@dereekb/firebase-server 13.35.0 → 13.37.0

package/mcp/index.cjs.js

@@ -2,15 +2,14 @@
 
 var common = require('@nestjs/common');
 var node_fs = require('node:fs');
-var mcp_js = require('@modelcontextprotocol/sdk/server/mcp.js');
-var types_js = require('@modelcontextprotocol/sdk/types.js');
+var server = require('@modelcontextprotocol/server');
 var firebase = require('@dereekb/firebase');
 var oidc = require('@dereekb/firebase-server/oidc');
 var util = require('@dereekb/util');
 var firebaseServer = require('@dereekb/firebase-server');
 var node_util = require('node:util');
 var model = require('@dereekb/model');
-var streamableHttp_js = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
+var node = require('@modelcontextprotocol/node');
 
 function _class_call_check$5(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
@@ -102,11 +101,12 @@ function _define_property$9(obj, key, value) {
      * protected-resource discovery document's `scopes_supported` (RFC 9728 §2).
      *
      * The base list is pulled automatically from the OIDC provider config via the
-     * injected {@link OidcProviderConfigService.scopesSupported} (i.e.
-     * `Object.keys(providerConfig.claims)`), so the MCP resource advertises exactly
-     * the scopes the issuer supports without the app restating them. Provide this
-     * only to narrow that set — it receives every scope the provider issues and
-     * returns the subset to advertise. When unset, all of them are advertised.
+     * injected {@link OidcProviderConfigService.clientRequestableScopesSupported}, so
+     * the MCP resource advertises the scopes the issuer grants an arbitrary client
+     * without the app restating them. Scopes only an admin-assigned provider profile
+     * unlocks are already excluded — requesting one is fatal at the consent unlock
+     * gate. Provide this only to narrow the set further; it returns the subset to
+     * advertise. When unset, the whole base list is advertised.
      *
      * Advertising these matters because dynamic-registration MCP clients (the Claude
      * Code CLI) read `scopes_supported` to decide which scopes to request on the
@@ -2038,8 +2038,8 @@ function modelGetToolHandler(args, ctx, deps) {
     })();
 }
 function parseModelGetInput(args) {
-    var modelType = args.modelType;
-    var keys = args.keys;
+    var modelType = args['modelType'];
+    var keys = args['keys'];
     if (typeof modelType !== 'string' || modelType.length === 0) {
         throw new Error('model-get: "modelType" is required and must be a non-empty string.');
     }
@@ -2940,7 +2940,7 @@ var MODEL_ROW_SCHEMA = {
     }
 };
 // MCP's `tools/list` validator requires `outputSchema.type === 'object'` at the root
-// (see @modelcontextprotocol/sdk Zod schema), so the variants are expressed via a top-level
+// (see the MCP SDK's `ToolSchema`), so the variants are expressed via a top-level
 // object whose nested `oneOf` discriminates by the `mode` literal.
 var MODEL_INFO_OUTPUT_SCHEMA = {
     type: 'object',
@@ -3742,7 +3742,7 @@ function whoamiToolHandler(args, ctx, deps) {
 }
 // Coerces the `detail` input into a WhoamiDetailLevel, defaulting unknown or absent values to `summary`.
