@dereekb/firebase-server 14.2.0 → 14.3.0

package/oidc/index.esm.js

@@ -27,13 +27,13 @@ import { ConfigService, ConfigModule } from '@nestjs/config';
     return req.auth;
 });
 
-function _type_of$2(obj) {
+function _type_of$3(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
 function __decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if ((typeof Reflect === "undefined" ? "undefined" : _type_of$2(Reflect)) === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    if ((typeof Reflect === "undefined" ? "undefined" : _type_of$3(Reflect)) === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
@@ -1681,7 +1681,7 @@ function _is_native_reflect_construct$1() {
     })();
 }
 function _possible_constructor_return$1(self, call) {
-    if (call && (_type_of$1(call) === "object" || typeof call === "function")) return call;
+    if (call && (_type_of$2(call) === "object" || typeof call === "function")) return call;
     return _assert_this_initialized$1(self);
 }
 function _set_prototype_of$1(o, p) {
@@ -1691,7 +1691,7 @@ function _set_prototype_of$1(o, p) {
     };
     return _set_prototype_of$1(o, p);
 }
-function _type_of$1(obj) {
+function _type_of$2(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
@@ -3188,13 +3188,13 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
     return FirestoreAdapter;
 }
 
-function _array_like_to_array$7(arr, len) {
+function _array_like_to_array$8(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$7(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
+function _array_without_holes$8(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$8(arr);
 }
 function _class_call_check$a(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
@@ -3223,24 +3223,24 @@ function _define_property$a(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _iterable_to_array$7(iter) {
+function _iterable_to_array$8(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$7() {
+function _non_iterable_spread$8() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$7(arr) {
-    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$7();
+function _to_consumable_array$8(arr) {
+    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$8(arr) || _non_iterable_spread$8();
 }
-function _unsupported_iterable_to_array$7(o, minLen) {
+function _unsupported_iterable_to_array$8(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$8(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$8(o, minLen);
 }
 // MARK: Encrypted Fields
 /**
@@ -3268,7 +3268,7 @@ function _unsupported_iterable_to_array$7(o, minLen) {
         this.provider = createAesStringEncryptionProvider(config.jwksKeyConverterConfig.encryptionSecret);
         this.adapterPayloadEncryptor = selectiveFieldEncryptor({
             provider: this.provider,
-            fields: _to_consumable_array$7(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
+            fields: _to_consumable_array$8(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
         });
     }
     _create_class$8(OidcEncryptionService, [
@@ -3304,13 +3304,13 @@ OidcEncryptionService = __decorate([
     __param(0, Inject(OidcModuleConfig))
 ], OidcEncryptionService);
 
-function _array_like_to_array$6(arr, len) {
+function _array_like_to_array$7(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$6(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
+function _array_without_holes$7(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
 }
 function _class_call_check$9(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
@@ -3339,24 +3339,24 @@ function _define_property$9(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _iterable_to_array$6(iter) {
+function _iterable_to_array$7(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$6() {
+function _non_iterable_spread$7() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$6(arr) {
-    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$6();
+function _to_consumable_array$7(arr) {
+    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$7();
 }
-function _unsupported_iterable_to_array$6(o, minLen) {
+function _unsupported_iterable_to_array$7(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
 }
 // MARK: Routes
 /**
@@ -3450,7 +3450,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
             return !assignmentOnlyScopes.has(scope);
         });
         this.claimsSupported = Array.from(new Set(Object.values(this.providerConfig.claims).flat()));
-        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$6(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
+        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$7(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
         var appUrl = envService.appUrl;
         this.appLoginUrl = websiteUrlFromPaths(appUrl, [
