "@dereekb/firebase": "13.30.0",
-    "@dereekb/firebase-server": "13.30.0",
-    "@dereekb/model": "13.30.0",
-    "@dereekb/nestjs": "13.30.0",
-    "@dereekb/rxjs": "13.30.0",
-    "@dereekb/util": "13.30.0",
+    "@dereekb/analytics": "13.32.0",
+    "@dereekb/date": "13.32.0",
+    "@dereekb/firebase": "13.32.0",
+    "@dereekb/firebase-server": "13.32.0",
+    "@dereekb/model": "13.32.0",
+    "@dereekb/nestjs": "13.32.0",
+    "@dereekb/rxjs": "13.32.0",
+    "@dereekb/util": "13.32.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.1",

package/model/src/lib/mailgun/index.d.ts

@@ -1 +1,2 @@
+export * from './notification.healthcheck.mailgun';
 export * from './notification.send.service.mailgun';

package/model/src/lib/mailgun/notification.healthcheck.mailgun.d.ts

@@ -0,0 +1,115 @@
+/**
+ * @module notification.healthcheck.mailgun
+ *
+ * Mailgun-backed diagnostics for the email delivery method.
+ *
+ * This is where "the user says they aren't getting emails" turns into an actual answer. In practice the
+ * cause is almost always one of:
+ *
+ * - the address is on the domain's **suppression list** (a past bounce or spam complaint), after which
+ *   Mailgun silently drops every subsequent message to it
+ * - recent messages to the address were **rejected or failed**, with a reason Mailgun recorded
+ * - nothing was ever sent to the address at all, which points upstream at configuration
+ * - the sending **domain** itself is not active
+ *
+ * All four are readable from Mailgun without sending anything. When that is not conclusive, an opt-in
+ * probe sends a real message and resolves its outcome from the Events API. Resolution is asynchronous —
+ * Mailgun records the outcome seconds after the send — so the probe is recorded as pending and settled
+ * by a later verification, which the client polls for automatically. Nothing here ever asks the user to
+ * come back and check for themselves.
+ */
+import { type Maybe, type Minutes, type PromiseOrValue } from '@dereekb/util';
+import { type FirebaseAuthUserId } from '@dereekb/firebase';
+import { type MailgunRecipient, type MailgunService, type MailgunTemplateEmailRequest } from '@dereekb/nestjs/mailgun';
+import { type NotificationEmailSendServiceHealthCheckService } from '../notification/notification.healthcheck.service';
+/**
+ * How long a dispatched probe may stay unresolved before it is reported as failed.
+ *
+ * Mailgun normally records a `delivered` or `failed` event within seconds; a probe with no event after
+ * this long is not going to arrive.
+ */
+export declare const DEFAULT_MAILGUN_HEALTH_CHECK_PROBE_TIMEOUT_MINUTES = 15;
+/**
+ * Input for building the test email dispatched as a delivery probe.
+ */
+export interface MailgunNotificationHealthCheckProbeBuilderInput {
+    /**
+     * The Mailgun service, for reading the configured sender and client url.
+     */
+    readonly mailgunService: MailgunService;
+    /**
+     * The recipient to send the probe to.
+     */
+    readonly recipient: MailgunRecipient;
+    /**
+     * The user the health check is running for.
+     */
+    readonly uid: FirebaseAuthUserId;
+}
+/**
+ * Builds the test email dispatched as a delivery probe.
+ *
+ * The message should be recognizable to whoever receives it — it lands in a real inbox, unannounced,
+ * because someone asked the system to check whether their email works.
+ */
+export type MailgunNotificationHealthCheckProbeBuilder = (input: MailgunNotificationHealthCheckProbeBuilderInput) => PromiseOrValue<MailgunTemplateEmailRequest>;
+/**
+ * Configuration for {@link mailgunNotificationEmailSendServiceHealthCheckService}.
+ */
+export interface MailgunNotificationEmailSendServiceHealthCheckServiceConfig {
+    /**
+     * The Mailgun service to diagnose against.
+     */
+    readonly mailgunService: MailgunService;
+    /**
+     * Builds the probe message. Probing is unavailable when this is not provided.
+     */
+    readonly probeBuilder?: Maybe<MailgunNotificationHealthCheckProbeBuilder>;
+    /**
+     * The maximum number of recent events to inspect per address.
+     */
+    readonly recentEventsLimit?: Maybe<number>;
+    /**
+     * How far back to look for recent events, in days.
+     */
+    readonly recentEventsWindowDays?: Maybe<number>;
+    /**
+     * Whether to run Mailgun address validation as part of the check.
+     *
+     * Off by default, because validation consumes a separate Mailgun quota.
+     */
+    readonly validateAddress?: Maybe<boolean>;
+    /**
+     * How long a dispatched probe may stay unresolved before it is reported as failed.
+     *
+     * Defaults to {@link DEFAULT_MAILGUN_HEALTH_CHECK_PROBE_TIMEOUT_MINUTES}.
+     */
+    readonly probeTimeoutMinutes?: Maybe<Minutes>;
+}
+/**
+ * Creates a {@link NotificationEmailSendServiceHealthCheckService} backed by the Mailgun API.
+ *
+ * Attach the result to a {@link NotificationEmailSendService} as its `healthCheckService` and the
+ * notification health check will pick it up automatically.
+ *
+ * @param config - The Mailgun service plus optional probe builder and inspection limits.
+ * @returns A health check service for the email delivery method.
+ *
+ * @example
+ * ```ts
+ * const emailSendService = mailgunNotificationEmailSendService({ mailgunService, messageBuilders });
+ *
+ * const sendServiceWithHealthCheck: NotificationEmailSendService = {
+ *   ...emailSendService,
+ *   healthCheckService: mailgunNotificationEmailSendServiceHealthCheckService({
+ *     mailgunService,
+ *     probeBuilder: ({ recipient }) => ({
+ *       to: recipient,
+ *       template: 'notificationtemplate',
+ *       subject: 'Email delivery test'
+ *     })
+ *   })
+ * };
+ * ```
+ */
+export declare function mailgunNotificationEmailSendServiceHealthCheckService(config: MailgunNotificationEmailSendServiceHealthCheckServiceConfig): NotificationEmailSendServiceHealthCheckService;

