@dereekb/firebase-server 13.36.0 → 13.38.0

package/mcp/package.json

@@ -1,18 +1,19 @@
 {
   "name": "@dereekb/firebase-server/mcp",
-  "version": "13.36.0",
+  "version": "13.38.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.36.0",
-    "@dereekb/date": "13.36.0",
-    "@dereekb/firebase": "13.36.0",
-    "@dereekb/firebase-server": "13.36.0",
-    "@dereekb/firebase-server/oidc": "13.36.0",
-    "@dereekb/model": "13.36.0",
-    "@dereekb/nestjs": "13.36.0",
-    "@dereekb/rxjs": "13.36.0",
-    "@dereekb/util": "13.36.0",
-    "@dereekb/zoho": "13.36.0",
-    "@modelcontextprotocol/sdk": "1.29.0",
+    "@dereekb/analytics": "13.38.0",
+    "@dereekb/date": "13.38.0",
+    "@dereekb/firebase": "13.38.0",
+    "@dereekb/firebase-server": "13.38.0",
+    "@dereekb/firebase-server/oidc": "13.38.0",
+    "@dereekb/model": "13.38.0",
+    "@dereekb/nestjs": "13.38.0",
+    "@dereekb/rxjs": "13.38.0",
+    "@dereekb/util": "13.38.0",
+    "@dereekb/zoho": "13.38.0",
+    "@modelcontextprotocol/node": "2.0.0",
+    "@modelcontextprotocol/server": "2.0.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/core": "^11.1.19",
     "arktype": "^2.2.0",

package/mcp/src/lib/controller/mcp.controller.d.ts

@@ -7,13 +7,38 @@ import { McpServerFactoryService } from '../service/mcp.server.factory';
  * which must include `'/mcp'` in its `protectedPaths`. By the time the request reaches
  * this controller, `req.auth` is populated with the authenticated user's data.
  *
- * Each request gets a fresh transport + MCP server pair (stateless mode), which is
- * adequate for Claude custom-connector style usage. A session-tracked variant can
- * be layered on later if streaming tool output becomes a requirement.
+ * Each request gets a fresh MCP server (stateless mode), which is adequate for Claude
+ * custom-connector style usage. Both protocol eras are served — 2026-07-28 through the
+ * SDK's per-request `createMcpHandler` entry, and 2025-era through a stateless Streamable
+ * HTTP transport. A session-tracked variant can be layered on later if streaming tool
+ * output becomes a requirement.
  */
 export declare class McpController {
     private readonly factory;
     private readonly _logger;
     constructor(factory: McpServerFactoryService);
     handleMcpRequest(req: Request, res: Response): Promise<void>;
+    /**
+     * Rejects the Streamable HTTP transport's optional `GET` method, which opens a standalone SSE
+     * stream. Not applicable in stateless mode. Separate from {@link handleUnsupportedDelete} because
+     * NestJS binds one HTTP method per handler — stacking route decorators would silently drop one.
+     *
+     * @param res - The Express response to write the rejection to.
+     */
+    handleUnsupportedGet(res: Response): void;
+    /**
+     * Rejects the Streamable HTTP transport's optional `DELETE` method, which tears down a session.
+     * Not applicable in stateless mode — no session is ever issued.
+     *
+     * @param res - The Express response to write the rejection to.
+     */
+    handleUnsupportedDelete(res: Response): void;
+    /**
+     * Answers with a spec-conformant `405 Method Not Allowed` + `Allow` header. Without these
+     * handlers NestJS answers `404`, which some clients treat as a hard failure rather than
+     * "the server doesn't offer this".
+     *
+     * @param res - The Express response to write the rejection to.
+     */
+    private _rejectUnsupportedMethod;
 }