             this.config.appOAuthInteractionPath,
@@ -3483,16 +3483,16 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
                     jwks_uri: jwksUri !== null && jwksUri !== void 0 ? jwksUri : "".concat(issuer).concat(routes.jwks),
                     registration_endpoint: this.oidcRegistrationRouteEnabled ? "".concat(issuer).concat(routes.registration) : undefined,
                     scopes_supported: this.scopesSupported,
-                    response_types_supported: _to_consumable_array$6(providerConfig.responseTypes),
+                    response_types_supported: _to_consumable_array$7(providerConfig.responseTypes),
                     response_modes_supported: [
                         'query'
                     ],
-                    grant_types_supported: _to_consumable_array$6(providerConfig.grantTypes),
-                    subject_types_supported: _to_consumable_array$6(DEFAULT_OIDC_SUBJECT_TYPES),
-                    id_token_signing_alg_values_supported: _to_consumable_array$6(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
-                    token_endpoint_auth_methods_supported: _to_consumable_array$6(this.tokenEndpointAuthMethodsSupported),
+                    grant_types_supported: _to_consumable_array$7(providerConfig.grantTypes),
+                    subject_types_supported: _to_consumable_array$7(DEFAULT_OIDC_SUBJECT_TYPES),
+                    id_token_signing_alg_values_supported: _to_consumable_array$7(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
+                    token_endpoint_auth_methods_supported: _to_consumable_array$7(this.tokenEndpointAuthMethodsSupported),
                     claims_supported: this.claimsSupported,
-                    code_challenge_methods_supported: _to_consumable_array$6(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
+                    code_challenge_methods_supported: _to_consumable_array$7(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
                 };
             }
         }
@@ -3506,32 +3506,32 @@ OidcProviderConfigService = __decorate([
     __param(2, Inject(FirebaseServerEnvService))
 ], OidcProviderConfigService);
 
-function _array_like_to_array$5(arr, len) {
+function _array_like_to_array$6(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$5(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
+function _array_without_holes$6(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
 }
-function _iterable_to_array$5(iter) {
+function _iterable_to_array$6(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$5() {
+function _non_iterable_spread$6() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$5(arr) {
-    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
+function _to_consumable_array$6(arr) {
+    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$6();
 }
-function _unsupported_iterable_to_array$5(o, minLen) {
+function _unsupported_iterable_to_array$6(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
 }
 /**
  * Custom oidc-provider client metadata field holding the {@link OidcProviderProfile} keys assigned
@@ -3571,7 +3571,7 @@ function _unsupported_iterable_to_array$5(o, minLen) {
  * @returns The union of config-level and profile-level admin-only scopes.
  */ function adminOnlyScopesForOidcProviderConfig(providerConfig) {
     var _providerConfig_adminOnlyScopes, _providerConfig_providerProfiles;
-    return new Set(_to_consumable_array$5((_providerConfig_adminOnlyScopes = providerConfig.adminOnlyScopes) !== null && _providerConfig_adminOnlyScopes !== void 0 ? _providerConfig_adminOnlyScopes : []).concat(_to_consumable_array$5(Array.from(adminOnlyScopesForOidcProviderProfiles((_providerConfig_providerProfiles = providerConfig.providerProfiles) !== null && _providerConfig_providerProfiles !== void 0 ? _providerConfig_providerProfiles : [])))));
+    return new Set(_to_consumable_array$6((_providerConfig_adminOnlyScopes = providerConfig.adminOnlyScopes) !== null && _providerConfig_adminOnlyScopes !== void 0 ? _providerConfig_adminOnlyScopes : []).concat(_to_consumable_array$6(Array.from(adminOnlyScopesForOidcProviderProfiles((_providerConfig_providerProfiles = providerConfig.providerProfiles) !== null && _providerConfig_providerProfiles !== void 0 ? _providerConfig_providerProfiles : [])))));
 }
 
 /**
@@ -3614,13 +3614,13 @@ function _unsupported_iterable_to_array$5(o, minLen) {
     return policy;
 }
 
-function _array_like_to_array$4(arr, len) {
+function _array_like_to_array$5(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$4(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
 }
 function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -3681,12 +3681,12 @@ function _instanceof$2(left, right) {
