@dereekb/firebase-server 14.2.0 → 14.4.0

package/oidc/index.esm.js

@@ -1,13 +1,15 @@
 import { createParamDecorator, Injectable, Inject, Optional, Logger, UnauthorizedException, Get, Param, Req, Res, Post, HttpCode, HttpStatus, Body, Controller, HttpException, All } from '@nestjs/common';
 import { errors } from 'oidc-provider';
-import { SECONDS_IN_MINUTE, SECONDS_IN_DAY, cachedGetter, unixDateTimeSecondsNumberToDate, unixDateTimeSecondsNumberForNow, selectiveFieldEncryptor, filterUndefinedValues, websiteUrlFromPaths, firstValue, hasHttpPrefix } from '@dereekb/util';
-import { generateKeyPairSync, randomBytes } from 'node:crypto';
+import { SECONDS_IN_MINUTE, SECONDS_IN_DAY, cachedGetter, unixDateTimeSecondsNumberToDate, unixDateTimeSecondsNumberForNow, selectiveFieldEncryptor, filterUndefinedValues, websiteUrlFromPaths, unique, filterKeysOnPOJOFunction, firstValue, hasHttpPrefix } from '@dereekb/util';
+import { generateKeyPairSync, randomBytes, randomUUID } from 'node:crypto';
 import { resolveEncryptionKey, encryptValue, decryptValue, createAesStringEncryptionProvider, isValidAES256GCMEncryptionSecret } from '@dereekb/nestjs';
 import { where, iterateFirestoreDocumentSnapshotPairs, firestoreModelIdentity, snapshotConverterFunctions, optionalFirestoreDate, firestoreDate, firestoreEnum, firestorePassThroughField, AbstractFirestoreDocument, createOidcClientParamsType, deleteOidcClientParamsType, deleteOidcTokenParamsType, rotateOidcClientSecretParamsType, updateOidcClientParamsType, firestoreModelKey, oidcEntryIdentity, PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD, OIDC_ENTRY_CLIENT_TYPE, oidcEntriesByUserCodeQuery, oidcEntriesByUidQuery, oidcEntriesByGrantIdQuery, assignmentOnlyScopesForOidcProviderProfiles, adminOnlyScopesForOidcProviderProfiles, oidcProviderProfilesForClient, requiredScopesForOidcProviderProfiles, scopesForOidcProviderProfiles, oidcScopesFromScopeClaim, oidcEntryFirestoreCollection } from '@dereekb/firebase';
 import { firestoreEncryptedField, firebaseServerActionsContext, FirebaseServerEnvService, FirebaseServerAnalyticsService, FIREBASE_FIRESTORE_CONTEXT_TOKEN, FirebaseServerFirestoreContextModule } from '@dereekb/firebase-server';
 import { nanoid } from 'nanoid';
 import { safeToJsDate } from '@dereekb/date';
 import { makeUrlSearchParamsString } from '@dereekb/util/fetch';
+import { buildIssuerProfiles, verifyBearerJwt, buildBearerChallenge as buildBearerChallenge$1 } from '@dereekb/oauth-resource';
+import { createLocalJWKSet, SignJWT, importJWK } from 'jose';
 import { ConfigService, ConfigModule } from '@nestjs/config';
 
 /**
@@ -27,13 +29,13 @@ import { ConfigService, ConfigModule } from '@nestjs/config';
     return req.auth;
 });
 
-function _type_of$2(obj) {
+function _type_of$3(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
 function __decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if ((typeof Reflect === "undefined" ? "undefined" : _type_of$2(Reflect)) === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    if ((typeof Reflect === "undefined" ? "undefined" : _type_of$3(Reflect)) === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
@@ -47,10 +49,10 @@ typeof SuppressedError === "function" ? SuppressedError : function(error, suppre
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 };
 
-function _class_call_check$i(instance, Constructor) {
+function _class_call_check$j(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
-function _defineProperties$e(target, props) {
+function _defineProperties$f(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -59,11 +61,11 @@ function _defineProperties$e(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$e(Constructor, protoProps, staticProps) {
-    if (staticProps) _defineProperties$e(Constructor, staticProps);
+function _create_class$f(Constructor, protoProps, staticProps) {
+    if (staticProps) _defineProperties$f(Constructor, staticProps);
     return Constructor;
 }
-function _define_property$g(obj, key, value) {
+function _define_property$i(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -139,32 +141,32 @@ function _define_property$g(obj, key, value) {
  * Used as an abstract class so it can serve as both a type and a NestJS DI token.
  */ var OidcModuleConfig = /*#__PURE__*/ function() {
     function OidcModuleConfig() {
-        _class_call_check$i(this, OidcModuleConfig);
+        _class_call_check$j(this, OidcModuleConfig);
         /**
      * The OIDC issuer URL (e.g., 'https://accounts.example.com').
      * Must be the canonical URL where the OIDC provider is accessible.
-     */ _define_property$g(this, "issuer", void 0);
+     */ _define_property$i(this, "issuer", void 0);
         /**
      * The path prefix used for OIDC interaction endpoints (login/consent).
      *
      * Appended to the base appUrl this is the base frontend interaction path.
      *
      * Defaults to '/oauth'.
-     */ _define_property$g(this, "appOAuthInteractionPath", void 0);
+     */ _define_property$i(this, "appOAuthInteractionPath", void 0);
         /**
      * Frontend URL for the login interaction page.
      * The interaction uid will be appended as a query parameter.
      *
      * Defaults to `<appOAuthInteractionPath>/login`.
-     */ _define_property$g(this, "appOAuthLoginUrlPart", void 0);
+     */ _define_property$i(this, "appOAuthLoginUrlPart", void 0);
         /**
      * Frontend URL for the consent interaction page.
      *
      * Defaults to `<appOAuthInteractionPath>/consent`.
-     */ _define_property$g(this, "appOAuthConsentUrlPart", void 0);
+     */ _define_property$i(this, "appOAuthConsentUrlPart", void 0);
         /**
      * Token lifetime configuration.
-     */ _define_property$g(this, "tokenLifetimes", void 0);
+     */ _define_property$i(this, "tokenLifetimes", void 0);
         /**
      * Maximum login duration (seconds) a client may request via the `dbx_session_ttl` auth-URL param.
      *
@@ -173,18 +175,18 @@ function _define_property$g(obj, key, value) {
      * `min(client.dbx_max_session_ttl, this)`.
      *
      * Defaults to {@link DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS} (90 days).
-     */ _define_property$g(this, "maxRequestedLoginDuration", void 0);
+     */ _define_property$i(this, "maxRequestedLoginDuration", void 0);
         /**
      * Minimum login duration (seconds) a client may request via the `dbx_session_ttl` auth-URL param.
      *
      * Requested values below this floor are clamped up. Prevents pathological 30-second sessions.
      *
      * Defaults to {@link DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS} (1 hour).
-     */ _define_property$g(this, "minRequestedLoginDuration", void 0);
+     */ _define_property$i(this, "minRequestedLoginDuration", void 0);
         /**
      * Default login duration (seconds) used when a client does NOT pass the `dbx_session_ttl`
      * auth-URL param. When undefined, falls back to {@link OidcTokenLifetimes.refreshToken}.
-     */ _define_property$g(this, "defaultRequestedLoginDuration", void 0);
+     */ _define_property$i(this, "defaultRequestedLoginDuration", void 0);
         /**
      * Tiered ceiling (seconds) on the requested login duration for a non-admin user.
      *
@@ -193,23 +195,23 @@ function _define_property$g(obj, key, value) {
      * {@link maxRequestedLoginDuration}, since service-token tokens intentionally exceed it).
      *
      * Defaults to {@link DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS} (45 days).
-     */ _define_property$g(this, "maxRequestedLoginDurationNonAdmin", void 0);
+     */ _define_property$i(this, "maxRequestedLoginDurationNonAdmin", void 0);
         /**
      * Tiered ceiling (seconds) on a normal (non-service-token) requested login duration for an admin user.
      *
      * Defaults to {@link DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS} (90 days).
-     */ _define_property$g(this, "maxRequestedLoginDurationAdmin", void 0);
+     */ _define_property$i(this, "maxRequestedLoginDurationAdmin", void 0);
         /**
      * Tiered ceiling (seconds) on a requested login duration carrying an admin-only service-token scope.
      *
      * Defaults to {@link DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS} (365 days).