package/mcp/src/lib/controller/mcp.wellknown.controller.d.ts

@@ -12,7 +12,8 @@ export interface OAuthProtectedResourceMetadata {
     /**
      * Scopes the resource accepts (RFC 9728 §2). Advertised so dynamic-registration
      * MCP clients (e.g. the Claude Code CLI) know which scopes to request on the
-     * authorization call. Omitted when {@link McpModuleConfig.scopesSupported} is unset.
+     * authorization call — they request this list verbatim, so it carries only scopes
+     * such a client can actually be granted. Omitted when the resolved list is empty.
      */
     readonly scopes_supported?: ReadonlyArray<OidcScope>;
 }
@@ -25,10 +26,29 @@ export interface OAuthProtectedResourceMetadata {
  * URIs must live at the host root. Apps need to exclude `.well-known/{*path}`
  * from any global API route prefix (see `FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE`
  * in `firebase-server/oidc` for the corresponding OIDC excludes).
+ *
+ * Because the document must be reachable at the origin root, the MCP endpoint has to be
+ * exposed through a host that serves the app at `/` — Firebase Hosting, or the hosting
+ * emulator in development. Pointing a client straight at the Functions emulator origin
+ * (`http://localhost:<port>/<project>/<region>/<function>/mcp`) breaks discovery: that
+ * runtime only routes `/<project>/<region>/<function>/…`, so nothing answers at the root
+ * and a client that has not yet seen a 401 challenge cannot find the issuer.
  */
 export declare class McpWellKnownController {
     private readonly mcpConfig;
     private readonly oidcProviderConfigService;
     constructor(mcpConfig: McpModuleConfig, oidcProviderConfigService: OidcProviderConfigService);
+    /**
+     * Serves both RFC 9728 discovery URLs — the primary form (§3.1), which inserts the resource's
+     * path after the well-known prefix (`/.well-known/oauth-protected-resource/mcp`), and the bare
+     * form (`/.well-known/oauth-protected-resource`) that clients probe as a fallback.
+     *
+     * The document is identical either way; the resource identity comes from
+     * {@link McpModuleConfig.mcpUrl}, not from the request path. Serving the primary form means
+     * discovery succeeds on a client's first probe rather than depending on it implementing the
+     * fallback.
+     *
+     * @returns The protected-resource metadata document.
+     */
     getProtectedResourceMetadata(): OAuthProtectedResourceMetadata;
 }

package/mcp/src/lib/mcp.config.d.ts

@@ -1,4 +1,5 @@
-import { type AuthClaims, type AuthRoleSet } from '@dereekb/util';
+import { type AuthClaims, type AuthRoleSet, type Maybe, type PromiseOrValue } from '@dereekb/util';
+import { type FirebaseServerAuthData } from '@dereekb/firebase-server';
 import { type FirestoreModelType, type OidcModelScopeRequirement, type OidcScope, type OidcScopeTerm } from '@dereekb/firebase';
 /**
  * Default path the MCP Streamable HTTP transport is mounted at.
@@ -83,8 +84,9 @@ export interface McpReasonParameterConfig {
 /**
  * Filter applied to the OIDC provider's advertised scope list when building the MCP
  * protected-resource metadata's `scopes_supported`. Receives every scope the provider
- * issues (from `OidcProviderConfigService.scopesSupported`) and returns the subset to
- * advertise. Supplied via {@link McpModuleConfig.scopesSupported}; when unset, all are advertised.
+ * issues to an arbitrary client (from `OidcProviderConfigService.clientRequestableScopesSupported`)
+ * and returns the subset to advertise. Supplied via {@link McpModuleConfig.scopesSupported};
+ * when unset, all of them are advertised.
  */
 export type McpScopesSupportedFilter = (allScopes: readonly OidcScope[]) => readonly OidcScope[];
 /**
@@ -127,11 +129,12 @@ export declare abstract class McpModuleConfig {
      * protected-resource discovery document's `scopes_supported` (RFC 9728 §2).
      *
      * The base list is pulled automatically from the OIDC provider config via the
-     * injected {@link OidcProviderConfigService.scopesSupported} (i.e.
-     * `Object.keys(providerConfig.claims)`), so the MCP resource advertises exactly
-     * the scopes the issuer supports without the app restating them. Provide this
-     * only to narrow that set — it receives every scope the provider issues and
-     * returns the subset to advertise. When unset, all of them are advertised.
+     * injected {@link OidcProviderConfigService.clientRequestableScopesSupported}, so
+     * the MCP resource advertises the scopes the issuer grants an arbitrary client
+     * without the app restating them. Scopes only an admin-assigned provider profile
+     * unlocks are already excluded — requesting one is fatal at the consent unlock
+     * gate. Provide this only to narrow the set further; it returns the subset to
+     * advertise. When unset, the whole base list is advertised.
      *
      * Advertising these matters because dynamic-registration MCP clients (the Claude
      * Code CLI) read `scopes_supported` to decide which scopes to request on the
@@ -236,3 +239,23 @@ export type McpAuthRoleReader = (claims: AuthClaims) => AuthRoleSet;
  * NestJS injection token for the optional {@link McpAuthRoleReader} provider.
  */
 export declare const MCP_AUTH_ROLE_READER = "MCP_AUTH_ROLE_READER";
+/**
+ * Signature for the optional predicate that authorizes `model-roles` calls which target another
+ * user's uid.
+ *
+ * `model-roles` resolves permissions for the calling user by default, which is always safe. Passing
+ * a `uid` asks the server "what can *that* user do here?" — an answer that leaks the target's
+ * effective access, so it is gated behind this app-supplied predicate rather than being open.
+ *
+ * Receives the calling request's auth data (`undefined` for an unauthenticated request) and returns
+ * true if that caller may resolve roles for arbitrary uids. Typically an admin check, e.g.
+ * `(auth) => authRoleClaimsService.toRoles(auth?.token ?? {}).has('admin')`.
+ *
+ * When no predicate is provided the `uid` parameter fails closed for every caller — the tool is
+ * still registered and still answers for the caller themselves.
+ */
+export type McpModelRolesTargetUidPredicate = (auth: Maybe<FirebaseServerAuthData>) => PromiseOrValue<boolean>;
+/**
+ * NestJS injection token for the optional {@link McpModelRolesTargetUidPredicate} provider.
+ */
+export declare const MCP_MODEL_ROLES_TARGET_UID_PREDICATE = "MCP_MODEL_ROLES_TARGET_UID_PREDICATE";