package/model/src/lib/notification/index.d.ts

@@ -3,6 +3,8 @@ export * from './notification.action.server.init';
 export * from './notification.config.service';
 export * from './notification.config';
 export * from './notification.create.run';
+export * from './notification.healthcheck';
+export * from './notification.healthcheck.service';
 export * from './notification.module';
 export * from './notification.send.service.notificationsummary';
 export * from './notification.send.service.text';

package/model/src/lib/notification/notification.action.server.d.ts

@@ -1,7 +1,7 @@
-import { type AsyncNotificationSummaryCreateAction, type AsyncNotificationUserCreateAction, type AsyncNotificationUserUpdateAction, type CleanupSentNotificationsParams, type CleanupOldNotificationLoggedEventDaysParams, type CleanupOldNotificationLoggedEventDaysResult, type CreateNotificationBoxParams, type CreateNotificationSummaryParams, type CreateNotificationUserParams, type NotificationSummaryDocument, type NotificationUser, type NotificationUserDocument, type SendNotificationParams, type SendQueuedNotificationsParams, type UpdateNotificationBoxParams, type UpdateNotificationBoxRecipientParams, type UpdateNotificationUserParams, type AsyncNotificationBoxCreateAction, type AsyncNotificationBoxUpdateAction, type CleanupSentNotificationsResult, type FirestoreContextReference, type NotificationBox, type NotificationBoxDocument, type NotificationDocument, type NotificationFirestoreCollections, type SendNotificationResult, type SendQueuedNotificationsResult, type Transaction, type ResyncAllNotificationUserParams, type ResyncAllNotificationUsersResult, type ResyncNotificationUserResult, type ResyncNotificationUserParams, type AppNotificationTemplateTypeInfoRecordServiceRef, type AsyncNotificationSummaryUpdateAction, type UpdateNotificationSummaryParams, type NotificationBoxDocumentReferencePair } from '@dereekb/firebase';
+import { type AsyncNotificationSummaryCreateAction, type AsyncNotificationUserCreateAction, type AsyncNotificationUserUpdateAction, type CleanupSentNotificationsParams, type CleanupOldNotificationLoggedEventDaysParams, type CleanupOldNotificationLoggedEventDaysResult, type CreateNotificationBoxParams, type CreateNotificationSummaryParams, type CreateNotificationUserParams, type NotificationSummaryDocument, type NotificationUser, type NotificationUserDocument, type SendNotificationParams, type SendQueuedNotificationsParams, type UpdateNotificationBoxParams, type UpdateNotificationBoxRecipientParams, type NotificationUserHealthCheckParams, type NotificationUserHealthCheckResult, type UpdateNotificationUserParams, type AsyncNotificationBoxCreateAction, type AsyncNotificationBoxUpdateAction, type CleanupSentNotificationsResult, type FirestoreContextReference, type NotificationBox, type NotificationBoxDocument, type NotificationDocument, type NotificationFirestoreCollections, type SendNotificationResult, type SendQueuedNotificationsResult, type Transaction, type ResyncAllNotificationUserParams, type ResyncAllNotificationUsersResult, type ResyncNotificationUserResult, type ResyncNotificationUserParams, type AppNotificationTemplateTypeInfoRecordServiceRef, type AsyncNotificationSummaryUpdateAction, type UpdateNotificationSummaryParams, type NotificationBoxDocumentReferencePair } from '@dereekb/firebase';
 import { type FirebaseServerActionsContext, type FirebaseServerAuthServiceRef } from '@dereekb/firebase-server';
 import { type TransformAndValidateFunctionResult } from '@dereekb/model';
-import { type Maybe } from '@dereekb/util';
+import { type Maybe, type Minutes, type Seconds } from '@dereekb/util';
 import { type InjectionToken } from '@nestjs/common';
 import { type NotificationTemplateServiceRef } from './notification.config.service';
 import { type NotificationSendServiceRef } from './notification.send.service';
@@ -24,11 +24,49 @@ export declare const NOTIFICATION_SERVER_ACTION_CONTEXT_TOKEN: InjectionToken;
  */