         return !!right[Symbol.hasInstance](left);
     } else return left instanceof right;
 }
-function _iterable_to_array$4(iter) {
+function _iterable_to_array$5(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$4() {
+function _non_iterable_spread$5() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _object_spread$3(target) {
@@ -3758,8 +3758,8 @@ function _object_without_properties_loose(source, excluded) {
     }
     return target;
 }
-function _to_consumable_array$4(arr) {
-    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$4();
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
 }
 function _ts_generator$5(thisArg, body) {
     var f, y, t, _ = {
@@ -3860,13 +3860,13 @@ function _ts_generator$5(thisArg, body) {
         };
     }
 }
-function _unsupported_iterable_to_array$4(o, minLen) {
+function _unsupported_iterable_to_array$5(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
 }
 var OidcService_1;
 // MARK: Service
@@ -4165,7 +4165,7 @@ var OidcService_1;
                 return _object_spread_props(_object_spread$3({
                     routes: _object_spread$3({}, this.providerConfigService.routes),
                     claims: _object_spread$3({}, providerConfig.claims),
-                    responseTypes: _to_consumable_array$4(providerConfig.responseTypes),
+                    responseTypes: _to_consumable_array$5(providerConfig.responseTypes),
                     pkce: {
                         required: function required() {
                             return true;
@@ -5054,32 +5054,32 @@ OidcAuthBearerTokenMiddleware = __decorate([
     __param(1, Inject(OidcAuthMiddlewareConfig))
 ], OidcAuthBearerTokenMiddleware);
 
-function _array_like_to_array$3(arr, len) {
+function _array_like_to_array$4(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$3(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
+function _array_without_holes$4(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
 }
-function _iterable_to_array$3(iter) {
+function _iterable_to_array$4(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$3() {
+function _non_iterable_spread$4() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$3(arr) {
-    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$3();
+function _to_consumable_array$4(arr) {
+    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$4();
 }
-function _unsupported_iterable_to_array$3(o, minLen) {
+function _unsupported_iterable_to_array$4(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
 }
 /**
  * Builds the `cors`-package origin delegate implementing the composed OIDC CORS policy.
@@ -5102,7 +5102,7 @@ function _unsupported_iterable_to_array$3(o, minLen) {
     var clientBased = cors.clientBased === true;
     var allowlist = new Set([
         appUrl
-    ].concat(_to_consumable_array$3((_cors_allowOrigins = cors.allowOrigins) !== null && _cors_allowOrigins !== void 0 ? _cors_allowOrigins : [])));
+    ].concat(_to_consumable_array$4((_cors_allowOrigins = cors.allowOrigins) !== null && _cors_allowOrigins !== void 0 ? _cors_allowOrigins : [])));
     return function(requestOrigin, callback) {
         var resolved;
         if (requestOrigin && allowlist.has(requestOrigin)) {
@@ -5343,7 +5343,7 @@ function _object_spread$2(target) {
     return target;
 }
 function _possible_constructor_return(self, call) {
-    if (call && (_type_of(call) === "object" || typeof call === "function")) return call;
+    if (call && (_type_of$1(call) === "object" || typeof call === "function")) return call;
     return _assert_this_initialized(self);
 }
 function _set_prototype_of(o, p) {
@@ -5353,7 +5353,7 @@ function _set_prototype_of(o, p) {
     };
     return _set_prototype_of(o, p);
 }
-function _type_of(obj) {
+function _type_of$1(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
@@ -5422,32 +5422,32 @@ FirebaseServerOidcAnalyticsService = FirebaseServerOidcAnalyticsService_1 = __de
     __param(2, Inject(FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG))
 ], FirebaseServerOidcAnalyticsService);
 
-function _array_like_to_array$2(arr, len) {
+function _array_like_to_array$3(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$2(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
+function _array_without_holes$3(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
 }
-function _iterable_to_array$2(iter) {
+function _iterable_to_array$3(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$2() {
+function _non_iterable_spread$3() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$2(arr) {
-    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$2();
+function _to_consumable_array$3(arr) {
+    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$3();
 }