package/mcp/src/lib/mcp.module.d.ts

@@ -17,7 +17,8 @@ export interface McpModuleMetadataConfig extends Pick<ModuleMetadata, 'imports'
      * - {@link ModelApiDispatchConfig} — so the MCP server can reuse the call model dispatch chain.
      * - {@link McpModuleConfig} — issuer + resource URLs for protected-resource discovery.
      * - `OidcProviderConfigService` (from `@dereekb/firebase-server/oidc`) — the `McpWellKnownController`
-     *   reads the provider's `scopesSupported` to advertise them on the protected-resource document.
+     *   reads the provider's `clientRequestableScopesSupported` to advertise them on the
+     *   protected-resource document.
      *
      * In practice, downstream apps typically import their own `*ModelApiModule` first (which provides
      * `ModelApiCallModelDispatchService` + `MODEL_API_NEST_APPLICATION_CONTEXT`) and add the

package/mcp/src/lib/service/index.d.ts

@@ -7,6 +7,7 @@ export * from './mcp.server.factory';
 export * from './mcp.tool-generator';
 export * from './mcp.visibility';
 export * from './tools/mcp.tool.model-get';
+export * from './tools/mcp.tool.model-roles';
 export * from './tools/mcp.tool.model-info';
 export * from './tools/mcp.tool.model-decode';
 export * from './tools/mcp.tool.enum-info';

package/mcp/src/lib/service/mcp.server.factory.d.ts

@@ -1,7 +1,7 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { type Request } from 'express';
 import { ModelApiCallModelDispatchService, ModelApiGetService, FirebaseServerStorageService, type FirebaseServerAuthData } from '@dereekb/firebase-server';
-import { McpModuleConfig, type McpAuthRoleReader } from '../mcp.config';
+import { McpModuleConfig, type McpAuthRoleReader, type McpModelRolesTargetUidPredicate } from '../mcp.config';
 import { type McpAnalyticsService } from './analytics/mcp.analytics.handler';
 /**
  * Optional per-request context passed when invoking the MCP server through a
@@ -17,9 +17,10 @@ export interface McpRequestContext {
  * Injectable factory that builds {@link McpServer} instances pre-wired to the
  * call model dispatch chain.
  *
- * The factory is invoked per Streamable HTTP request — `@modelcontextprotocol/sdk`
- * recommends a fresh `McpServer` + transport pair per stateless JSON-RPC request,
- * which sidesteps session bookkeeping for the common Claude-connector case.
+ * The factory is invoked per Streamable HTTP request. That is the shape the MCP
+ * SDK's 2026-07-28 entry (`createMcpHandler`) requires — it builds a fresh server
+ * per request and has no session concept at all — and it is equally what the SDK
+ * recommends for stateless 2025-era serving, so one factory backs both eras.
  */
 export declare class McpServerFactoryService {
     private readonly mcpConfig;
@@ -27,6 +28,7 @@ export declare class McpServerFactoryService {
     private readonly modelApiGetService?;
     private readonly roleReader?;
     private readonly storageService?;
+    private readonly modelRolesTargetUidPredicate?;
     private readonly _logger;
     private _cachedTools;
     private _cachedStaticTools;
@@ -41,7 +43,7 @@ export declare class McpServerFactoryService {
     private _warnedMissingRoleReader;
     private _resolvedReasonConfig?;
     private readonly _analyticsService;
-    constructor(mcpConfig: McpModuleConfig, dispatchService: ModelApiCallModelDispatchService, modelApiGetService?: ModelApiGetService | undefined, roleReader?: McpAuthRoleReader | undefined, analyticsService?: McpAnalyticsService, storageService?: FirebaseServerStorageService | undefined);
+    constructor(mcpConfig: McpModuleConfig, dispatchService: ModelApiCallModelDispatchService, modelApiGetService?: ModelApiGetService | undefined, roleReader?: McpAuthRoleReader | undefined, analyticsService?: McpAnalyticsService, storageService?: FirebaseServerStorageService | undefined, modelRolesTargetUidPredicate?: McpModelRolesTargetUidPredicate | undefined);
     /**
      * Builds a configured MCP server with tool listing + dispatch handlers wired up.
      *