 export interface BaseNotificationServerActionsContext extends FirebaseServerActionsContext, NotificationFirestoreCollections, FirebaseServerAuthServiceRef, FirestoreContextReference {
 }
+/**
+ * App-level tuning for the NotificationUser delivery health check.
+ *
+ * Both windows are enforced by the server and counted down by the client, so an app that overrides one
+ * must give the SAME value to its client (see the dbx-firebase health check config). Declaring the value
+ * once in a package both sides import is the way to keep them from drifting — otherwise the UI will
+ * offer a check or a test message that the server then rejects.
+ */
+export interface NotificationUserHealthCheckServerConfig {
+    /**
+     * How long a user must wait between test messages on a single delivery method.
+     *
+     * Defaults to {@link DEFAULT_NOTIFICATION_USER_HEALTH_CHECK_PROBE_THROTTLE_MINUTES}.
+     */
+    readonly probeThrottleMinutes?: Maybe<Minutes>;
+    /**
+     * How long a user must wait between health check runs.
+     *
+     * Defaults to {@link DEFAULT_NOTIFICATION_USER_HEALTH_CHECK_THROTTLE_MINUTES}.
+     */
+    readonly runThrottleMinutes?: Maybe<Minutes>;
+    /**
+     * How long a caller must wait between verifications of a check's pending probes.
+     *
+     * Defaults to {@link DEFAULT_NOTIFICATION_USER_HEALTH_CHECK_VERIFY_THROTTLE_SECONDS}. In seconds
+     * because a verification exists to be polled while the user watches for their test message to land.
+     */
+    readonly verifyThrottleSeconds?: Maybe<Seconds>;
+}
+/**
+ * Reference to a {@link NotificationUserHealthCheckServerConfig}.
+ */
+export interface NotificationUserHealthCheckServerConfigRef {
+    /**
+     * Tuning for the delivery health check. Every field falls back to the library default when absent.
+     */
+    readonly notificationUserHealthCheckConfig?: Maybe<NotificationUserHealthCheckServerConfig>;
+}
 /**
  * Full context for notification server actions, extending the base with template resolution,
  * send channel orchestration, task dispatch, and expedite services.
  */
-export interface NotificationServerActionsContext extends BaseNotificationServerActionsContext, AppNotificationTemplateTypeInfoRecordServiceRef, NotificationTemplateServiceRef, NotificationSendServiceRef, NotificationTaskServiceRef {
+export interface NotificationServerActionsContext extends BaseNotificationServerActionsContext, AppNotificationTemplateTypeInfoRecordServiceRef, NotificationTemplateServiceRef, NotificationSendServiceRef, NotificationTaskServiceRef, NotificationUserHealthCheckServerConfigRef {
 }
 /**
  * Abstract service class defining all server-side notification CRUD and delivery actions.
@@ -50,6 +88,7 @@ export declare abstract class NotificationServerActions {
     abstract updateNotificationUser(params: UpdateNotificationUserParams): AsyncNotificationUserUpdateAction<UpdateNotificationUserParams>;
     abstract resyncNotificationUser(params: ResyncNotificationUserParams): Promise<TransformAndValidateFunctionResult<ResyncNotificationUserParams, (notificationUserDocument: NotificationUserDocument) => Promise<ResyncNotificationUserResult>>>;
     abstract resyncAllNotificationUsers(params?: ResyncAllNotificationUserParams): Promise<ResyncAllNotificationUsersResult>;
+    abstract notificationUserHealthCheck(params: NotificationUserHealthCheckParams): Promise<TransformAndValidateFunctionResult<NotificationUserHealthCheckParams, (notificationUserDocument: NotificationUserDocument) => Promise<NotificationUserHealthCheckResult>>>;
     abstract createNotificationSummary(params: CreateNotificationSummaryParams): AsyncNotificationSummaryCreateAction<CreateNotificationSummaryParams>;
     abstract updateNotificationSummary(params: UpdateNotificationSummaryParams): AsyncNotificationSummaryUpdateAction<UpdateNotificationSummaryParams>;
     abstract createNotificationBox(params: CreateNotificationBoxParams): AsyncNotificationBoxCreateAction<CreateNotificationBoxParams>;