-function _unsupported_iterable_to_array$2(o, minLen) {
+function _unsupported_iterable_to_array$3(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
 }
 /**
  * Generates NestJS module metadata that registers {@link FirebaseServerOidcAnalyticsService} as the
@@ -5479,18 +5479,18 @@ function _unsupported_iterable_to_array$2(o, minLen) {
         }
     ] : [];
     return {
-        imports: _to_consumable_array$2(imports !== null && imports !== void 0 ? imports : []),
+        imports: _to_consumable_array$3(imports !== null && imports !== void 0 ? imports : []),
         exports: [
             OIDC_ANALYTICS_SERVICE,
             FirebaseServerOidcAnalyticsService
-        ].concat(_to_consumable_array$2(exports !== null && exports !== void 0 ? exports : [])),
+        ].concat(_to_consumable_array$3(exports !== null && exports !== void 0 ? exports : [])),
         providers: [
             FirebaseServerOidcAnalyticsService,
             {
                 provide: OIDC_ANALYTICS_SERVICE,
                 useExisting: FirebaseServerOidcAnalyticsService
             }
-        ].concat(_to_consumable_array$2(configProviders), _to_consumable_array$2(providers !== null && providers !== void 0 ? providers : []))
+        ].concat(_to_consumable_array$3(configProviders), _to_consumable_array$3(providers !== null && providers !== void 0 ? providers : []))
     };
 }
 
@@ -5891,13 +5891,210 @@ OidcInteractionService = __decorate([
     __param(1, Inject(OidcClientService))
 ], OidcInteractionService);
 
-function _array_like_to_array$1(arr, len) {
+function _array_like_to_array$2(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes(arr) {
-    if (Array.isArray(arr)) return arr;
+function _array_without_holes$2(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
+}
+function _iterable_to_array$2(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
+        return Array.from(iter);
+    }
+}
+function _non_iterable_spread$2() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array$2(arr) {
+    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$2();
+}
+function _type_of(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+function _unsupported_iterable_to_array$2(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
+}
+/**
+ * Splits a space-delimited scope string into its non-empty entries.
+ *
+ * @param scope - The space-delimited scope string.
+ * @returns The scope entries.
+ */ function splitScope(scope) {
+    return (scope !== null && scope !== void 0 ? scope : '').split(' ').filter(Boolean);
+}
+/**
+ * Removes previously-rejected OIDC scopes from a Grant's rejected set.
+ *
+ * oidc-provider exposes `rejectOIDCScope()` but no inverse, and a rejected scope is subtracted from
+ * `getOIDCScope()` on every read — so `addOIDCScope()` alone cannot put a once-rejected scope back in
+ * force. `rejected` is plain persisted data (`Pick<Grant, 'openid' | 'resources'>`), which is what
+ * makes editing it directly the supported shape of an un-reject.
+ *
+ * @param grant - The grant to edit in place.
+ * @param scopes - The scopes to un-reject. Scopes not currently rejected are ignored.
+ */ function unrejectOIDCScopes(grant, scopes) {
+    var _grant_rejected;
+    var rejected = (_grant_rejected = grant.rejected) === null || _grant_rejected === void 0 ? void 0 : _grant_rejected.openid;
+    if (rejected === null || rejected === void 0 ? void 0 : rejected.scope) {
+        var remove = new Set(scopes);
+        var remaining = splitScope(rejected.scope).filter(function(scope) {
+            return !remove.has(scope);
+        });
+        rejected.scope = remaining.length > 0 ? remaining.join(' ') : undefined;
+    }
+}
+/**
+ * Removes previously-rejected OIDC claims from a Grant's rejected set.
+ *
+ * @param grant - The grant to edit in place.
+ * @param claims - The claims to un-reject. Claims not currently rejected are ignored.
+ * @see unrejectOIDCScopes
+ */ function unrejectOIDCClaims(grant, claims) {
+    var _grant_rejected, _rejected_claims;
+    var rejected = (_grant_rejected = grant.rejected) === null || _grant_rejected === void 0 ? void 0 : _grant_rejected.openid;
+    if (rejected === null || rejected === void 0 ? void 0 : (_rejected_claims = rejected.claims) === null || _rejected_claims === void 0 ? void 0 : _rejected_claims.length) {
+        var remove = new Set(claims);
+        var remaining = rejected.claims.filter(function(claim) {
+            return !remove.has(claim);
+        });
+        rejected.claims = remaining.length > 0 ? remaining : undefined;
+    }
+}
+/**
+ * Removes previously-rejected resource scopes for one resource indicator from a Grant's rejected set.
+ *
+ * @param grant - The grant to edit in place.
+ * @param resource - The resource indicator.