 function parseDetailLevel(args) {
-    var value = args.detail;
+    var value = args['detail'];
     return value === 'claims' || value === 'full' ? value : 'summary';
 }
 function buildResult(output, text) {
@@ -4337,30 +4337,30 @@ function urlModelsToolHandler(args, ctx, deps) {
     })();
 }
 function parseUrlModelsInput(args) {
-    var url = args.url;
+    var url = args['url'];
     if (typeof url !== 'string' || url.length === 0) {
         throw new Error('url-models: "url" is required and must be a non-empty string.');
     }
-    var keysOnly = args.keysOnly === true;
-    var load = args.load === true;
+    var keysOnly = args['keysOnly'] === true;
+    var load = args['load'] === true;
     if (keysOnly && load) {
         throw new Error('url-models: "keysOnly" and "load" cannot be combined — "keysOnly" returns keys without loading documents.');
     }
     var models;
-    if (args.models !== undefined) {
-        if (!Array.isArray(args.models) || args.models.some(function(m) {
+    if (args['models'] !== undefined) {
+        if (!Array.isArray(args['models']) || args['models'].some(function(m) {
             return typeof m !== 'string';
         })) {
             throw new Error('url-models: "models" must be an array of model-type strings.');
         }
-        models = args.models;
+        models = args['models'];
     }
     var currentUserUid;
-    if (args.currentUserUid !== undefined) {
-        if (typeof args.currentUserUid !== 'string' || args.currentUserUid.length === 0) {
+    if (args['currentUserUid'] !== undefined) {
+        if (typeof args['currentUserUid'] !== 'string' || args['currentUserUid'].length === 0) {
             throw new Error('url-models: "currentUserUid" must be a non-empty string.');
         }
-        currentUserUid = args.currentUserUid;
+        currentUserUid = args['currentUserUid'];
     }
     return _object_spread$2(_object_spread_props$1(_object_spread$2({
         url: url
@@ -5308,19 +5308,19 @@ function batchExecuteToolHandler(args, ctx, deps) {
 // MARK: Input parsing
 function parseBatchExecuteInput(args) {
     var _args_format, _args_maxParallel;
-    var uploadPath = args.uploadPath;
+    var uploadPath = args['uploadPath'];
     if (typeof uploadPath !== 'string' || uploadPath.length === 0) {
         throw new Error('batch-execute: "uploadPath" is required and must be a non-empty string.');
     }
-    var bucketId = args.bucketId;
+    var bucketId = args['bucketId'];
     if (bucketId != null && (typeof bucketId !== 'string' || bucketId.length === 0)) {
         throw new Error('batch-execute: "bucketId" must be a non-empty string when provided.');
     }
-    var format = (_args_format = args.format) !== null && _args_format !== void 0 ? _args_format : 'ndjson';
+    var format = (_args_format = args['format']) !== null && _args_format !== void 0 ? _args_format : 'ndjson';
     if (format !== 'json' && format !== 'ndjson') {
         throw new Error('batch-execute: "format" must be "json" or "ndjson".');
     }
-    var maxParallel = (_args_maxParallel = args.maxParallel) !== null && _args_maxParallel !== void 0 ? _args_maxParallel : DEFAULT_BATCH_EXECUTE_MAX_PARALLEL;
+    var maxParallel = (_args_maxParallel = args['maxParallel']) !== null && _args_maxParallel !== void 0 ? _args_maxParallel : DEFAULT_BATCH_EXECUTE_MAX_PARALLEL;
     if (typeof maxParallel !== 'number' || !Number.isInteger(maxParallel) || maxParallel < 1) {
         throw new Error('batch-execute: "maxParallel" must be a positive integer.');
     }
@@ -5329,8 +5329,8 @@ function parseBatchExecuteInput(args) {
         bucketId: bucketId !== null && bucketId !== void 0 ? bucketId : undefined,
         format: format,
         maxParallel: maxParallel,
-        stopOnError: args.stopOnError === true,
-        deleteUploadOnSuccess: args.deleteUploadOnSuccess !== false
+        stopOnError: args['stopOnError'] === true,
+        deleteUploadOnSuccess: args['deleteUploadOnSuccess'] !== false
     };
 }
 function readOperationsFile(input) {
@@ -5411,9 +5411,9 @@ function validateOperation(value, index) {
         throw new Error("batch-execute: operation[".concat(index, "] must be an object."));
     }
     var candidate = value;
-    var modelType = candidate.modelType;
-    var call = candidate.call;
-    var specifier = candidate.specifier;
+    var modelType = candidate['modelType'];
+    var call = candidate['call'];
+    var specifier = candidate['specifier'];
     if (typeof modelType !== 'string' || modelType.length === 0) {
         throw new Error("batch-execute: operation[".concat(index, '] is missing a non-empty "modelType".'));
     }
@@ -5427,7 +5427,7 @@ function validateOperation(value, index) {
         call: call,
         modelType: modelType,
         specifier: specifier !== null && specifier !== void 0 ? specifier : undefined,
-        data: candidate.data
+        data: candidate['data']
     };
 }
 function collectPreflightErrors(operations, authorizeOperation) {
@@ -6055,9 +6055,10 @@ var McpServerFactoryService_1;
  * Injectable factory that builds {@link McpServer} instances pre-wired to the
  * call model dispatch chain.
  *
- * The factory is invoked per Streamable HTTP request — `@modelcontextprotocol/sdk`
- * recommends a fresh `McpServer` + transport pair per stateless JSON-RPC request,
- * which sidesteps session bookkeeping for the common Claude-connector case.