package/model/src/lib/notification/notification.error.d.ts

@@ -59,6 +59,37 @@ export declare function notificationBoxExistsForModelError(): import("firebase-f
  * @returns A precondition conflict error with the recipient-not-found error code.
  */
 export declare function notificationBoxRecipientDoesNotExistsError(): import("firebase-functions/https").HttpsError;
+/**
+ * Creates an error indicating that a health check was run again before its throttle window passed.
+ *
+ * Thrown by the {@link NotificationUser} health check when the stored check is too recent.
+ *
+ * @param nextRunAt - The time the next health check may be run.
+ * @returns A precondition conflict error with the health-check-throttled error code.
+ */
+export declare function notificationUserHealthCheckThrottledError(nextRunAt: Date): import("firebase-functions/https").HttpsError;
+/**
+ * Creates an error indicating that a test message was requested again before its throttle window passed.
+ *
+ * Thrown by the {@link NotificationUser} health check when a probe was dispatched too recently. Separate
+ * from {@link notificationUserHealthCheckThrottledError}: running the check does not consume the test
+ * message allowance.
+ *
+ * @param nextProbeAt - The time the next test message may be dispatched.
+ * @returns A precondition conflict error with the probe-throttled error code.
+ */
+export declare function notificationUserHealthCheckProbeThrottledError(nextProbeAt: Date): import("firebase-functions/https").HttpsError;
+/**
+ * Creates an error indicating that pending probes were verified again before their throttle window passed.
+ *
+ * Thrown by the {@link NotificationUser} health check on a `verifyPendingProbesOnly` run that arrives too
+ * soon after the last one. Separate from {@link notificationUserHealthCheckThrottledError}: verifying an
+ * in-flight test message is a poll, so it neither answers to nor consumes the user's run allowance.
+ *
+ * @param nextVerifyAt - The time the next verification may be run.
+ * @returns A precondition conflict error with the verify-throttled error code.
+ */
+export declare function notificationUserHealthCheckVerifyThrottledError(nextVerifyAt: Date): import("firebase-functions/https").HttpsError;
 /**
  * Creates an error indicating that the given UID does not correspond to an existing Firebase Auth user.
  *