-     */ _define_property$g(this, "maxRequestedLoginDurationServiceToken", void 0);
+     */ _define_property$i(this, "maxRequestedLoginDurationServiceToken", void 0);
         /**
      * JWKS service configuration (encryption secret, rotated key max age).
-     */ _define_property$g(this, "jwksServiceConfig", void 0);
+     */ _define_property$i(this, "jwksServiceConfig", void 0);
         /**
      * JWKS key converter configuration (encryption secret for Firestore field encryption).
-     */ _define_property$g(this, "jwksKeyConverterConfig", void 0);
+     */ _define_property$i(this, "jwksKeyConverterConfig", void 0);
         /**
      * Custom error rendering function for the oidc-provider.
      *
@@ -219,7 +221,7 @@ function _define_property$g(obj, key, value) {
      * errors are presented (e.g. redirect to an error page).
      *
      * The function signature matches oidc-provider's `renderError` configuration option.
-     */ _define_property$g(this, "renderError", void 0);
+     */ _define_property$i(this, "renderError", void 0);
         /**
      * Whether to suppress the oidc-provider "already parsed request body" warning.
      *
@@ -228,7 +230,7 @@ function _define_property$g(obj, key, value) {
      * this correctly by falling back to `req.body`, but emits a one-time warning.
      *
      * Defaults to `false`.
-     */ _define_property$g(this, "suppressBodyParserWarning", void 0);
+     */ _define_property$i(this, "suppressBodyParserWarning", void 0);
         /**
      * Path prefixes that require OAuth bearer token verification.
      *
@@ -238,7 +240,7 @@ function _define_property$g(obj, key, value) {
      *
      * Paths under the global API route prefix should not be included
      * since those are typically protected by AppCheck.
-     */ _define_property$g(this, "protectedPaths", void 0);
+     */ _define_property$i(this, "protectedPaths", void 0);
         /**
      * Map of recognized OAuth resource indicator URLs (RFC 8707) to their
      * {@link OidcResourceServerInfo}. When non-empty, oidc-provider's
@@ -260,7 +262,7 @@ function _define_property$g(obj, key, value) {
      *   }
      * }
      * ```
-     */ _define_property$g(this, "resourceServers", void 0);
+     */ _define_property$i(this, "resourceServers", void 0);
         /**
      * When `true`, {@link oidcModuleMetadata} automatically derives a resource-server
      * entry from `envService.appMcpUrl` and the registered {@link OidcAccountService}'s
@@ -276,7 +278,7 @@ function _define_property$g(obj, key, value) {
      * Defaults to `false`.
      *
      * @see buildFirebaseServerMcpResourceServer
-     */ _define_property$g(this, "configureMcpResourceServer", void 0);
+     */ _define_property$i(this, "configureMcpResourceServer", void 0);
         /**
      * Absolute URL of the OAuth 2.0 Protected Resource Metadata document
      * (RFC 9728) for the resources guarded by {@link protectedPaths}.
@@ -294,7 +296,7 @@ function _define_property$g(obj, key, value) {
      *
      * @example
      * resourceMetadataUrl: 'http://localhost:9902/dereekb-components/us-central1/api/.well-known/oauth-protected-resource'
-     */ _define_property$g(this, "resourceMetadataUrl", void 0);
+     */ _define_property$i(this, "resourceMetadataUrl", void 0);
         /**
      * Supported token endpoint authentication methods.
      *
@@ -302,7 +304,7 @@ function _define_property$g(obj, key, value) {
      * in the discovery metadata document.
      *
      * @see DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS
-     */ _define_property$g(this, "tokenEndpointAuthMethods", void 0);
+     */ _define_property$i(this, "tokenEndpointAuthMethods", void 0);
         /**
      * Whether to enable the OIDC dynamic client registration endpoint (`/reg`).
      *
@@ -310,7 +312,7 @@ function _define_property$g(obj, key, value) {
      * and manage their registrations via the registration management feature.
      *
      * Defaults to `false`.
-     */ _define_property$g(this, "registrationEnabled", void 0);
+     */ _define_property$i(this, "registrationEnabled", void 0);
         /**
      * Whether the oidc-provider should trust upstream proxy headers
      * (`X-Forwarded-Host`, `X-Forwarded-Proto`) when computing the request URL
@@ -329,7 +331,7 @@ function _define_property$g(obj, key, value) {
      * (which is the Koa `app.proxy` setting).
      *
      * Defaults to `'prod_only'` if the environment is `production`, otherwise `false`.
-     */ _define_property$g(this, "trustProxy", void 0);
+     */ _define_property$i(this, "trustProxy", void 0);
         /**
      * Whether to trust proxy headers in a non-production environment, such as the local environment.
      *
@@ -337,7 +339,7 @@ function _define_property$g(obj, key, value) {
      * `true` will result in errors.
      *
      * Defaults to `false`.
-     */ _define_property$g(this, "trustProxyInNonProduction", void 0);
+     */ _define_property$i(this, "trustProxyInNonProduction", void 0);
         /**
      * Unified CORS configuration for the cross-origin browser OIDC endpoints
      * (discovery GET, token POST). When unset, the Express CORS layer preserves the
@@ -345,9 +347,9 @@ function _define_property$g(obj, key, value) {
      * response, which pre-empts oidc-provider's own CORS handling.
      *
      * @see OidcCorsConfig
-     */ _define_property$g(this, "cors", void 0);
+     */ _define_property$i(this, "cors", void 0);
     }
-    _create_class$e(OidcModuleConfig, null, [
+    _create_class$f(OidcModuleConfig, null, [
         {
             key: "assertValidConfig",
             value: /**
@@ -597,7 +599,7 @@ function _define_property$g(obj, key, value) {
     return jwksKeysWithStatusQuery('rotated');
 }
 
-function _class_call_check$h(instance, Constructor) {
+function _class_call_check$i(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
 // MARK: Collections
@@ -607,11 +609,11 @@ function _class_call_check$h(instance, Constructor) {
  * Extends both {@link JwksFirestoreCollections} (server-only JWKS keys) and
  * {@link OidcModelFirestoreCollections} (shared adapter entries).
  */ var OidcServerFirestoreCollections = function OidcServerFirestoreCollections() {
-    _class_call_check$h(this, OidcServerFirestoreCollections);
+    _class_call_check$i(this, OidcServerFirestoreCollections);
 } 
 ;
 
-function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -622,25 +624,25 @@ function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$a(fn) {
+function _async_to_generator$c(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$g(instance, Constructor) {
+function _class_call_check$h(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
-function _defineProperties$d(target, props) {
+function _defineProperties$e(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -649,11 +651,11 @@ function _defineProperties$d(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$d(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$d(Constructor.prototype, protoProps);
+function _create_class$e(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$e(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$f(obj, key, value) {
+function _define_property$h(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -664,7 +666,7 @@ function _define_property$f(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$7(target) {
+function _object_spread$9(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -674,7 +676,7 @@ function _object_spread$7(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$f(target, key, source[key]);
+            _define_property$h(target, key, source[key]);
         });
     }
     return target;
@@ -697,7 +699,7 @@ function _object_spread_props$3(target, source) {
     }
     return target;
 }
-function _ts_generator$a(thisArg, body) {
+function _ts_generator$c(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -798,27 +800,27 @@ function _ts_generator$a(thisArg, body) {
 }
 // MARK: Config
 var JwksServiceConfig = function JwksServiceConfig() {
-    _class_call_check$g(this, JwksServiceConfig);
+    _class_call_check$h(this, JwksServiceConfig);
 };
 /**
  * If provided, the JwksService will write the JWKS to this file when keys are rotated.