+ * The factory is invoked per Streamable HTTP request. That is the shape the MCP
+ * SDK's 2026-07-28 entry (`createMcpHandler`) requires — it builds a fresh server
+ * per request and has no session concept at all — and it is equally what the SDK
+ * recommends for stateless 2025-era serving, so one factory backs both eras.
  */ exports.McpServerFactoryService = McpServerFactoryService_1 = /*#__PURE__*/ function() {
     function McpServerFactoryService(mcpConfig, dispatchService, modelApiGetService, roleReader, analyticsService, storageService) {
         _class_call_check$3(this, McpServerFactoryService);
@@ -6100,13 +6101,13 @@ var McpServerFactoryService_1;
                 var _this_mcpConfig_serverName, _this_mcpConfig_serverVersion, _this_mcpConfig_serverInstructions;
                 var baseServerName = (_this_mcpConfig_serverName = this.mcpConfig.serverName) !== null && _this_mcpConfig_serverName !== void 0 ? _this_mcpConfig_serverName : DEFAULT_MCP_SERVER_NAME;
                 var serverName = this.mcpConfig.readOnly === true ? "".concat(baseServerName, " (read-only)") : baseServerName;
-                var server = new mcp_js.McpServer({
+                var server$1 = new server.McpServer({
                     name: serverName,
                     version: (_this_mcpConfig_serverVersion = this.mcpConfig.serverVersion) !== null && _this_mcpConfig_serverVersion !== void 0 ? _this_mcpConfig_serverVersion : '0.0.0'
                 }, {
                     instructions: (_this_mcpConfig_serverInstructions = this.mcpConfig.serverInstructions) !== null && _this_mcpConfig_serverInstructions !== void 0 ? _this_mcpConfig_serverInstructions : DEFAULT_MCP_SERVER_INSTRUCTIONS
                 });
-                server.server.registerCapabilities({
+                server$1.server.registerCapabilities({
                     tools: {}
                 });
                 var toolGeneration = this._resolveToolDefinitions();
@@ -6135,7 +6136,7 @@ var McpServerFactoryService_1;
                         batchTool
                     ]);
                 }
-                server.server.setRequestHandler(types_js.ListToolsRequestSchema, function() {
+                server$1.server.setRequestHandler('tools/list', function() {
                     return _async_to_generator$2(function() {
                         var _this;
                         return _ts_generator$2(this, function(_state) {
@@ -6143,6 +6144,10 @@ var McpServerFactoryService_1;
                             return [
                                 2,
                                 {
+                                    // McpToolListEntry types its schemas as opaque `object`: they are read from a manifest file
+                                    // or produced by arktype's JSON Schema export, so the `type: 'object'` root the SDK's wire
+                                    // type mandates holds at runtime but cannot be proven statically. Every schema reaching here
+                                    // either came from arktypeToJsonSchemaForExport or defaulted to `{ type: 'object' }`.
                                     tools: listedTools.map(function(tool) {
                                         return _this._buildToolListEntry(tool, ctx, scopes);
                                     })
@@ -6151,7 +6156,7 @@ var McpServerFactoryService_1;
                         });
                     }).call(_this);
                 });
-                server.server.setRequestHandler(types_js.CallToolRequestSchema, function(request) {
+                server$1.server.setRequestHandler('tools/call', function(request) {
                     return _async_to_generator$2(function() {
                         return _ts_generator$2(this, function(_state) {
                             return [
@@ -6161,7 +6166,7 @@ var McpServerFactoryService_1;
                         });
                     }).call(_this);
                 });
-                return server;
+                return server$1;
             }
         },
         {
@@ -7236,29 +7241,168 @@ function _ts_generator$1(thisArg, body) {
     }
 }
 /**
- * Handles a single Streamable HTTP JSON-RPC request against the supplied MCP server.
+ * Handles a single Streamable HTTP JSON-RPC request, building a fresh MCP server for it.
  *
- * Each call creates a fresh `StreamableHTTPServerTransport` in stateless mode — the
- * transport binds the server, processes one request, and is discarded. Stateless
- * mode is adequate for Claude custom-connector usage and avoids the bookkeeping
- * cost of session-tracked transports for the common case.