+ * @param scopes - The scopes to un-reject. Scopes not currently rejected for the resource are ignored.
+ * @see unrejectOIDCScopes
+ */ function unrejectResourceScopes(grant, resource, scopes) {
+    var _grant_rejected;
+    var rejectedResources = (_grant_rejected = grant.rejected) === null || _grant_rejected === void 0 ? void 0 : _grant_rejected.resources;
+    if (rejectedResources === null || rejectedResources === void 0 ? void 0 : rejectedResources[resource]) {
+        var remove = new Set(scopes);
+        var remaining = splitScope(rejectedResources[resource]).filter(function(scope) {
+            return !remove.has(scope);
+        });
+        if (remaining.length > 0) {
+            rejectedResources[resource] = remaining.join(' ');
+        } else {
+            delete rejectedResources[resource];
+        }
+    }
+}
+/**
+ * Moves previously-rejected values the current request asks for again from the "encountered" set back into
+ * the "missing" set, so a re-consent decides them afresh.
+ *
+ * oidc-provider counts a rejected value as encountered: it never reappears in the prompt's `missing*`
+ * details, so without this a consent that names it again is a silent no-op and the value can never be
+ * granted on that Grant — even when the user explicitly ticks it. Values the Grant has GRANTED are left in
+ * `encountered`: they are already in force and need no re-application.
+ *
+ * @param input - The missing, encountered, rejected, and requested sets.
+ * @returns The adjusted missing/encountered sets plus the reconsidered values.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function reconsiderRejectedValues(input) {
+    var missing = input.missing, encountered = input.encountered, rejected = input.rejected, requested = input.requested;
+    var missingSet = new Set(missing);
+    var reconsidered = rejected.filter(function(value) {
+        return requested.has(value) && !missingSet.has(value);
+    });
+    var reconsideredSet = new Set(reconsidered);
+    return {
+        missing: _to_consumable_array$2(missing).concat(_to_consumable_array$2(reconsidered)),
+        encountered: encountered.filter(function(value) {
+            return !reconsideredSet.has(value);
+        }),
+        reconsidered: reconsidered
+    };
+}
+/**
+ * Names every claim an authorization request's `claims` parameter asks for, across `id_token` and `userinfo`.
+ *
+ * @param claimsParam - The raw `claims` request parameter (a JSON string), or undefined.
+ * @returns The requested claim names; empty when the parameter is absent or malformed.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function requestedOIDCClaimNames(claimsParam) {
+    var names = new Set();
+    if (typeof claimsParam === 'string' && claimsParam.length > 0) {
+        var parsed;
+        try {
+            parsed = JSON.parse(claimsParam);
+        } catch (unused) {
+            parsed = undefined;
+        }
+        if (parsed != null && (typeof parsed === "undefined" ? "undefined" : _type_of(parsed)) === 'object') {
+            for(var _i = 0, _iter = [
+                'id_token',
+                'userinfo'
+            ]; _i < _iter.length; _i++){
+                var key = _iter[_i];
+                var section = parsed[key];
+                if (section != null && (typeof section === "undefined" ? "undefined" : _type_of(section)) === 'object') {
+                    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                    try {
+                        for(var _iterator = Object.keys(section)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                            var claim = _step.value;
+                            names.add(claim);
+                        }
+                    } catch (err) {
+                        _didIteratorError = true;
+                        _iteratorError = err;
+                    } finally{
+                        try {
+                            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                                _iterator.return();
+                            }
+                        } finally{
+                            if (_didIteratorError) {
+                                throw _iteratorError;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return names;
+}
+/**
+ * Normalizes an authorization request's `resource` parameter to its list of resource indicators.
+ *
+ * @param resourceParam - The raw `resource` request parameter (a string, an array of strings, or undefined).