  */ var JwksServiceStorageConfig = function JwksServiceStorageConfig() {
-    _class_call_check$g(this, JwksServiceStorageConfig);
+    _class_call_check$h(this, JwksServiceStorageConfig);
 };
 var DEFAULT_ROTATED_KEY_MAX_AGE = 30 * 24 * 60 * 60; // 30 days
 // MARK: Service
 var JwksService = /*#__PURE__*/ function() {
     function JwksService(config, collections, storageConfig) {
         var _this = this;
-        _class_call_check$g(this, JwksService);
+        _class_call_check$h(this, JwksService);
         var _config_rotatedKeyMaxAge, _config_enableSaveJwksToStorage, _config_serveJwksFromStorage;
-        _define_property$f(this, "config", void 0);
-        _define_property$f(this, "collections", void 0);
-        _define_property$f(this, "storageConfig", void 0);
-        _define_property$f(this, "_jwksStoragePublicUrl", cachedGetter(function() {
-            return _async_to_generator$a(function() {
+        _define_property$h(this, "config", void 0);
+        _define_property$h(this, "collections", void 0);
+        _define_property$h(this, "storageConfig", void 0);
+        _define_property$h(this, "_jwksStoragePublicUrl", cachedGetter(function() {
+            return _async_to_generator$c(function() {
                 var _this, _this_storageConfig, result, _file;
-                return _ts_generator$a(this, function(_state) {
+                return _ts_generator$c(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             _this = this;
@@ -830,8 +832,8 @@ var JwksService = /*#__PURE__*/ function() {
                             return [
                                 4,
                                 _file.getDownloadUrl().catch(function() {
-                                    return _async_to_generator$a(function() {
-                                        return _ts_generator$a(this, function(_state) {
+                                    return _async_to_generator$c(function() {
+                                        return _ts_generator$c(this, function(_state) {
                                             switch(_state.label){
                                                 case 0:
                                                     return [
@@ -864,13 +866,13 @@ var JwksService = /*#__PURE__*/ function() {
                 });
             }).call(_this);
         }));
-        _define_property$f(this, "rotatedKeyMaxAge", void 0);
+        _define_property$h(this, "rotatedKeyMaxAge", void 0);
         /**
      * Whether the JWKS is served from a public storage URL rather than the built-in endpoint.
-     */ _define_property$f(this, "serveJwksFromStorage", void 0);
+     */ _define_property$h(this, "serveJwksFromStorage", void 0);
         /**
      * Whether the JWKS should be saved to storage when keys are rotated.
-     */ _define_property$f(this, "saveJwksToStorage", void 0);
+     */ _define_property$h(this, "saveJwksToStorage", void 0);
         this.config = config;
         this.collections = collections;
         this.storageConfig = storageConfig;
@@ -879,7 +881,7 @@ var JwksService = /*#__PURE__*/ function() {
         this.saveJwksToStorage = (_config_enableSaveJwksToStorage = config.enableSaveJwksToStorage) !== null && _config_enableSaveJwksToStorage !== void 0 ? _config_enableSaveJwksToStorage : hasStorageFile;
         this.serveJwksFromStorage = (_config_serveJwksFromStorage = config.serveJwksFromStorage) !== null && _config_serveJwksFromStorage !== void 0 ? _config_serveJwksFromStorage : this.saveJwksToStorage;
     }
-    _create_class$d(JwksService, [
+    _create_class$e(JwksService, [
         {
             key: "jwksKeyCollection",
             get: function get() {
@@ -897,9 +899,9 @@ var JwksService = /*#__PURE__*/ function() {
      *
      * @returns The generated key pair result containing the stored JwksKey and signing key.
      */ function generateKeyPair() {
-                return _async_to_generator$a(function() {
+                return _async_to_generator$c(function() {
                     var _generateKeyPairSync, publicKey, privateKey, kid, publicJwk, privateJwk, getKey, encryptedPrivateKey, data, doc;
-                    return _ts_generator$a(this, function(_state) {
+                    return _ts_generator$c(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 _generateKeyPairSync = generateKeyPairSync('rsa', {
@@ -914,13 +916,13 @@ var JwksService = /*#__PURE__*/ function() {
                                     }
                                 }), publicKey = _generateKeyPairSync.publicKey, privateKey = _generateKeyPairSync.privateKey;
                                 kid = randomBytes(16).toString('hex');
-                                publicJwk = _object_spread_props$3(_object_spread$7({}, publicKey), {
+                                publicJwk = _object_spread_props$3(_object_spread$9({}, publicKey), {
                                     kid: kid,
                                     kty: 'RSA',
                                     alg: 'RS256',
                                     use: 'sig'
                                 });
-                                privateJwk = _object_spread_props$3(_object_spread$7({}, privateKey), {
+                                privateJwk = _object_spread_props$3(_object_spread$9({}, privateKey), {
                                     kid: kid,
                                     kty: 'RSA',
                                     alg: 'RS256',
@@ -960,9 +962,9 @@ var JwksService = /*#__PURE__*/ function() {
      *
      * @returns The active signing key's private JWK, or undefined if no active key exists.
      */ function getActiveSigningKey() {
-                return _async_to_generator$a(function() {
+                return _async_to_generator$c(function() {
                     var results, result, data, getKey;
-                    return _ts_generator$a(this, function(_state) {
+                    return _ts_generator$c(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -998,8 +1000,8 @@ var JwksService = /*#__PURE__*/ function() {
      *
      * @returns The public URL, or null/undefined if unavailable.
      */ function getJwksStoragePublicUrl() {
-                return _async_to_generator$a(function() {
-                    return _ts_generator$a(this, function(_state) {
+                return _async_to_generator$c(function() {
+                    return _ts_generator$c(this, function(_state) {
                         return [
                             2,
                             this._jwksStoragePublicUrl()
@@ -1015,9 +1017,9 @@ var JwksService = /*#__PURE__*/ function() {
      *
      * @returns The public JWKS containing all non-retired signing keys.
      */ function getLatestPublicJwks() {
-                return _async_to_generator$a(function() {
+                return _async_to_generator$c(function() {
                     var keys;
-                    return _ts_generator$a(this, function(_state) {
+                    return _ts_generator$c(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 keys = [];
@@ -1030,8 +1032,8 @@ var JwksService = /*#__PURE__*/ function() {
                                             return nonRetiredJwksKeysQuery();
                                         },
                                         iterateSnapshotPair: function iterateSnapshotPair(pair) {
-                                            return _async_to_generator$a(function() {
-                                                return _ts_generator$a(this, function(_state) {
+                                            return _async_to_generator$c(function() {
+                                                return _ts_generator$c(this, function(_state) {
                                                     keys.push(pair.data.publicKey);
                                                     return [
                                                         2
@@ -1061,9 +1063,9 @@ var JwksService = /*#__PURE__*/ function() {
      *
      * @returns The newly generated active JwksKey.
      */ function rotateKeys() {
-                return _async_to_generator$a(function() {
+                return _async_to_generator$c(function() {
                     var now, expiresAt, _ref, newKey;
-                    return _ts_generator$a(this, function(_state) {
+                    return _ts_generator$c(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 now = new Date();
@@ -1077,8 +1079,8 @@ var JwksService = /*#__PURE__*/ function() {
                                             return activeJwksKeysQuery();
                                         },
                                         iterateSnapshotPair: function iterateSnapshotPair(pair) {
-                                            return _async_to_generator$a(function() {
-                                                return _ts_generator$a(this, function(_state) {
+                                            return _async_to_generator$c(function() {
+                                                return _ts_generator$c(this, function(_state) {
                                                     switch(_state.label){
                                                         case 0:
                                                             return [
@@ -1128,9 +1130,9 @@ var JwksService = /*#__PURE__*/ function() {
         {
             key: "_initializeKeysAndCloud",
             value: function _initializeKeysAndCloud() {
-                return _async_to_generator$a(function() {
+                return _async_to_generator$c(function() {
                     var jwks;
-                    return _ts_generator$a(this, function(_state) {
+                    return _ts_generator$c(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -1173,9 +1175,9 @@ var JwksService = /*#__PURE__*/ function() {
         {
             key: "_syncKeysToCloud",
             value: function _syncKeysToCloud() {
-                return _async_to_generator$a(function() {
+                return _async_to_generator$c(function() {
                     var _this_storageConfig, jwks, data, _this_storageConfig_jwksStorageAccessorFile_makePublic, _this_storageConfig_jwksStorageAccessorFile, e;
-                    return _ts_generator$a(this, function(_state) {
+                    return _ts_generator$c(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 if (!(this.saveJwksToStorage && ((_this_storageConfig = this.storageConfig) === null || _this_storageConfig === void 0 ? void 0 : _this_storageConfig.jwksStorageAccessorFile))) return [
@@ -1241,9 +1243,9 @@ var JwksService = /*#__PURE__*/ function() {
      *
      * @returns The number of keys retired.