+ * Both protocol eras are served, each by its own leg:
+ *
+ * - **2026-07-28 (modern)** — `createMcpHandler`, which is per-request and stateless by
+ *   construction: there is no `Mcp-Session-Id` and no transport bookkeeping.
+ * - **2025-era (legacy)** — a `NodeStreamableHTTPServerTransport` in stateless mode, which is
+ *   byte-for-byte what this endpoint served before the SDK v2 upgrade.
+ *
+ * The legacy leg is wired by hand (the SDK's documented `isLegacyRequest` composition) rather
+ * than left to `createMcpHandler`'s built-in `legacy: 'stateless'` fallback, because that
+ * fallback builds its transport with `sessionIdGenerator` alone and therefore answers in
+ * `text/event-stream`. See {@link handleLegacyMcpRequest} for why that framing is not viable
+ * here.
  *
  * The caller is expected to have already validated the bearer token (via the
  * OIDC bearer middleware) before this function runs.
  *
  * @param req - The Express request carrying the JSON-RPC body.
  * @param res - The Express response.
+ * @param buildServer - Factory producing the MCP server that backs this request.
+ */ function handleStreamableHttpMcpRequest(req, res, buildServer) {
+    return _async_to_generator$1(function() {
+        var probe;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    // Hand-wired compositions must reject non-JSON POST bodies themselves — neither the modern
+                    // entry's routing nor the legacy transport does it on our behalf once we classify up front.
+                    if (!server.isJsonContentType(req.headers['content-type'])) {
+                        res.status(415).json({
+                            statusCode: 415,
+                            message: 'Unsupported Media Type'
+                        });
+                        return [
+                            2
+                        ];
+                    }
+                    return [
+                        4,
+                        node.toWebRequest(req, req.body)
+                    ];
+                case 1:
+                    probe = _state.sent();
+                    return [
+                        4,
+                        server.isLegacyRequest(probe)
+                    ];
+                case 2:
+                    if (!_state.sent()) return [
+                        3,
+                        4
+                    ];
+                    return [
+                        4,
+                        handleLegacyMcpRequest(req, res, buildServer())
+                    ];
+                case 3:
+                    _state.sent();
+                    return [
+                        3,
+                        6
+                    ];
+                case 4:
+                    return [
+                        4,
+                        handleModernMcpRequest(req, res, buildServer)
+                    ];
+                case 5:
+                    _state.sent();
+                    _state.label = 6;
+                case 6:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Serves one 2026-07-28 request through `createMcpHandler`.
+ *
+ * `legacy: 'reject'` keeps this leg modern-only — 2025-era traffic never reaches it, having
+ * already been routed to {@link handleLegacyMcpRequest}.
+ *
+ * `responseMode: 'json'` is the modern-leg equivalent of the legacy transport's
+ * `enableJsonResponse`, keeping the endpoint on a single `application/json` body. Safe here
+ * because no tool handler emits mid-call notifications, which are the only thing `'json'` drops.
+ *
+ * @param req - The Express request carrying the JSON-RPC body.
+ * @param res - The Express response.
+ * @param buildServer - Factory producing the MCP server that backs this request.
+ */ function handleModernMcpRequest(req, res, buildServer) {
+    return _async_to_generator$1(function() {
+        var handler;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    handler = server.createMcpHandler(buildServer, {
+                        legacy: 'reject',
+                        responseMode: 'json'
+                    });
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        ,
+                        3,
+                        5
+                    ]);
+                    return [
+                        4,
+                        node.toNodeHandler(handler)(req, res, req.body)
+                    ];
+                case 2:
+                    _state.sent();
+                    return [
+                        3,
+                        5
+                    ];
+                case 3:
+                    return [
+                        4,
+                        handler.close()
+                    ];
+                case 4:
+                    _state.sent();
+                    return [
+                        7
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Serves one 2025-era request through a stateless `NodeStreamableHTTPServerTransport`.
+ *
+ * `sessionIdGenerator: undefined` selects stateless mode: the transport binds the server,
+ * processes one request, and is discarded.
+ *
+ * `enableJsonResponse: true` replies with a single `application/json` body instead of framing it
+ * as `text/event-stream`. Stateless mode answers exactly one JSON-RPC message per request and the
+ * controller only implements POST (there is no standalone SSE stream to keep open), so SSE framing
+ * adds nothing while making the endpoint fragile behind proxies that buffer or rewrite streamed
+ * responses — the failure that originally pushed the demo app off its dev proxy.