package/mcp/src/lib/service/mcp.tool-generator.d.ts

@@ -2,7 +2,7 @@ import { type Maybe } from '@dereekb/util';
 import { type FirestoreModelType, type KnownOnCallFunctionType, type OidcModelScopeRequirement, type OidcScopeTerm } from '@dereekb/firebase';
 import { type ModelApiDetailsResult, type OnCallModelFunctionApiDetails, type FirebaseServerAuthData, type McpToolDetailsBuilder, type McpVisibilityRule } from '@dereekb/firebase-server';
 import { type Request } from 'express';
-import { type CallToolResult, type ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
+import type { CallToolResult, ToolAnnotations } from '@modelcontextprotocol/server';
 import { type McpManifestToolEntry } from './mcp.manifest';
 import { type McpToolFilterMetadata } from './mcp.visibility';
 /**

package/mcp/src/lib/service/mcp.visibility.d.ts

@@ -1,7 +1,7 @@
 import { type Maybe } from '@dereekb/util';
 import { type CallModelOidcScope, type OidcScopeTerm } from '@dereekb/firebase';
 import { type McpToolVisibility, type McpVisibilityContext, type McpVisibilityRule } from '@dereekb/firebase-server';
-import { type ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
+import type { ToolAnnotations } from '@modelcontextprotocol/server';
 /**
  * Normalized classification of a {@link McpToolVisibility} value computed at boot.
  *