      */ function retireExpiredKeys() {
-                return _async_to_generator$a(function() {
+                return _async_to_generator$c(function() {
                     var now, count;
-                    return _ts_generator$a(this, function(_state) {
+                    return _ts_generator$c(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 now = new Date();
@@ -1257,8 +1259,8 @@ var JwksService = /*#__PURE__*/ function() {
                                             return rotatedJwksKeysQuery();
                                         },
                                         iterateSnapshotPair: function iterateSnapshotPair(pair) {
-                                            return _async_to_generator$a(function() {
-                                                return _ts_generator$a(this, function(_state) {
+                                            return _async_to_generator$c(function() {
+                                                return _ts_generator$c(this, function(_state) {
                                                     switch(_state.label){
                                                         case 0:
                                                             if (!(pair.data.expiresAt && pair.data.expiresAt <= now)) return [
@@ -1309,7 +1311,7 @@ JwksService = __decorate([
     __param(2, Inject(JwksServiceStorageConfig))
 ], JwksService);
 
-function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1320,25 +1322,25 @@ function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$9(fn) {
+function _async_to_generator$b(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$f(instance, Constructor) {
+function _class_call_check$g(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
-function _defineProperties$c(target, props) {
+function _defineProperties$d(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -1347,11 +1349,11 @@ function _defineProperties$c(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$c(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
+function _create_class$d(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$d(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$e(obj, key, value) {
+function _define_property$g(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -1362,7 +1364,7 @@ function _define_property$e(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _ts_generator$9(thisArg, body) {
+function _ts_generator$b(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1504,7 +1506,7 @@ function _ts_generator$9(thisArg, body) {
  * };
  * ```
  */ var OidcAccountServiceDelegate = function OidcAccountServiceDelegate() {
-    _class_call_check$f(this, OidcAccountServiceDelegate);
+    _class_call_check$g(this, OidcAccountServiceDelegate);
 };
 // MARK: User Context
 /**
@@ -1513,15 +1515,15 @@ function _ts_generator$9(thisArg, body) {
  * Created by {@link OidcAccountService.userContext} for a specific user ID.
  */ var OidcAccountServiceUserContext = /*#__PURE__*/ function() {
     function OidcAccountServiceUserContext(_service, _uid) {
-        _class_call_check$f(this, OidcAccountServiceUserContext);
-        _define_property$e(this, "_service", void 0);
-        _define_property$e(this, "_uid", void 0);
-        _define_property$e(this, "authUserContext", void 0);
+        _class_call_check$g(this, OidcAccountServiceUserContext);
+        _define_property$g(this, "_service", void 0);
+        _define_property$g(this, "_uid", void 0);
+        _define_property$g(this, "authUserContext", void 0);
         this._service = _service;
         this._uid = _uid;
         this.authUserContext = this._service.authService.userContext(this._uid);
     }
-    _create_class$c(OidcAccountServiceUserContext, [
+    _create_class$d(OidcAccountServiceUserContext, [
         {
             key: "uid",
             get: function get() {
@@ -1544,9 +1546,9 @@ function _ts_generator$9(thisArg, body) {
      *
      * @returns The OIDC account for this user, or undefined if the user does not exist.
      */ function findAccount() {
-                return _async_to_generator$9(function() {
+                return _async_to_generator$b(function() {
                     var authUserContext, exists, result, delegate;
-                    return _ts_generator$9(this, function(_state) {
+                    return _ts_generator$b(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 authUserContext = this.authUserContext;
@@ -1561,9 +1563,9 @@ function _ts_generator$9(thisArg, body) {
                                     result = {
                                         accountId: this._uid,
                                         claims: function claims(_use, scope) {
-                                            return _async_to_generator$9(function() {
+                                            return _async_to_generator$b(function() {
                                                 var scopes;
-                                                return _ts_generator$9(this, function(_state) {
+                                                return _ts_generator$b(this, function(_state) {
                                                     scopes = new Set(scope.split(' '));
                                                     return [
                                                         2,
@@ -1596,13 +1598,13 @@ function _ts_generator$9(thisArg, body) {
  * Register it as a provider using the `OidcAccountService` class as the injection token.
  */ var OidcAccountService = /*#__PURE__*/ function() {
     function OidcAccountService(authService, delegate) {
-        _class_call_check$f(this, OidcAccountService);
-        _define_property$e(this, "authService", void 0);
-        _define_property$e(this, "delegate", void 0);
+        _class_call_check$g(this, OidcAccountService);
+        _define_property$g(this, "authService", void 0);
+        _define_property$g(this, "delegate", void 0);
         this.authService = authService;
         this.delegate = delegate;
     }
-    _create_class$c(OidcAccountService, [
+    _create_class$d(OidcAccountService, [
         {
             key: "providerConfig",
             get: /**
@@ -1637,10 +1639,10 @@ function _call_super$1(_this, derived, args) {
     derived = _get_prototype_of$1(derived);
     return _possible_constructor_return$1(_this, _is_native_reflect_construct$1() ? Reflect.construct(derived, args || [], _get_prototype_of$1(_this).constructor) : derived.apply(_this, args));
 }
-function _class_call_check$e(instance, Constructor) {
+function _class_call_check$f(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
-function _defineProperties$b(target, props) {
+function _defineProperties$c(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -1649,8 +1651,8 @@ function _defineProperties$b(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$b(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
+function _create_class$c(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$c(Constructor.prototype, protoProps);
     return Constructor;
 }
 function _get_prototype_of$1(o) {
@@ -1681,7 +1683,7 @@ function _is_native_reflect_construct$1() {
     })();
 }
 function _possible_constructor_return$1(self, call) {
-    if (call && (_type_of$1(call) === "object" || typeof call === "function")) return call;
+    if (call && (_type_of$2(call) === "object" || typeof call === "function")) return call;
     return _assert_this_initialized$1(self);
 }
 function _set_prototype_of$1(o, p) {
@@ -1691,7 +1693,7 @@ function _set_prototype_of$1(o, p) {
     };
     return _set_prototype_of$1(o, p);
 }
-function _type_of$1(obj) {
+function _type_of$2(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
@@ -1701,7 +1703,7 @@ function _type_of$1(obj) {
  *
  * Implementations provide concrete collection instances wired to a specific {@link FirestoreContext}.
  */ var JwksFirestoreCollections = function JwksFirestoreCollections() {
-    _class_call_check$e(this, JwksFirestoreCollections);
+    _class_call_check$f(this, JwksFirestoreCollections);
 };
 // MARK: Identity
 /**
@@ -1714,10 +1716,10 @@ function _type_of$1(obj) {
  */ var JwksKeyDocument = /*#__PURE__*/ function(AbstractFirestoreDocument) {
     _inherits$1(JwksKeyDocument, AbstractFirestoreDocument);
     function JwksKeyDocument() {
-        _class_call_check$e(this, JwksKeyDocument);
+        _class_call_check$f(this, JwksKeyDocument);
         return _call_super$1(this, JwksKeyDocument, arguments);
     }
-    _create_class$b(JwksKeyDocument, [
+    _create_class$c(JwksKeyDocument, [
         {
             key: "modelIdentity",
             get: function get() {
@@ -1780,7 +1782,7 @@ function _type_of$1(obj) {
     });
 }
 
-function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1791,25 +1793,25 @@ function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$8(fn) {
+function _async_to_generator$a(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$d(instance, Constructor) {
+function _class_call_check$e(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
-function _ts_generator$8(thisArg, body) {
+function _ts_generator$a(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1914,7 +1916,7 @@ function _ts_generator$8(thisArg, body) {
  *
  * @see {@link oidcModelServerActions} for the concrete implementation factory.
  */ var OidcModelServerActions = function OidcModelServerActions() {
-    _class_call_check$d(this, OidcModelServerActions);
+    _class_call_check$e(this, OidcModelServerActions);
 };
 /**
  * Creates a concrete {@link OidcModelServerActions} implementation wired to the provided context.