+ *
+ * @param req - The Express request carrying the JSON-RPC body.
+ * @param res - The Express response.
  * @param server - The MCP server instance to back the transport.
- * @param server.connect - The MCP server's connect method that binds the transport before request handling.
- */ function handleStreamableHttpMcpRequest(req, res, server) {
+ */ function handleLegacyMcpRequest(req, res, server) {
     return _async_to_generator$1(function() {
         var transport;
         return _ts_generator$1(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    // sessionIdGenerator: undefined → stateless mode.
-                    transport = new streamableHttp_js.StreamableHTTPServerTransport({
-                        sessionIdGenerator: undefined
+                    transport = new node.NodeStreamableHTTPServerTransport({
+                        sessionIdGenerator: undefined,
+                        enableJsonResponse: true
                     });
                     res.on('close', function() {
                         void transport.close();
@@ -7450,9 +7594,11 @@ var McpController_1;
  * which must include `'/mcp'` in its `protectedPaths`. By the time the request reaches
  * this controller, `req.auth` is populated with the authenticated user's data.
  *
- * Each request gets a fresh transport + MCP server pair (stateless mode), which is
- * adequate for Claude custom-connector style usage. A session-tracked variant can
- * be layered on later if streaming tool output becomes a requirement.
+ * Each request gets a fresh MCP server (stateless mode), which is adequate for Claude
+ * custom-connector style usage. Both protocol eras are served — 2026-07-28 through the
+ * SDK's per-request `createMcpHandler` entry, and 2025-era through a stateless Streamable
+ * HTTP transport. A session-tracked variant can be layered on later if streaming tool
+ * output becomes a requirement.
  */ exports.McpController = McpController_1 = /*#__PURE__*/ function() {
     function McpController(factory) {
         _class_call_check$2(this, McpController);
@@ -7465,15 +7611,12 @@ var McpController_1;
             key: "handleMcpRequest",
             value: function handleMcpRequest(req, res) {
                 return _async_to_generator(function() {
-                    var auth, server, error;
+                    var _this, auth, error;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
+                                _this = this;
                                 auth = req.auth;
-                                server = this.factory.createServer({
-                                    auth: auth,
-                                    rawRequest: req
-                                });
                                 _state.label = 1;
                             case 1:
                                 _state.trys.push([
@@ -7484,7 +7627,12 @@ var McpController_1;
                                 ]);
                                 return [
                                     4,
-                                    handleStreamableHttpMcpRequest(req, res, server)
+                                    handleStreamableHttpMcpRequest(req, res, function() {
+                                        return _this.factory.createServer({
+                                            auth: auth,
+                                            rawRequest: req
+                                        });
+                                    })
                                 ];
                             case 2:
                                 _state.sent();
@@ -7513,6 +7661,45 @@ var McpController_1;
                     });
                 }).call(this);
             }
+        },
+        {
+            /**
+     * Rejects the Streamable HTTP transport's optional `GET` method, which opens a standalone SSE
+     * stream. Not applicable in stateless mode. Separate from {@link handleUnsupportedDelete} because
+     * NestJS binds one HTTP method per handler — stacking route decorators would silently drop one.
+     *
+     * @param res - The Express response to write the rejection to.
+     */ key: "handleUnsupportedGet",
+            value: function handleUnsupportedGet(res) {
+                this._rejectUnsupportedMethod(res);
+            }
+        },
+        {
+            /**
+     * Rejects the Streamable HTTP transport's optional `DELETE` method, which tears down a session.
+     * Not applicable in stateless mode — no session is ever issued.
+     *
+     * @param res - The Express response to write the rejection to.
+     */ key: "handleUnsupportedDelete",
+            value: function handleUnsupportedDelete(res) {
+                this._rejectUnsupportedMethod(res);
+            }
+        },
+        {
+            /**
+     * Answers with a spec-conformant `405 Method Not Allowed` + `Allow` header. Without these
+     * handlers NestJS answers `404`, which some clients treat as a hard failure rather than
+     * "the server doesn't offer this".
+     *
+     * @param res - The Express response to write the rejection to.