package/mcp/src/lib/service/tools/mcp.tool.model-roles.d.ts

@@ -0,0 +1,95 @@
+import { type Maybe, type PromiseOrValue } from '@dereekb/util';
+import { type FirebaseAuthUserId, type FirestoreModelIdentity, type FirestoreModelKey, type FirestoreModelType } from '@dereekb/firebase';
+import { type ModelAccessMultiRoleMapResult, type FirebaseServerAuthData } from '@dereekb/firebase-server';
+import { type McpToolDefinition } from '../mcp.tool-generator';
+/**
+ * Reserved tool name for the built-in `model-roles` static tool.
+ */
+export declare const MODEL_ROLES_TOOL_NAME = "model-roles";
+/**
+ * Synthetic call type used in the tool's dispatch identity. Distinct from `model-get`'s `get` so
+ * visibility predicates can target the two independently.
+ */
+export declare const MODEL_ROLES_DISPATCH_CALL = "roles";
+/**
+ * Synthetic model type used in the tool's dispatch identity. Mirrors {@link MODEL_GET_DISPATCH_MODEL_TYPE}
+ * — the tool isn't bound to one model type, so the literal "model" stands in.
+ */
+export declare const MODEL_ROLES_DISPATCH_MODEL_TYPE = "model";
+/**
+ * Maximum number of keys accepted per `model-roles` call. Role resolution runs the model's real
+ * permission delegate per key (which may itself read parent documents), so this is deliberately
+ * lower than the `model-get` batch size.
+ */
+export declare const MCP_MODEL_ROLES_MAX_KEYS = 25;
+/**
+ * Resolves granted role maps for a batch of keys. Signature matches
+ * `ModelApiGetService.readRoleMaps` so the service method can be passed directly.
+ */
+export type McpModelRolesReadRoleMaps = (params: {
+    readonly modelType: FirestoreModelType;
+    readonly keys: FirestoreModelKey[];
+    readonly auth: Maybe<FirebaseServerAuthData>;
+    readonly targetUid?: Maybe<FirebaseAuthUserId>;
+}) => Promise<ModelAccessMultiRoleMapResult>;
+/**
+ * Lookup that resolves a `modelType` to its registered {@link FirestoreModelIdentity}, so bare ids
+ * can be promoted to full keys. Mirrors `McpModelGetResolveIdentity`.
+ */
+export type McpModelRolesResolveIdentity = (modelType: FirestoreModelType, auth: Maybe<FirebaseServerAuthData>) => Maybe<FirestoreModelIdentity>;
+/**
+ * Predicate authorizing a caller to resolve roles for a uid other than their own. Mirrors
+ * `McpModelRolesTargetUidPredicate` from the module config; redeclared here so this module does not
+ * depend on the config module.
+ */
+export type McpModelRolesTargetUidCheck = (auth: Maybe<FirebaseServerAuthData>) => PromiseOrValue<boolean>;
+/**
+ * Constructor dependencies for {@link createModelRolesTool}.
+ */
+export interface CreateModelRolesToolDeps {
+    /**
+     * Resolves the granted role maps for a batch of keys.
+     */
+    readonly readRoleMaps: McpModelRolesReadRoleMaps;
+    /**
+     * Resolves the registered identity for a model type so bare ids can be promoted into full keys.
+     */
+    readonly resolveIdentity: McpModelRolesResolveIdentity;
+    /**
+     * Authorizes use of the `uid` parameter. Omitted means the parameter fails closed for everyone;
+     * the tool still answers for the calling user.
+     */
+    readonly canTargetOtherUids?: Maybe<McpModelRolesTargetUidCheck>;
+}
+/**
+ * Shape of the `model-roles` tool input.
+ */
+export interface ModelRolesToolInput {
+    readonly modelType: string;
+    readonly keys: ReadonlyArray<string>;
+    readonly uid?: string;
+}
+/**
+ * Builds the built-in `model-roles` MCP tool definition.
+ *
+ * Answers "what is this user actually allowed to do with this document?" by running the same
+ * `roleMapForModel()` delegate the permission-checked read/write paths use, and returning the
+ * resolved roles instead of consuming them. Because the model's real delegate runs, derived and
+ * cascading roles appear exactly as the API grants them — there is no second implementation of the
+ * rules to drift.
+ *
+ * Two things it disambiguates that a plain read cannot:
+ * - **Missing vs. forbidden.** A key that resolves to a missing document returns
+ *   `exists: false, roles: []` rather than an error, so "the document is not there" reads
+ *   differently from "it is there and you have no access" (`exists: true, roles: []`).
+ * - **Full access.** Admin short-circuits that grant the full-access marker come back as
+ *   `fullAccess: true` rather than as an opaque enumerated set.
+ *
+ * By default roles are resolved for the calling user. Passing `uid` resolves them for another user
+ * and is gated behind {@link CreateModelRolesToolDeps.canTargetOtherUids}.
+ *
+ * @param deps - Role-map reader, identity resolver, and the target-uid authorization predicate.
+ * @returns A statically-registered {@link McpToolDefinition} ready to be appended to the MCP
+ *   server factory's tool registry.
+ */
+export declare function createModelRolesTool(deps: CreateModelRolesToolDeps): McpToolDefinition;