+ * @returns The resource indicators; empty when the parameter is absent.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function requestedResourceIndicators(resourceParam) {
+    var indicators;
+    if (typeof resourceParam === 'string') {
+        indicators = [
+            resourceParam
+        ];
+    } else if (Array.isArray(resourceParam)) {
+        indicators = resourceParam.filter(function(value) {
+            return typeof value === 'string';
+        });
+    } else {
+        indicators = [];
+    }
+    return indicators;
+}
+
+function _array_like_to_array$1(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
 }
 function _array_without_holes$1(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$1(arr);
@@ -5966,39 +6163,9 @@ function _iterable_to_array$1(iter) {
         return Array.from(iter);
     }
 }
-function _iterable_to_array_limit(arr, i) {
-    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
-    if (_i == null) return;
-    var _arr = [];
-    var _n = true;
-    var _d = false;
-    var _s, _e;
-    try {
-        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
-            _arr.push(_s.value);
-            if (i && _arr.length === i) break;
-        }
-    } catch (err) {
-        _d = true;
-        _e = err;
-    } finally{
-        try {
-            if (!_n && _i["return"] != null) _i["return"]();
-        } finally{
-            if (_d) throw _e;
-        }
-    }
-    return _arr;
-}
-function _non_iterable_rest() {
-    throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
 function _non_iterable_spread$1() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array(arr, i) {
-    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array$1(arr, i) || _non_iterable_rest();
-}
 function _to_consumable_array$1(arr) {
     return _array_without_holes$1(arr) || _iterable_to_array$1(arr) || _unsupported_iterable_to_array$1(arr) || _non_iterable_spread$1();
 }
@@ -6306,7 +6473,7 @@ var OidcInteractionController_1;
      * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _ref1, _this_accountService_providerConfig_adminOnlyScopes, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref5, redirectTo1, missingRequiredScopes, _ref6, redirectTo2, effectiveOIDCScopes, heldOIDCScopes, consentedOIDCScopeSet, configAdminOnlyScopes, adminOnlyScopes, consentedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _ref8, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset1, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref9, redirectTo4, err;
+                    var startedAt, clientId, accountId, _ref, _params_scope, _prompt_details_missingOIDCScope, _ref1, _this_accountService_providerConfig_adminOnlyScopes, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, existingGrant, _tmp, requestedScopeParam, oidcScopes, missingOIDCScope, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref5, redirectTo1, missingRequiredScopes, _ref6, redirectTo2, effectiveOIDCScopes, heldOIDCScopes, consentedOIDCScopeSet, configAdminOnlyScopes, adminOnlyScopes, consentedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, _reconsiderRejectedValues, missingOIDCClaims, encounteredOIDCClaims, _resolveEffectiveSubset, granted1, rejected1, missingResourceScopes, resourceIndicators, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, indicator, _missingResourceScopes_indicator, _ref8, _body_grantedResourceScopes, _reconsiderRejectedValues1, scopes, encounteredResourceScopes, requestedSubset, _resolveEffectiveSubset1, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref9, redirectTo4, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -6356,7 +6523,6 @@ var OidcInteractionController_1;
                                 prompt = interaction.prompt, params = interaction.params, session = interaction.session;
                                 clientId = params['client_id'];
                                 accountId = (_ref = session === null || session === void 0 ? void 0 : session.accountId) !== null && _ref !== void 0 ? _ref : '';
-                                missingOIDCScope = (_prompt_details_missingOIDCScope = prompt.details['missingOIDCScope']) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [];
                                 if (!interaction.grantId) return [
                                     3,
                                     7
@@ -6381,7 +6547,20 @@ var OidcInteractionController_1;
                                 // but the consent UI sources its checkbox list from the auth URL's `scope=` param (the full request set)
                                 // and re-submits them all. We accept already-encountered values as silent no-ops so a re-consent on a
                                 // client the user has previously authorized doesn't fail validation.
-                                encounteredOIDCScopes = existingGrant ? existingGrant.getOIDCScopeEncountered().split(' ').filter(Boolean) : [];
+                                //
+                                // A REJECTED value is the exception. oidc-provider counts it as encountered too, so it never comes back
+                                // in `missing*` — and a rejected scope is subtracted from `getOIDCScope()` on every read, so treating it
+                                // as a no-op would make it ungrantable on this Grant for good, even when the user explicitly ticks it
+                                // again. `reconsiderRejectedValues` moves the rejected values this request names back into `missing`
+                                // so this consent decides them afresh; a grant of one of those un-rejects it further down.