@@ -1949,13 +1951,13 @@ function _ts_generator$8(thisArg, body) {
  */ function createOidcClientFactory(context) {
     var oidcClientService = context.oidcClientService, firebaseServerActionTransformFunctionFactory = context.firebaseServerActionTransformFunctionFactory;
     return firebaseServerActionTransformFunctionFactory(createOidcClientParamsType, function(params) {
-        return _async_to_generator$8(function() {
-            return _ts_generator$8(this, function(_state) {
+        return _async_to_generator$a(function() {
+            return _ts_generator$a(this, function(_state) {
                 return [
                     2,
                     function() {
-                        return _async_to_generator$8(function() {
-                            return _ts_generator$8(this, function(_state) {
+                        return _async_to_generator$a(function() {
+                            return _ts_generator$a(this, function(_state) {
                                 return [
                                     2,
                                     oidcClientService.createClient(params)
@@ -1978,13 +1980,13 @@ function _ts_generator$8(thisArg, body) {
  */ function updateOidcClientFactory(context) {
     var oidcClientService = context.oidcClientService, firebaseServerActionTransformFunctionFactory = context.firebaseServerActionTransformFunctionFactory;
     return firebaseServerActionTransformFunctionFactory(updateOidcClientParamsType, function(params) {
-        return _async_to_generator$8(function() {
-            return _ts_generator$8(this, function(_state) {
+        return _async_to_generator$a(function() {
+            return _ts_generator$a(this, function(_state) {
                 return [
                     2,
                     function(document) {
-                        return _async_to_generator$8(function() {
-                            return _ts_generator$8(this, function(_state) {
+                        return _async_to_generator$a(function() {
+                            return _ts_generator$a(this, function(_state) {
                                 switch(_state.label){
                                     case 0:
                                         return [
@@ -2017,13 +2019,13 @@ function _ts_generator$8(thisArg, body) {
  */ function rotateOidcClientSecretFactory(context) {
     var oidcClientService = context.oidcClientService, firebaseServerActionTransformFunctionFactory = context.firebaseServerActionTransformFunctionFactory;
     return firebaseServerActionTransformFunctionFactory(rotateOidcClientSecretParamsType, function(_params) {
-        return _async_to_generator$8(function() {
-            return _ts_generator$8(this, function(_state) {
+        return _async_to_generator$a(function() {
+            return _ts_generator$a(this, function(_state) {
                 return [
                     2,
                     function(document) {
-                        return _async_to_generator$8(function() {
-                            return _ts_generator$8(this, function(_state) {
+                        return _async_to_generator$a(function() {
+                            return _ts_generator$a(this, function(_state) {
                                 return [
                                     2,
                                     oidcClientService.rotateClientSecret(document.id)
@@ -2046,13 +2048,13 @@ function _ts_generator$8(thisArg, body) {
  */ function deleteOidcClientFactory(context) {
     var oidcClientService = context.oidcClientService, firebaseServerActionTransformFunctionFactory = context.firebaseServerActionTransformFunctionFactory;
     return firebaseServerActionTransformFunctionFactory(deleteOidcClientParamsType, function(_params) {
-        return _async_to_generator$8(function() {
-            return _ts_generator$8(this, function(_state) {
+        return _async_to_generator$a(function() {
+            return _ts_generator$a(this, function(_state) {
                 return [
                     2,
                     function(document) {
-                        return _async_to_generator$8(function() {
-                            return _ts_generator$8(this, function(_state) {
+                        return _async_to_generator$a(function() {
+                            return _ts_generator$a(this, function(_state) {
                                 switch(_state.label){
                                     case 0:
                                         return [
@@ -2089,14 +2091,14 @@ function _ts_generator$8(thisArg, body) {
  */ function deleteOidcTokenFactory(context) {
     var oidcService = context.oidcService, firebaseServerActionTransformFunctionFactory = context.firebaseServerActionTransformFunctionFactory;
     return firebaseServerActionTransformFunctionFactory(deleteOidcTokenParamsType, function(_params) {
-        return _async_to_generator$8(function() {
-            return _ts_generator$8(this, function(_state) {
+        return _async_to_generator$a(function() {
+            return _ts_generator$a(this, function(_state) {
                 return [
                     2,
                     function(document) {
-                        return _async_to_generator$8(function() {
+                        return _async_to_generator$a(function() {
                             var data;
-                            return _ts_generator$8(this, function(_state) {
+                            return _ts_generator$a(this, function(_state) {
                                 switch(_state.label){
                                     case 0:
                                         return [
@@ -2127,7 +2129,7 @@ function _ts_generator$8(thisArg, body) {
     });
 }
 
-function asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2138,25 +2140,25 @@ function asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$7(fn) {
+function _async_to_generator$9(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$c(instance, Constructor) {
+function _class_call_check$d(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
-function _defineProperties$a(target, props) {
+function _defineProperties$b(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -2165,11 +2167,11 @@ function _defineProperties$a(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$a(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
+function _create_class$b(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$b(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$d(obj, key, value) {
+function _define_property$f(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2180,7 +2182,7 @@ function _define_property$d(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$6(target) {
+function _object_spread$8(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2190,7 +2192,7 @@ function _object_spread$6(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$d(target, key, source[key]);
+            _define_property$f(target, key, source[key]);
         });
     }
     return target;
@@ -2213,7 +2215,7 @@ function _object_spread_props$2(target, source) {
     }
     return target;
 }
-function _ts_generator$7(thisArg, body) {
+function _ts_generator$9(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2324,11 +2326,11 @@ function _ts_generator$7(thisArg, body) {
  * with the acting user — not by the OIDC analytics service.
  */ var OidcClientService = /*#__PURE__*/ function() {
     function OidcClientService(oidcService) {
-        _class_call_check$c(this, OidcClientService);
-        _define_property$d(this, "oidcService", void 0);
+        _class_call_check$d(this, OidcClientService);
+        _define_property$f(this, "oidcService", void 0);
         this.oidcService = oidcService;
     }
-    _create_class$a(OidcClientService, [
+    _create_class$b(OidcClientService, [
         {
             key: "createClient",
             value: /**
@@ -2348,9 +2350,9 @@ function _ts_generator$7(thisArg, body) {
      *   and should not be exposed through the API params.
      * @returns The generated client ID and, for secret-based methods, the secret (plaintext, returned only once).
      */ function createClient(params, validatedMetadata) {
-                return _async_to_generator$7(function() {
+                return _async_to_generator$9(function() {
                     var provider, ProviderClient, clientId, firestoreOwnerKey, properties, clientSecret, client, payload;
-                    return _ts_generator$7(this, function(_state) {
+                    return _ts_generator$9(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -2448,9 +2450,9 @@ function _ts_generator$7(thisArg, body) {
      * @param params - The fields to update.
      * @throws {Error} When the client is not found.
      */ function updateClient(clientId, params) {
-                return _async_to_generator$7(function() {
+                return _async_to_generator$9(function() {
                     var provider, ProviderClient, existing, updatedMetadata, _params_logo_uri, _params_client_uri, _params_dbx_max_session_ttl, _params_dbx_provider_profiles, client;
-                    return _ts_generator$7(this, function(_state) {
+                    return _ts_generator$9(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -2469,7 +2471,7 @@ function _ts_generator$7(thisArg, body) {
                                 if (!existing) {
                                     throw new Error('Client not found.');
                                 }
-                                updatedMetadata = _object_spread$6({}, existing);
+                                updatedMetadata = _object_spread$8({}, existing);
                                 updatedMetadata.client_name = params.client_name;
                                 updatedMetadata.redirect_uris = params.redirect_uris;
                                 if (params.logo_uri !== undefined) {
@@ -2524,9 +2526,9 @@ function _ts_generator$7(thisArg, body) {
      * @returns The client ID and new secret (plaintext, returned only once).
      * @throws {Error} When the client is not found, or is a public PKCE (`none`) client.
      */ function rotateClientSecret(clientId) {
-                return _async_to_generator$7(function() {
+                return _async_to_generator$9(function() {
                     var provider, ProviderClient, existing, newSecret, updatedMetadata, client;
-                    return _ts_generator$7(this, function(_state) {
+                    return _ts_generator$9(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -2549,7 +2551,7 @@ function _ts_generator$7(thisArg, body) {
                                     throw new Error('Cannot rotate a client secret for a public PKCE client (token_endpoint_auth_method "none"). Public clients have no secret.');
                                 }
                                 newSecret = randomBytes(64).toString('base64url');
-                                updatedMetadata = _object_spread_props$2(_object_spread$6({}, existing), {
+                                updatedMetadata = _object_spread_props$2(_object_spread$8({}, existing), {
                                     client_secret: newSecret,
                                     client_secret_expires_at: 0
                                 });
@@ -2586,9 +2588,9 @@ function _ts_generator$7(thisArg, body) {
      * @param clientId - The client's document/adapter entry ID.
      * @throws {Error} When the client is not found.
      */ function deleteClient(clientId) {
-                return _async_to_generator$7(function() {
+                return _async_to_generator$9(function() {
                     var provider, ProviderClient, existing;
-                    return _ts_generator$7(this, function(_state) {
+                    return _ts_generator$9(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -2626,7 +2628,7 @@ function _ts_generator$7(thisArg, body) {
 } 
 ();
 
-function _define_property$c(obj, key, value) {
+function _define_property$e(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2637,7 +2639,7 @@ function _define_property$c(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$5(target) {
+function _object_spread$7(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2647,7 +2649,7 @@ function _object_spread$5(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$c(target, key, source[key]);
+            _define_property$e(target, key, source[key]);
         });
     }
     return target;
@@ -2678,7 +2680,7 @@ function _object_spread_props$1(target, source) {
  * @param oidcService - The core OIDC service for grant revocation.