package/model/src/lib/notification/notification.healthcheck.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @module notification.healthcheck
+ *
+ * The `healthCheck` server action: a self-serve diagnosis of why a given user is or is not receiving
+ * notifications on each delivery method.
+ *
+ * The check runs in three passes:
+ *
+ * 1. **Configuration** — mirrors the gates {@link expandNotificationRecipients} applies at send time,
+ *    so a finding here corresponds to a real reason a message would be dropped.
+ * 2. **Subscriptions** — inspects the user's {@link NotificationBox} documents to confirm they exist,
+ *    are initialized, and carry a recipient entry matching the user's own configuration.
+ * 3. **Provider** — delegates to each delivery method's optional
+ *    {@link NotificationSendServiceHealthCheckService} for provider-specific diagnostics and for
+ *    dispatching/resolving a delivery probe.
+ *
+ * The result is persisted to the user's `hc` field, because delivery confirmation is asynchronous: a
+ * probe dispatched by one run is resolved by a later one. That later run is normally a
+ * `verifyPendingProbesOnly` VERIFICATION rather than anything the user does — a cheap poll that consults
+ * a provider only where a probe is actually in flight, answers to its own short window, and advances
+ * `vat` instead of `at` so that watching a test message never consumes the user's run allowance. The
+ * client reads the stored check live, so a resolved probe simply appears.
+ */
+import { type NotificationUserDocument, type NotificationUserHealthCheckParams, type NotificationUserHealthCheckResult } from '@dereekb/firebase';
+import { type NotificationServerActionsContext } from './notification.action.server';
+/**
+ * The maximum number of the user's notification boxes to inspect in a single health check.
+ *
+ * A user can be subscribed to an unbounded number of boxes; a health check is interactive, so it
+ * samples rather than walking all of them.
+ */
+export declare const DEFAULT_MAX_NOTIFICATION_BOXES_TO_INSPECT_PER_HEALTH_CHECK = 10;
+/**
+ * Factory for the `healthCheck` action on a {@link NotificationUser}.
+ *
+ * @param context - The notification server actions context.
+ * @returns A transform-and-validate function that runs a delivery health check for a notification user.
+ */
+export declare function notificationUserHealthCheckFactory(context: NotificationServerActionsContext): import("@dereekb/model").TransformAndValidateFunctionResultFunction<NotificationUserHealthCheckParams, (notificationUserDocument: NotificationUserDocument) => Promise<NotificationUserHealthCheckResult>, object, unknown>;