+                                requestedScopeParam = new Set(((_params_scope = params['scope']) !== null && _params_scope !== void 0 ? _params_scope : '').split(' ').filter(Boolean));
+                                oidcScopes = reconsiderRejectedValues({
+                                    missing: (_prompt_details_missingOIDCScope = prompt.details['missingOIDCScope']) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [],
+                                    encountered: existingGrant ? existingGrant.getOIDCScopeEncountered().split(' ').filter(Boolean) : [],
+                                    rejected: existingGrant ? existingGrant.getRejectedOIDCScope().split(' ').filter(Boolean) : [],
+                                    requested: requestedScopeParam
+                                });
+                                missingOIDCScope = oidcScopes.missing, encounteredOIDCScopes = oidcScopes.encountered;
                                 return [
                                     4,
                                     this.oidcService.findClientPayload(clientId)
@@ -6596,6 +6775,7 @@ var OidcInteractionController_1;
                                 if (missingOIDCScope.length > 0) {
                                     granted = effectiveOIDCScopes.granted, rejected = effectiveOIDCScopes.rejected;
                                     if (granted.length > 0) {
+                                        unrejectOIDCScopes(grant, granted);
                                         grant.addOIDCScope(granted.join(' '));
                                     }
                                     _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
@@ -6619,8 +6799,14 @@ var OidcInteractionController_1;
                                         }
                                     }
                                 }
-                                encounteredOIDCClaims = grant.getOIDCClaimsEncountered();
-                                missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details['missingOIDCClaims']) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
+                                // Same reconsideration as the scopes above: a claim rejected on an earlier consent that this request's
+                                // `claims` parameter names again is decided afresh rather than silently kept rejected.
+                                _reconsiderRejectedValues = reconsiderRejectedValues({
+                                    missing: (_prompt_details_missingOIDCClaims = prompt.details['missingOIDCClaims']) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [],
+                                    encountered: grant.getOIDCClaimsEncountered(),
+                                    rejected: grant.getRejectedOIDCClaims(),
+                                    requested: requestedOIDCClaimNames(params['claims'])
+                                }), missingOIDCClaims = _reconsiderRejectedValues.missing, encounteredOIDCClaims = _reconsiderRejectedValues.encountered;
                                 if (missingOIDCClaims.length > 0) {
                                     _resolveEffectiveSubset = resolveEffectiveSubset({
                                         missing: missingOIDCClaims,
@@ -6628,6 +6814,7 @@ var OidcInteractionController_1;
                                         alreadyEncountered: encounteredOIDCClaims
                                     }), granted1 = _resolveEffectiveSubset.granted, rejected1 = _resolveEffectiveSubset.rejected;
                                     if (granted1.length > 0) {
+                                        unrejectOIDCClaims(grant, granted1);
                                         grant.addOIDCClaims(granted1);
                                     }
                                     if (rejected1.length > 0) {
@@ -6635,12 +6822,25 @@ var OidcInteractionController_1;
                                     }
                                 }
                                 missingResourceScopes = (_prompt_details_missingResourceScopes = prompt.details['missingResourceScopes']) !== null && _prompt_details_missingResourceScopes !== void 0 ? _prompt_details_missingResourceScopes : {};
+                                // Resource indicators this consent decides: the ones oidc-provider reports as still undecided, plus any
+                                // the request names (`resource` param) that carry a rejection worth reconsidering. An indicator whose
+                                // every scope was rejected earlier is absent from `missingResourceScopes` entirely, which is exactly the
+                                // case that needs the second source.