  * @returns The configured OidcModelServerActions instance.
  */ function oidcModelServerActionsFactory(oidcClientService, oidcService) {
-    var context = _object_spread_props$1(_object_spread$5({}, firebaseServerActionsContext()), {
+    var context = _object_spread_props$1(_object_spread$7({}, firebaseServerActionsContext()), {
         oidcClientService: oidcClientService,
         oidcService: oidcService
     });
@@ -2714,7 +2716,7 @@ function _object_spread_props$1(target, source) {
     };
 }
 
-function asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2725,25 +2727,25 @@ function asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$6(fn) {
+function _async_to_generator$8(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$b(instance, Constructor) {
+function _class_call_check$c(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
-function _defineProperties$9(target, props) {
+function _defineProperties$a(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -2752,11 +2754,11 @@ function _defineProperties$9(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$9(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
+function _create_class$a(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$a(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$b(obj, key, value) {
+function _define_property$d(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2773,7 +2775,7 @@ function _instanceof$3(left, right) {
         return !!right[Symbol.hasInstance](left);
     } else return left instanceof right;
 }
-function _object_spread$4(target) {
+function _object_spread$6(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2783,12 +2785,12 @@ function _object_spread$4(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$b(target, key, source[key]);
+            _define_property$d(target, key, source[key]);
         });
     }
     return target;
 }
-function _ts_generator$6(thisArg, body) {
+function _ts_generator$8(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2917,19 +2919,19 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
  */ function createAdapterFactory(collections, encryptionService) {
     var FirestoreAdapter = /*#__PURE__*/ function() {
         function FirestoreAdapter(name) {
-            _class_call_check$b(this, FirestoreAdapter);
-            _define_property$b(this, "name", void 0);
-            _define_property$b(this, "collection", void 0);
+            _class_call_check$c(this, FirestoreAdapter);
+            _define_property$d(this, "name", void 0);
+            _define_property$d(this, "collection", void 0);
             this.name = name;
             this.collection = collections.oidcEntryCollection;
         }
-        _create_class$9(FirestoreAdapter, [
+        _create_class$a(FirestoreAdapter, [
             {
                 key: "upsert",
                 value: function upsert(id, payload, expiresIn) {
-                    return _async_to_generator$6(function() {
+                    return _async_to_generator$8(function() {
                         var _payload_uid, _payload_clientId, o, uid, clientId, iat, createdAtIso, createdAt, data, doc;
-                        return _ts_generator$6(this, function(_state) {
+                        return _ts_generator$8(this, function(_state) {
                             switch(_state.label){
                                 case 0:
                                     // Set ownership key for Client entries so firestore rules can restrict reads by owner.
@@ -2954,7 +2956,7 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
                                     } else if (createdAtIso) {
                                         createdAt = safeToJsDate(createdAtIso);
                                     }
-                                    data = _object_spread$4({
+                                    data = _object_spread$6({
                                         type: this.name,
                                         payload: encryptionService.encryptAdapterPayload(payload),
                                         o: o,
@@ -2988,9 +2990,9 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
             {
                 key: "find",
                 value: function find(id) {
-                    return _async_to_generator$6(function() {
+                    return _async_to_generator$8(function() {
                         var doc, snapshot, data;
-                        return _ts_generator$6(this, function(_state) {
+                        return _ts_generator$8(this, function(_state) {
                             switch(_state.label){
                                 case 0:
                                     doc = this.collection.documentAccessor().loadDocumentForId(id);
@@ -3013,9 +3015,9 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
             {
                 key: "findByUserCode",
                 value: function findByUserCode(userCode) {
-                    return _async_to_generator$6(function() {
+                    return _async_to_generator$8(function() {
                         var results;
-                        return _ts_generator$6(this, function(_state) {
+                        return _ts_generator$8(this, function(_state) {
                             switch(_state.label){
                                 case 0:
                                     return [
@@ -3036,9 +3038,9 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
             {
                 key: "findByUid",
                 value: function findByUid(uid) {
-                    return _async_to_generator$6(function() {
+                    return _async_to_generator$8(function() {
                         var results;
-                        return _ts_generator$6(this, function(_state) {
+                        return _ts_generator$8(this, function(_state) {
                             switch(_state.label){
                                 case 0:
                                     return [
@@ -3059,9 +3061,9 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
             {
                 key: "consume",
                 value: function consume(id) {
-                    return _async_to_generator$6(function() {
+                    return _async_to_generator$8(function() {
                         var now, doc, snapshot, data, payload;
-                        return _ts_generator$6(this, function(_state) {
+                        return _ts_generator$8(this, function(_state) {
                             switch(_state.label){
                                 case 0:
                                     now = unixDateTimeSecondsNumberForNow();
@@ -3103,9 +3105,9 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
             {
                 key: "destroy",
                 value: function destroy(id) {
-                    return _async_to_generator$6(function() {
+                    return _async_to_generator$8(function() {
                         var doc;
-                        return _ts_generator$6(this, function(_state) {
+                        return _ts_generator$8(this, function(_state) {
                             switch(_state.label){
                                 case 0:
                                     doc = this.collection.documentAccessor().loadDocumentForId(id);
@@ -3126,9 +3128,9 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
             {
                 key: "revokeByGrantId",
                 value: function revokeByGrantId(grantId) {
-                    return _async_to_generator$6(function() {
+                    return _async_to_generator$8(function() {
                         var _this, results;
-                        return _ts_generator$6(this, function(_state) {
+                        return _ts_generator$8(this, function(_state) {
                             switch(_state.label){
                                 case 0:
                                     _this = this;
@@ -3188,18 +3190,18 @@ var GRANTABLE_MODELS = new Set(GRANTABLE_MODEL_NAMES);
     return FirestoreAdapter;
 }
 
-function _array_like_to_array$7(arr, len) {
+function _array_like_to_array$a(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$7(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
+function _array_without_holes$a(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$a(arr);
 }
-function _class_call_check$a(instance, Constructor) {
+function _class_call_check$b(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
-function _defineProperties$8(target, props) {
+function _defineProperties$9(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3208,11 +3210,11 @@ function _defineProperties$8(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$8(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
+function _create_class$9(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$9(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$a(obj, key, value) {
+function _define_property$c(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3223,24 +3225,24 @@ function _define_property$a(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _iterable_to_array$7(iter) {
+function _iterable_to_array$a(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$7() {
+function _non_iterable_spread$a() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$7(arr) {
-    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$7();
+function _to_consumable_array$a(arr) {
+    return _array_without_holes$a(arr) || _iterable_to_array$a(arr) || _unsupported_iterable_to_array$a(arr) || _non_iterable_spread$a();
 }
-function _unsupported_iterable_to_array$7(o, minLen) {
+function _unsupported_iterable_to_array$a(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$a(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$a(o, minLen);
 }
 // MARK: Encrypted Fields
 /**
@@ -3262,16 +3264,16 @@ function _unsupported_iterable_to_array$7(o, minLen) {
  * the OIDC model server actions.
  */ var OidcEncryptionService = /*#__PURE__*/ function() {
     function OidcEncryptionService(config) {
-        _class_call_check$a(this, OidcEncryptionService);
-        _define_property$a(this, "provider", void 0);
-        _define_property$a(this, "adapterPayloadEncryptor", void 0);
+        _class_call_check$b(this, OidcEncryptionService);
+        _define_property$c(this, "provider", void 0);
+        _define_property$c(this, "adapterPayloadEncryptor", void 0);
         this.provider = createAesStringEncryptionProvider(config.jwksKeyConverterConfig.encryptionSecret);
         this.adapterPayloadEncryptor = selectiveFieldEncryptor({
             provider: this.provider,
-            fields: _to_consumable_array$7(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
+            fields: _to_consumable_array$a(OIDC_ENCRYPTED_PAYLOAD_FIELDS)
         });
     }
-    _create_class$8(OidcEncryptionService, [
+    _create_class$9(OidcEncryptionService, [
         {
             /**
      * Encrypts sensitive fields in an adapter payload and returns it as a {@link JsonSerializableObject}
@@ -3304,18 +3306,18 @@ OidcEncryptionService = __decorate([
     __param(0, Inject(OidcModuleConfig))
 ], OidcEncryptionService);
 
-function _array_like_to_array$6(arr, len) {
+function _array_like_to_array$9(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$6(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
+function _array_without_holes$9(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$9(arr);
 }
-function _class_call_check$9(instance, Constructor) {
+function _class_call_check$a(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
-function _defineProperties$7(target, props) {
+function _defineProperties$8(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -3324,11 +3326,11 @@ function _defineProperties$7(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$7(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$7(Constructor.prototype, protoProps);
+function _create_class$8(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$8(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$9(obj, key, value) {
+function _define_property$b(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3339,24 +3341,24 @@ function _define_property$9(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _iterable_to_array$6(iter) {
+function _iterable_to_array$9(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$6() {
+function _non_iterable_spread$9() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$6(arr) {
-    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$6();
+function _to_consumable_array$9(arr) {
+    return _array_without_holes$9(arr) || _iterable_to_array$9(arr) || _unsupported_iterable_to_array$9(arr) || _non_iterable_spread$9();
 }
-function _unsupported_iterable_to_array$6(o, minLen) {
+function _unsupported_iterable_to_array$9(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$9(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$9(o, minLen);
 }
 // MARK: Routes
 /**
@@ -3404,25 +3406,25 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
  * Injected into {@link OidcService} and {@link OidcWellKnownController}.