package/model/src/lib/notification/notification.healthcheck.service.d.ts

@@ -0,0 +1,118 @@
+/**
+ * @module notification.healthcheck.service
+ *
+ * The extension point that lets each delivery method contribute its own diagnostics to a
+ * notification delivery health check.
+ *
+ * The shared health check action can only inspect what it knows about: the user's configuration,
+ * their notification boxes, and the send queue. Everything beyond that is provider-specific — whether
+ * an address is on an email provider's suppression list, whether a carrier rejected an SMS, whether a
+ * test message actually arrived. A send service opts into contributing that knowledge by exposing a
+ * {@link NotificationSendServiceHealthCheckService}.
+ */
+import { type EmailAddress, type E164PhoneNumber, type Maybe } from '@dereekb/util';
+import { type FirebaseAuthUserId, type NotificationDeliveryMethod, type NotificationHealthCheckIssue, type NotificationHealthCheckProbe, type NotificationSummaryId, type NotificationTemplateType } from '@dereekb/firebase';
+/**
+ * Input to a {@link NotificationSendServiceHealthCheckService}.
+ *
+ * @template T - The delivery target type for the method (email address, phone number, summary id).
+ */
+export interface NotificationSendServiceHealthCheckRequest<T = unknown> {
+    /**
+     * The delivery method being diagnosed.
+     */
+    readonly method: NotificationDeliveryMethod;
+    /**
+     * The resolved delivery target to diagnose.
+     */
+    readonly target: T;
+    /**
+     * The user the check is being run for.
+     */
+    readonly uid: FirebaseAuthUserId;
+    /**
+     * Whether this run is permitted to dispatch a real probe message to the target.
+     *
+     * Always respect this — a probe sends real mail or SMS to a real person, and the caller has decided
+     * whether that is acceptable right now.
+     */
+    readonly sendProbe: boolean;
+    /**
+     * A probe dispatched by an earlier run that has not reached a final status yet.
+     *
+     * When present, the service should try to resolve it and return it (updated) as the response's probe.
+     */
+    readonly pendingProbe?: Maybe<NotificationHealthCheckProbe>;
+    /**
+     * The notification template type the check is being evaluated against, if the caller specified one.
+     */
+    readonly notificationTemplateType?: Maybe<NotificationTemplateType>;
+    /**
+     * The time the health check started. Use this rather than reading the clock so every finding in a
+     * single check shares one reference time.
+     */
+    readonly now: Date;
+}
+/**
+ * Output of a {@link NotificationSendServiceHealthCheckService}.
+ */
+export interface NotificationSendServiceHealthCheckResponse {
+    /**
+     * Provider-level findings. May be empty when the provider had nothing to report.
+     */
+    readonly issues: NotificationHealthCheckIssue[];
+    /**
+     * The probe for this delivery method — a newly dispatched one, a resolved pending one, or a pending
+     * one that still has no outcome.
+     */
+    readonly probe?: Maybe<NotificationHealthCheckProbe>;
+}
+/**
+ * Contributes provider-specific diagnostics for one delivery method.
+ *
+ * Implementations should be failure-tolerant: if a provider API is unreachable, report that as an
+ * {@link NotificationHealthCheckStatus.UNKNOWN} issue rather than throwing, so the rest of the health
+ * check still reaches the user.
+ *
+ * @template T - The delivery target type for the method.
+ *
+ * @example
+ * ```ts
+ * const healthCheckService: NotificationEmailSendServiceHealthCheckService = {
+ *   supportsProbe: true,
+ *   async runHealthCheck({ target, sendProbe }) {
+ *     const issues = await inspectSuppressionLists(target);
+ *     const probe = sendProbe ? await dispatchProbe(target) : undefined;
+ *     return { issues, probe };
+ *   }
+ * };
+ * ```
+ */
+export interface NotificationSendServiceHealthCheckService<T = unknown> {
+    /**
+     * Whether this service can dispatch a probe message.
+     *
+     * Reported to callers so a UI can hide the "send a test message" affordance for methods that do not
+     * support it. Defaults to false.
+     */
+    readonly supportsProbe?: Maybe<boolean>;
+    /**
+     * Runs the provider's diagnostics for a single delivery target.
+     *
+     * @param request - The target to diagnose and whether probing is permitted.
+     * @returns The provider's findings and probe state.
+     */
+    runHealthCheck(request: NotificationSendServiceHealthCheckRequest<T>): Promise<NotificationSendServiceHealthCheckResponse>;
+}
+/**
+ * A {@link NotificationSendServiceHealthCheckService} for the email delivery method.
+ */
+export type NotificationEmailSendServiceHealthCheckService = NotificationSendServiceHealthCheckService<EmailAddress>;
+/**
+ * A {@link NotificationSendServiceHealthCheckService} for the text/SMS delivery method.
+ */
+export type NotificationTextSendServiceHealthCheckService = NotificationSendServiceHealthCheckService<E164PhoneNumber>;
+/**
+ * A {@link NotificationSendServiceHealthCheckService} for the in-app notification summary delivery method.
+ */
+export type NotificationSummarySendServiceHealthCheckService = NotificationSendServiceHealthCheckService<NotificationSummaryId>;