+                                resourceIndicators = new Set(_to_consumable_array$1(Object.keys(missingResourceScopes)).concat(_to_consumable_array$1(requestedResourceIndicators(params['resource']).filter(function(indicator) {
+                                    return grant.getRejectedResourceScope(indicator).length > 0;
+                                }))));
                                 _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                                 try {
-                                    for(_iterator1 = Object.entries(missingResourceScopes)[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                                        _step_value = _sliced_to_array(_step1.value, 2), indicator = _step_value[0], scopes = _step_value[1];
+                                    for(_iterator1 = resourceIndicators[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                                        indicator = _step1.value;
                                         ;
                                         ;
+                                        _reconsiderRejectedValues1 = reconsiderRejectedValues({
+                                            missing: (_missingResourceScopes_indicator = missingResourceScopes[indicator]) !== null && _missingResourceScopes_indicator !== void 0 ? _missingResourceScopes_indicator : [],
+                                            encountered: grant.getResourceScopeEncountered(indicator).split(' ').filter(Boolean),
+                                            rejected: grant.getRejectedResourceScope(indicator).split(' ').filter(Boolean),
+                                            requested: requestedScopeParam
+                                        }), scopes = _reconsiderRejectedValues1.missing, encounteredResourceScopes = _reconsiderRejectedValues1.encountered;
                                         // A submission with no explicit per-resource selection falls back to the OIDC scope selection
                                         // rather than granting everything the resource server declares. A resource server's scope list
                                         // is drawn from the same provider scopes the consent UI renders as one checkbox list, so a scope
@@ -6650,13 +6850,13 @@ var OidcInteractionController_1;
                                         requestedSubset = (_ref8 = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator]) !== null && _ref8 !== void 0 ? _ref8 : body.grantedOIDCScopes ? scopes.filter(function(scope) {
                                             return consentedOIDCScopeSet.has(scope);
                                         }) : undefined;
-                                        encounteredResourceScopes = grant.getResourceScopeEncountered(indicator).split(' ').filter(Boolean);
                                         _resolveEffectiveSubset1 = resolveEffectiveSubset({
                                             missing: scopes,
                                             requestedSubset: requestedSubset,
                                             alreadyEncountered: encounteredResourceScopes
                                         }), granted2 = _resolveEffectiveSubset1.granted, rejected2 = _resolveEffectiveSubset1.rejected;
                                         if (granted2.length > 0) {
+                                            unrejectResourceScopes(grant, indicator, granted2);
                                             grant.addResourceScope(indicator, granted2.join(' '));
                                         }
                                         _iteratorNormalCompletion2 = true, _didIteratorError2 = false, _iteratorError2 = undefined;
@@ -7898,4 +8098,4 @@ function _unsupported_iterable_to_array(o, minLen) {
     };
 }
 
-export { DBX_FIREBASE_SERVER_OIDC_PROVIDER_PROFILES_CLIENT_METADATA, DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, FirebaseServerOidcAnalyticsService, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ANALYTICS_SERVICE, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JSON_RENDER_ERROR_FUNCTION, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAnalyticsService, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, STALE_SESSION_ACCOUNT_CHECK_REASON, activeJwksKeysQuery, adminOnlyScopesForOidcProviderConfig, allOidcScopesStringForProviderConfig, appOidcAnalyticsModuleMetadata, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, buildBearerChallenge, buildFirebaseServerMcpResourceServer, buildOidcInteractionPolicy, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, deriveResourceMetadataUrlFromEnv, emitOidcAnalyticsEvent, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, noopOidcAnalyticsService, oidcClientProviderProfileScopes, oidcCorsOriginDelegate, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, resolveEffectiveSubset, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };
+export { DBX_FIREBASE_SERVER_OIDC_PROVIDER_PROFILES_CLIENT_METADATA, DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, FirebaseServerOidcAnalyticsService, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ANALYTICS_SERVICE, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JSON_RENDER_ERROR_FUNCTION, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAnalyticsService, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, STALE_SESSION_ACCOUNT_CHECK_REASON, activeJwksKeysQuery, adminOnlyScopesForOidcProviderConfig, allOidcScopesStringForProviderConfig, appOidcAnalyticsModuleMetadata, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, buildBearerChallenge, buildFirebaseServerMcpResourceServer, buildOidcInteractionPolicy, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, deriveResourceMetadataUrlFromEnv, emitOidcAnalyticsEvent, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, noopOidcAnalyticsService, oidcClientProviderProfileScopes, oidcCorsOriginDelegate, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, reconsiderRejectedValues, requestedOIDCClaimNames, requestedResourceIndicators, resolveEffectiveSubset, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, unrejectOIDCClaims, unrejectOIDCScopes, unrejectResourceScopes, updateOidcClientFactory };