  */ var OidcProviderConfigService = /*#__PURE__*/ function() {
     function OidcProviderConfigService(config, accountService, envService) {
-        _class_call_check$9(this, OidcProviderConfigService);
+        _class_call_check$a(this, OidcProviderConfigService);
         var _this_providerConfig_providerProfiles, _this_config_tokenEndpointAuthMethods;
-        _define_property$9(this, "config", void 0);
-        _define_property$9(this, "routes", DEFAULT_OIDC_ROUTES);
+        _define_property$b(this, "config", void 0);
+        _define_property$b(this, "routes", DEFAULT_OIDC_ROUTES);
         /**
      * If the OIDC registration route is enabled.
-     */ _define_property$9(this, "oidcRegistrationRouteEnabled", void 0);
+     */ _define_property$b(this, "oidcRegistrationRouteEnabled", void 0);
         /**
      * The url to the front-end login page.
-     */ _define_property$9(this, "appLoginUrl", void 0);
+     */ _define_property$b(this, "appLoginUrl", void 0);
         /**
      * The url to the front-end consent page.
-     */ _define_property$9(this, "appConsentUrl", void 0);
+     */ _define_property$b(this, "appConsentUrl", void 0);
         /**
      * The app-provided provider config from the delegate.
-     */ _define_property$9(this, "providerConfig", void 0);
+     */ _define_property$b(this, "providerConfig", void 0);
         /**
      * Scopes derived from the claims configuration keys.
-     */ _define_property$9(this, "scopesSupported", void 0);
+     */ _define_property$b(this, "scopesSupported", void 0);
         /**
      * {@link scopesSupported} minus the scopes only an admin-assigned {@link OidcProviderProfile}
      * unlocks — what an arbitrary client (a dynamically registered one included) may actually put in
@@ -3435,13 +3437,13 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
      * verbatim onto `/authorize`. An assignment-only scope advertised there ends the flow in
      * `access_denied`: the consent unlock gate judges the REQUEST, so unlike an admin-only scope
      * there is no deselect-at-consent way through.
-     */ _define_property$9(this, "clientRequestableScopesSupported", void 0);
+     */ _define_property$b(this, "clientRequestableScopesSupported", void 0);
         /**
      * Flat list of all unique claim names from the claims configuration.
-     */ _define_property$9(this, "claimsSupported", void 0);
+     */ _define_property$b(this, "claimsSupported", void 0);
         /**
      * Token endpoint authentication methods from config or defaults.
-     */ _define_property$9(this, "tokenEndpointAuthMethodsSupported", void 0);
+     */ _define_property$b(this, "tokenEndpointAuthMethodsSupported", void 0);
         this.config = config;
         this.providerConfig = accountService.providerConfig;
         this.scopesSupported = Object.keys(this.providerConfig.claims);
@@ -3450,7 +3452,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
             return !assignmentOnlyScopes.has(scope);
         });
         this.claimsSupported = Array.from(new Set(Object.values(this.providerConfig.claims).flat()));
-        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$6(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
+        this.tokenEndpointAuthMethodsSupported = (_this_config_tokenEndpointAuthMethods = this.config.tokenEndpointAuthMethods) !== null && _this_config_tokenEndpointAuthMethods !== void 0 ? _this_config_tokenEndpointAuthMethods : _to_consumable_array$9(DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS);
         var appUrl = envService.appUrl;
         this.appLoginUrl = websiteUrlFromPaths(appUrl, [
             this.config.appOAuthInteractionPath,
@@ -3462,7 +3464,7 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
         ]);
         this.oidcRegistrationRouteEnabled = config.registrationEnabled === true;
     }
-    _create_class$7(OidcProviderConfigService, [
+    _create_class$8(OidcProviderConfigService, [
         {
             /**
      * Builds the OpenID Connect Discovery metadata document.
@@ -3483,16 +3485,16 @@ var DEFAULT_OIDC_CODE_CHALLENGE_METHODS = [
                     jwks_uri: jwksUri !== null && jwksUri !== void 0 ? jwksUri : "".concat(issuer).concat(routes.jwks),
                     registration_endpoint: this.oidcRegistrationRouteEnabled ? "".concat(issuer).concat(routes.registration) : undefined,
                     scopes_supported: this.scopesSupported,
-                    response_types_supported: _to_consumable_array$6(providerConfig.responseTypes),
+                    response_types_supported: _to_consumable_array$9(providerConfig.responseTypes),
                     response_modes_supported: [
                         'query'
                     ],
-                    grant_types_supported: _to_consumable_array$6(providerConfig.grantTypes),
-                    subject_types_supported: _to_consumable_array$6(DEFAULT_OIDC_SUBJECT_TYPES),
-                    id_token_signing_alg_values_supported: _to_consumable_array$6(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
-                    token_endpoint_auth_methods_supported: _to_consumable_array$6(this.tokenEndpointAuthMethodsSupported),
+                    grant_types_supported: _to_consumable_array$9(providerConfig.grantTypes),
+                    subject_types_supported: _to_consumable_array$9(DEFAULT_OIDC_SUBJECT_TYPES),
+                    id_token_signing_alg_values_supported: _to_consumable_array$9(DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES),
+                    token_endpoint_auth_methods_supported: _to_consumable_array$9(this.tokenEndpointAuthMethodsSupported),
                     claims_supported: this.claimsSupported,
-                    code_challenge_methods_supported: _to_consumable_array$6(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
+                    code_challenge_methods_supported: _to_consumable_array$9(DEFAULT_OIDC_CODE_CHALLENGE_METHODS)
                 };
             }
         }
@@ -3506,32 +3508,32 @@ OidcProviderConfigService = __decorate([
     __param(2, Inject(FirebaseServerEnvService))
 ], OidcProviderConfigService);
 
-function _array_like_to_array$5(arr, len) {
+function _array_like_to_array$8(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$5(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
+function _array_without_holes$8(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$8(arr);
 }
-function _iterable_to_array$5(iter) {
+function _iterable_to_array$8(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$5() {
+function _non_iterable_spread$8() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$5(arr) {
-    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
+function _to_consumable_array$8(arr) {
+    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$8(arr) || _non_iterable_spread$8();
 }
-function _unsupported_iterable_to_array$5(o, minLen) {
+function _unsupported_iterable_to_array$8(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$8(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$8(o, minLen);
 }
 /**
  * Custom oidc-provider client metadata field holding the {@link OidcProviderProfile} keys assigned
@@ -3571,7 +3573,7 @@ function _unsupported_iterable_to_array$5(o, minLen) {
  * @returns The union of config-level and profile-level admin-only scopes.