package/model/src/lib/notification/notification.send.service.d.ts

@@ -1,5 +1,6 @@
 import { type NotificationSummaryIdForUidFunction, type NotificationMessage, type NotificationSendEmailMessagesResult, type NotificationSendNotificationSummaryMessagesResult, type NotificationSendTextMessagesResult } from '@dereekb/firebase';
 import { type NotificationSendMessagesInstance } from './notification.send';
+import { type NotificationEmailSendServiceHealthCheckService, type NotificationSummarySendServiceHealthCheckService, type NotificationTextSendServiceHealthCheckService } from './notification.healthcheck.service';
 import { type Maybe } from '@dereekb/util';
 /**
  * Provides a reference to a NotificationSendService instance.
@@ -46,6 +47,13 @@ export interface NotificationEmailSendService {
      * Can throw an error if the messages cannot be sent or generated properly due to a configuration error.
      */
     buildSendInstanceForEmailNotificationMessages(notificationMessages: NotificationMessage[]): Promise<NotificationSendMessagesInstance<NotificationSendEmailMessagesResult>>;
+    /**
+     * Optional. Contributes provider-specific diagnostics for the email channel to a notification
+     * delivery health check.
+     *
+     * When absent, a health check reports only what it can determine from configuration and send history.
+     */
+    readonly healthCheckService?: Maybe<NotificationEmailSendServiceHealthCheckService>;
 }
 /**
  * Service dedicated to sending notification text messages.
@@ -57,6 +65,13 @@ export interface NotificationTextSendService {
      * Can throw an error if the messages cannot be sent or generated properly due to a configuration error.
      */
     buildSendInstanceForTextNotificationMessages(notificationMessages: NotificationMessage[]): Promise<NotificationSendMessagesInstance<NotificationSendTextMessagesResult>>;
+    /**
+     * Optional. Contributes provider-specific diagnostics for the text/SMS channel to a notification
+     * delivery health check.
+     *
+     * When absent, a health check reports only what it can determine from configuration and send history.
+     */
+    readonly healthCheckService?: Maybe<NotificationTextSendServiceHealthCheckService>;
 }
 /**
  * Service dedicated to sending/updating NotificationSummary values in the system for the input messages.
@@ -68,4 +83,11 @@ export interface NotificationSummarySendService {
      * Can throw an error if the messages cannot be sent or generated properly due to a configuration error.
      */
     buildSendInstanceForNotificationSummaryMessages(notificationMessages: NotificationMessage[]): Promise<NotificationSendMessagesInstance<NotificationSendNotificationSummaryMessagesResult>>;
+    /**
+     * Optional. Contributes diagnostics for the in-app notification summary channel to a notification
+     * delivery health check.
+     *
+     * When absent, a health check reports only what it can determine from configuration and send history.
+     */
+    readonly healthCheckService?: Maybe<NotificationSummarySendServiceHealthCheckService>;
 }