+     */ key: "_rejectUnsupportedMethod",
+            value: function _rejectUnsupportedMethod(res) {
+                res.setHeader('Allow', 'POST');
+                res.status(common.HttpStatus.METHOD_NOT_ALLOWED).json({
+                    statusCode: common.HttpStatus.METHOD_NOT_ALLOWED,
+                    message: 'Method Not Allowed'
+                });
+            }
         }
     ]);
     return McpController;
@@ -7522,6 +7709,14 @@ __decorate([
     __param(0, common.Req()),
     __param(1, common.Res())
 ], exports.McpController.prototype, "handleMcpRequest", null);
+__decorate([
+    common.Get(),
+    __param(0, common.Res())
+], exports.McpController.prototype, "handleUnsupportedGet", null);
+__decorate([
+    common.Delete(),
+    __param(0, common.Res())
+], exports.McpController.prototype, "handleUnsupportedDelete", null);
 exports.McpController = McpController_1 = __decorate([
     common.Controller('mcp'),
     __param(0, common.Inject(exports.McpServerFactoryService))
@@ -7607,6 +7802,13 @@ function _unsupported_iterable_to_array$2(o, minLen) {
  * URIs must live at the host root. Apps need to exclude `.well-known/{*path}`
  * from any global API route prefix (see `FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE`
  * in `firebase-server/oidc` for the corresponding OIDC excludes).
+ *
+ * Because the document must be reachable at the origin root, the MCP endpoint has to be
+ * exposed through a host that serves the app at `/` — Firebase Hosting, or the hosting
+ * emulator in development. Pointing a client straight at the Functions emulator origin
+ * (`http://localhost:<port>/<project>/<region>/<function>/mcp`) breaks discovery: that
+ * runtime only routes `/<project>/<region>/<function>/…`, so nothing answers at the root
+ * and a client that has not yet seen a 401 challenge cannot find the issuer.
  */ exports.McpWellKnownController = /*#__PURE__*/ function() {
     function McpWellKnownController(mcpConfig, oidcProviderConfigService) {
         _class_call_check$1(this, McpWellKnownController);
@@ -7617,12 +7819,26 @@ function _unsupported_iterable_to_array$2(o, minLen) {
     }
     _create_class$1(McpWellKnownController, [
         {
-            key: "getProtectedResourceMetadata",
+            /**
+     * Serves both RFC 9728 discovery URLs — the primary form (§3.1), which inserts the resource's
+     * path after the well-known prefix (`/.well-known/oauth-protected-resource/mcp`), and the bare
+     * form (`/.well-known/oauth-protected-resource`) that clients probe as a fallback.
+     *
+     * The document is identical either way; the resource identity comes from
+     * {@link McpModuleConfig.mcpUrl}, not from the request path. Serving the primary form means
+     * discovery succeeds on a client's first probe rather than depending on it implementing the
+     * fallback.
+     *
+     * @returns The protected-resource metadata document.
+     */ key: "getProtectedResourceMetadata",
             value: function getProtectedResourceMetadata() {
                 var _this_mcpConfig = this.mcpConfig, mcpUrl = _this_mcpConfig.mcpUrl, oidcIssuer = _this_mcpConfig.oidcIssuer, scopesFilter = _this_mcpConfig.scopesSupported;
-                // Base scope list is the OIDC provider's own `scopes_supported`, so the resource
-                // advertises exactly what the issuer grants; the optional filter narrows it.
-                var providerScopes = this.oidcProviderConfigService.scopesSupported;
+                // Base scope list is what the issuer grants an arbitrary client, NOT its full
+                // `scopes_supported`: a dynamic-registration client copies this list verbatim onto
+                // `/authorize`, and a provider-profile-gated scope in it would be hard-rejected at the
+                // consent unlock gate (`access_denied`) for every client lacking that profile assignment.
+                // The optional filter narrows the list further.
+                var providerScopes = this.oidcProviderConfigService.clientRequestableScopesSupported;
                 var scopes = scopesFilter ? scopesFilter(providerScopes) : providerScopes;
                 return _object_spread({
                     resource: mcpUrl,
@@ -7638,7 +7854,10 @@ function _unsupported_iterable_to_array$2(o, minLen) {
     return McpWellKnownController;
 }();
 __decorate([
-    common.Get('oauth-protected-resource')
+    common.Get([
+        'oauth-protected-resource',
+        'oauth-protected-resource/{*path}'
+    ])
 ], exports.McpWellKnownController.prototype, "getProtectedResourceMetadata", null);
 exports.McpWellKnownController = __decorate([
     common.Controller('.well-known'),