package/mcp/src/lib/transport/streamable-http.transport.d.ts

@@ -1,21 +1,26 @@
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { type McpServer } from '@modelcontextprotocol/server';
 import { type Request, type Response } from 'express';
 /**
- * Handles a single Streamable HTTP JSON-RPC request against the supplied MCP server.
+ * Handles a single Streamable HTTP JSON-RPC request, building a fresh MCP server for it.
  *
- * Each call creates a fresh `StreamableHTTPServerTransport` in stateless mode — the
- * transport binds the server, processes one request, and is discarded. Stateless
- * mode is adequate for Claude custom-connector usage and avoids the bookkeeping
- * cost of session-tracked transports for the common case.
+ * Both protocol eras are served, each by its own leg:
+ *
+ * - **2026-07-28 (modern)** — `createMcpHandler`, which is per-request and stateless by
+ *   construction: there is no `Mcp-Session-Id` and no transport bookkeeping.
+ * - **2025-era (legacy)** — a `NodeStreamableHTTPServerTransport` in stateless mode, which is
+ *   byte-for-byte what this endpoint served before the SDK v2 upgrade.
+ *
+ * The legacy leg is wired by hand (the SDK's documented `isLegacyRequest` composition) rather
+ * than left to `createMcpHandler`'s built-in `legacy: 'stateless'` fallback, because that
+ * fallback builds its transport with `sessionIdGenerator` alone and therefore answers in
+ * `text/event-stream`. See {@link handleLegacyMcpRequest} for why that framing is not viable
+ * here.
  *
  * The caller is expected to have already validated the bearer token (via the
  * OIDC bearer middleware) before this function runs.
  *
  * @param req - The Express request carrying the JSON-RPC body.
  * @param res - The Express response.
- * @param server - The MCP server instance to back the transport.
- * @param server.connect - The MCP server's connect method that binds the transport before request handling.
+ * @param buildServer - Factory producing the MCP server that backs this request.
  */
-export declare function handleStreamableHttpMcpRequest(req: Request, res: Response, server: {
-    connect: (transport: StreamableHTTPServerTransport) => Promise<void>;
-}): Promise<void>;
+export declare function handleStreamableHttpMcpRequest(req: Request, res: Response, buildServer: () => McpServer): Promise<void>;

package/model/index.cjs.js

@@ -14770,7 +14770,7 @@ function enrichSignedUploadUrlInputSchema(defaultInputSchema, purposeKeys) {
     if (defaultInputSchema != null && (typeof defaultInputSchema === "undefined" ? "undefined" : _type_of$3(defaultInputSchema)) === 'object') {
         var _base_properties;
         var base = defaultInputSchema;
-        var purposeProperty = (_base_properties = base.properties) === null || _base_properties === void 0 ? void 0 : _base_properties.purpose;
+        var purposeProperty = (_base_properties = base.properties) === null || _base_properties === void 0 ? void 0 : _base_properties['purpose'];
         if (purposeProperty != null && (typeof purposeProperty === "undefined" ? "undefined" : _type_of$3(purposeProperty)) === 'object') {
             var quotedPurposes = purposeKeys.map(function(purpose) {
                 return '"'.concat(purpose, '"');

package/model/index.esm.js

@@ -14768,7 +14768,7 @@ function enrichSignedUploadUrlInputSchema(defaultInputSchema, purposeKeys) {
     if (defaultInputSchema != null && (typeof defaultInputSchema === "undefined" ? "undefined" : _type_of$3(defaultInputSchema)) === 'object') {
         var _base_properties;
         var base = defaultInputSchema;
-        var purposeProperty = (_base_properties = base.properties) === null || _base_properties === void 0 ? void 0 : _base_properties.purpose;
+        var purposeProperty = (_base_properties = base.properties) === null || _base_properties === void 0 ? void 0 : _base_properties['purpose'];
         if (purposeProperty != null && (typeof purposeProperty === "undefined" ? "undefined" : _type_of$3(purposeProperty)) === 'object') {
             var quotedPurposes = purposeKeys.map(function(purpose) {
                 return '"'.concat(purpose, '"');

package/model/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase-server/model",
-  "version": "13.36.0",
+  "version": "13.38.0",
   "peerDependencies": {
-    "@dereekb/analytics": "13.36.0",
-    "@dereekb/date": "13.36.0",
-    "@dereekb/firebase": "13.36.0",
-    "@dereekb/firebase-server": "13.36.0",
-    "@dereekb/model": "13.36.0",
-    "@dereekb/nestjs": "13.36.0",
-    "@dereekb/rxjs": "13.36.0",
-    "@dereekb/util": "13.36.0",
+    "@dereekb/analytics": "13.38.0",
+    "@dereekb/date": "13.38.0",
+    "@dereekb/firebase": "13.38.0",
+    "@dereekb/firebase-server": "13.38.0",
+    "@dereekb/model": "13.38.0",
+    "@dereekb/nestjs": "13.38.0",
+    "@dereekb/rxjs": "13.38.0",
+    "@dereekb/util": "13.38.0",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "archiver": "^7.0.1",