package/oidc/index.cjs.js

@@ -3555,11 +3555,18 @@ exports.OidcProviderConfigService = __decorate([
  * Resolves the unlocked + required scope sets for a client from the provider-profile registry and
  * the profile keys assigned to that client.
  *
+ * A client with NO assigned profiles resolves to the registry's default profiles (those marked
+ * `isDefault`), so a registry declaring no default resolves exactly as it would from the assigned
+ * keys alone.
+ *
+ * This is the single choke point for a client's profile resolution — the consent unlock gate, the
+ * consent required gate, and the `requiredScopes` interaction param all read through it.
+ *
  * @param providerProfiles - The provider-profile registry (from {@link OidcProviderConfig.providerProfiles}).
  * @param clientProfileKeys - The profile keys assigned to the client (its `dbx_provider_profiles`).
  * @returns The unlocked and required scope sets for the client.
  */ function oidcClientProviderProfileScopes(providerProfiles, clientProfileKeys) {
-    var clientProfiles = firebase.oidcProviderProfilesForKeys(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : [], clientProfileKeys);
+    var clientProfiles = firebase.oidcProviderProfilesForClient(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : [], clientProfileKeys);
     return {
         unlocked: firebase.scopesForOidcProviderProfiles(clientProfiles),
         required: firebase.requiredScopesForOidcProviderProfiles(clientProfiles)
@@ -6212,7 +6219,7 @@ var OidcInteractionController_1;
      * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, adminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref5, redirectTo1, providerProfiles, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref6, redirectTo2, missingRequiredScopes, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref8, redirectTo4, err;
+                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _this_accountService_providerConfig_adminOnlyScopes, _ref1, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, configAdminOnlyScopes, adminOnlyScopes, requestedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref5, redirectTo1, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref6, redirectTo2, missingRequiredScopes, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, _resolveEffectiveSubset, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset1, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset2, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref8, redirectTo4, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -6296,11 +6303,20 @@ var OidcInteractionController_1;
                                 clientPayload = _state.sent();
                                 // Admin-only scope gate. The requested OIDC scope set is `missingOIDCScope ∪ encounteredOIDCScopes`
                                 // (a fresh consent has everything in `missing`; a re-consent may carry already-granted scopes in
-                                // `encountered`). If that set intersects the provider's `adminOnlyScopes` and the resolving user is
-                                // not an admin, hard-reject with `access_denied` rather than silently dropping the scope.
+                                // `encountered`). If that set intersects the admin-only scopes — the provider's `adminOnlyScopes`
+                                // unioned with the scopes of every profile marked `adminOnly` — and the resolving user is not an
+                                // admin, hard-reject with `access_denied` rather than silently dropping the scope.
                                 requestedOIDCScopeSet = new Set(_to_consumable_array$1(missingOIDCScope).concat(_to_consumable_array$1(encounteredOIDCScopes)));
-                                adminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
-                                requestsServiceToken = adminOnlyScopes.some(function(scope) {
+                                providerProfiles = this.accountService.providerConfig.providerProfiles;
+                                configAdminOnlyScopes = (_this_accountService_providerConfig_adminOnlyScopes = this.accountService.providerConfig.adminOnlyScopes) !== null && _this_accountService_providerConfig_adminOnlyScopes !== void 0 ? _this_accountService_providerConfig_adminOnlyScopes : [];
+                                adminOnlyScopes = new Set(_to_consumable_array$1(configAdminOnlyScopes).concat(_to_consumable_array$1(firebase.adminOnlyScopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []))));
+                                requestedAdminOnlyScopes = Array.from(adminOnlyScopes).filter(function(scope) {
+                                    return requestedOIDCScopeSet.has(scope);
+                                });
+                                // Deliberately sourced from the provider config's `adminOnlyScopes` ALONE, unlike the gate above:
+                                // this flag also selects the (highest) service-token TTL tier further down, and a profile marked
+                                // `adminOnly` must gate by admin status WITHOUT widening its grant's lifetime to that tier.
+                                requestsServiceToken = configAdminOnlyScopes.some(function(scope) {
                                     return requestedOIDCScopeSet.has(scope);
                                 });
                                 if (!accountId) return [
@@ -6322,7 +6338,7 @@ var OidcInteractionController_1;
                                 _state.label = 12;
                             case 12:
                                 isAdmin = _tmp1;
-                                if (!(requestsServiceToken && !isAdmin)) return [
+                                if (!(requestedAdminOnlyScopes.length > 0 && !isAdmin)) return [
                                     3,
                                     14
                                 ];
@@ -6330,7 +6346,7 @@ var OidcInteractionController_1;
                                     4,
                                     this.oidcInteractionService.finishInteractionByUid(uid, {
                                         error: 'access_denied',
-                                        error_description: 'token.service is restricted to admins.'
+                                        error_description: "The following scope(s) are restricted to admins: ".concat(requestedAdminOnlyScopes.join(', '), ".")
                                     }, {
                                         mergeWithLastSubmission: true
                                     })
@@ -6342,7 +6358,7 @@ var OidcInteractionController_1;
                                     isSuccessful: false,
                                     uid: accountId,
                                     clientId: clientId,
-                                    serviceToken: true,
+                                    serviceToken: requestsServiceToken,
                                     isAdmin: false,
                                     reason: 'service_token_non_admin',
                                     durationMs: Date.now() - startedAt
@@ -6355,9 +6371,9 @@ var OidcInteractionController_1;
                                 ];
                             case 14:
                                 // Provider-profile scope gate. Any scope referenced by a provider profile is "gated" — available
-                                // only to clients whose assigned profiles unlock it. Independent of the admin-only gate above; a
-                                // scope may be subject to both.
-                                providerProfiles = this.accountService.providerConfig.providerProfiles;
+                                // only to clients whose assigned profiles unlock it (a client with NO assigned profiles resolves
+                                // to the registry's default profiles). Independent of the admin-only gate above; a scope may be
+                                // subject to both.
                                 _oidcClientProviderProfileScopes = oidcClientProviderProfileScopes(providerProfiles, (_ref2 = clientPayload === null || clientPayload === void 0 ? void 0 : clientPayload.dbx_provider_profiles) !== null && _ref2 !== void 0 ? _ref2 : undefined), clientUnlockedScopes = _oidcClientProviderProfileScopes.unlocked, clientRequiredScopes = _oidcClientProviderProfileScopes.required;
                                 profileGatedScopes = firebase.scopesForOidcProviderProfiles(providerProfiles !== null && providerProfiles !== void 0 ? providerProfiles : []);
                                 // Unlock gate: reject any requested gated scope this client's profiles do not unlock.