  */ function adminOnlyScopesForOidcProviderConfig(providerConfig) {
     var _providerConfig_adminOnlyScopes, _providerConfig_providerProfiles;
-    return new Set(_to_consumable_array$5((_providerConfig_adminOnlyScopes = providerConfig.adminOnlyScopes) !== null && _providerConfig_adminOnlyScopes !== void 0 ? _providerConfig_adminOnlyScopes : []).concat(_to_consumable_array$5(Array.from(adminOnlyScopesForOidcProviderProfiles((_providerConfig_providerProfiles = providerConfig.providerProfiles) !== null && _providerConfig_providerProfiles !== void 0 ? _providerConfig_providerProfiles : [])))));
+    return new Set(_to_consumable_array$8((_providerConfig_adminOnlyScopes = providerConfig.adminOnlyScopes) !== null && _providerConfig_adminOnlyScopes !== void 0 ? _providerConfig_adminOnlyScopes : []).concat(_to_consumable_array$8(Array.from(adminOnlyScopesForOidcProviderProfiles((_providerConfig_providerProfiles = providerConfig.providerProfiles) !== null && _providerConfig_providerProfiles !== void 0 ? _providerConfig_providerProfiles : [])))));
 }
 
 /**
@@ -3614,57 +3616,18 @@ function _unsupported_iterable_to_array$5(o, minLen) {
     return policy;
 }
 
-function _array_like_to_array$4(arr, len) {
+function _array_like_to_array$7(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$4(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
-}
-function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
-    try {
-        var info = gen[key](arg);
-        var value = info.value;
-    } catch (error) {
-        reject(error);
-        return;
-    }
-    if (info.done) resolve(value);
-    else Promise.resolve(value).then(_next, _throw);
-}
-function _async_to_generator$5(fn) {
-    return function() {
-        var self = this, args = arguments;
-        return new Promise(function(resolve, reject) {
-            var gen = fn.apply(self, args);
-            function _next(value) {
-                asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, "next", value);
-            }
-            function _throw(err) {
-                asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, "throw", err);
-            }
-            _next(undefined);
-        });
-    };
-}
-function _class_call_check$8(instance, Constructor) {
-    if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
-}
-function _defineProperties$6(target, props) {
-    for(var i = 0; i < props.length; i++){
-        var descriptor = props[i];
-        descriptor.enumerable = descriptor.enumerable || false;
-        descriptor.configurable = true;
-        if ("value" in descriptor) descriptor.writable = true;
-        Object.defineProperty(target, descriptor.key, descriptor);
-    }
+function _array_with_holes(arr) {
+    if (Array.isArray(arr)) return arr;
 }
-function _create_class$6(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$6(Constructor.prototype, protoProps);
-    return Constructor;
+function _array_without_holes$7(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
 }
-function _define_property$8(obj, key, value) {
+function _define_property$a(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3675,93 +3638,223 @@ function _define_property$8(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$2(left, right) {
-    "@swc/helpers - instanceof";
-    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
-        return !!right[Symbol.hasInstance](left);
-    } else return left instanceof right;
-}
-function _iterable_to_array$4(iter) {
+function _iterable_to_array$7(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$4() {
-    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _object_spread$3(target) {
-    for(var i = 1; i < arguments.length; i++){
-        var source = arguments[i] != null ? arguments[i] : {};
-        var ownKeys = Object.keys(source);
-        if (typeof Object.getOwnPropertySymbols === "function") {
-            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
-            }));
+function _iterable_to_array_limit(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
         }
-        ownKeys.forEach(function(key) {
-            _define_property$8(target, key, source[key]);
-        });
-    }
-    return target;
-}
-function ownKeys(object, enumerableOnly) {
-    var keys = Object.keys(object);
-    if (Object.getOwnPropertySymbols) {
-        var symbols = Object.getOwnPropertySymbols(object);
-        keys.push.apply(keys, symbols);
     }
-    return keys;
+    return _arr;
 }
-function _object_spread_props(target, source) {
-    source = source != null ? source : {};
-    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
-    else {
-        ownKeys(Object(source)).forEach(function(key) {
-            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+function _non_iterable_rest() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _non_iterable_spread$7() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread$5(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$a(target, key, source[key]);
         });
     }
     return target;
 }
-function _object_without_properties(source, excluded) {
-    if (source == null) return {};
-    var target = {}, sourceKeys, key, i;
-    if (typeof Reflect !== "undefined" && Reflect.ownKeys) {
-        sourceKeys = Reflect.ownKeys(Object(source));
-        for(i = 0; i < sourceKeys.length; i++){
-            key = sourceKeys[i];
-            if (excluded.indexOf(key) >= 0) continue;
-            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
-            target[key] = source[key];
-        }
-        return target;
-    }
-    target = _object_without_properties_loose(source, excluded);
-    if (Object.getOwnPropertySymbols) {
-        sourceKeys = Object.getOwnPropertySymbols(source);
-        for(i = 0; i < sourceKeys.length; i++){
-            key = sourceKeys[i];
-            if (excluded.indexOf(key) >= 0) continue;
-            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
-            target[key] = source[key];
-        }
+function _sliced_to_array(arr, i) {
+    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array$7(arr, i) || _non_iterable_rest();
+}
+function _to_consumable_array$7(arr) {
+    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$7();
+}
+function _unsupported_iterable_to_array$7(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
+}
+/**
+ * Builds a single-entry {@link OidcResourceServerInfo} map for an RFC 8707 resource indicator.
+ *
+ * This is the supported way to declare a resource server the provider issues tokens for —
+ * including one that runs OFF-BOX (a Docker'd sidecar, a worker, a standalone MCP host), which is
+ * what {@link BuildOidcResourceServerConfig.accessTokenFormat} `'jwt'` exists for.
+ *
+ * @param config - The resource indicator, its scopes, and the token shape to issue for it.
+ * @returns A single-entry map keyed by the resource indicator.
+ *
+ * @example
+ * ```ts
+ * const DB_ORIGIN = 'https://db.example.com';
+ *
+ * oidcModuleMetadata({
+ *   dependencyModule: MyOidcDependencyModule,
+ *   config: {
+ *     resourceServers: buildOidcResourceServer({
+ *       url: `${DB_ORIGIN}/mcp`,
+ *       scope: 'openid profile email offline_access',
+ *       audience: DB_ORIGIN,
+ *       accessTokenFormat: 'jwt',
+ *       accessTokenTTL: 3600
+ *     })
+ *   }
+ * })
+ * ```
+ */ function buildOidcResourceServer(config) {
+    var _config_audience;
+    var url = config.url.replace(/\/+$/, '');
+    return _define_property$a({}, url, _object_spread$5({
+        scope: config.scope,
+        audience: (_config_audience = config.audience) !== null && _config_audience !== void 0 ? _config_audience : url
+    }, config.accessTokenFormat == null ? {} : {
+        accessTokenFormat: config.accessTokenFormat
+    }, config.accessTokenTTL == null ? {} : {
+        accessTokenTTL: config.accessTokenTTL
+    }));
+}
+// COMPAT: superseded by the general-purpose buildOidcResourceServer().
+/**
+ * Builds a single-entry {@link OidcResourceServerInfo} map for the MCP endpoint
+ * declared on `envService.appMcpUrl`, with `scope` set to every scope declared
+ * on `providerConfig.claims` (so any scope the provider issues is valid on the
+ * resource server) and `audience` set to the MCP URL.
+ *
+ * Returns `undefined` when no `appMcpUrl` is configured.
+ *
+ * Used internally by `oidcModuleMetadata` when `OidcModuleConfig.configureMcpResourceServer`
+ * is enabled.
+ *
+ * @param input - The environment service and provider config backing the entry.
+ * @returns The single-entry map, or `undefined` when no MCP URL is configured.
+ *
+ * @deprecated Prefer {@link buildOidcResourceServer}, which takes the URL, scope, audience, and
+ * token format explicitly instead of deriving a fixed shape from the environment.
+ */ function buildFirebaseServerMcpResourceServer(input) {
+    var envService = input.envService, providerConfig = input.providerConfig;
+    var mcpUrl = envService.appMcpUrl;
+    var result;
+    if (mcpUrl) {
+        result = buildOidcResourceServer({
+            url: mcpUrl,
+            scope: allOidcScopesStringForProviderConfig(providerConfig),
+            audience: mcpUrl,
+            accessTokenFormat: input.accessTokenFormat,
+            accessTokenTTL: input.accessTokenTTL
+        });
     }
-    return target;
+    return result;
 }
-function _object_without_properties_loose(source, excluded) {
-    if (source == null) return {};
-    var target = {}, sourceKeys = Object.getOwnPropertyNames(source), key, i;
-    for(i = 0; i < sourceKeys.length; i++){
-        key = sourceKeys[i];
-        if (excluded.indexOf(key) >= 0) continue;
-        if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
-        target[key] = source[key];
+/**
+ * Emits the `@dereekb/oauth-resource` {@link BuildIssuerProfilesConfig} for THIS provider, so an
+ * API and the satellite services it issues tokens for cannot drift on issuer / audience strings —
+ * both sides read the same `OidcModuleConfig`.
+ *
+ * The type dependency points `firebase-server → oauth-resource` and never the reverse: the light
+ * verify package must stay installable in a plain Express service with no Firebase, Nest, or
+ * oidc-provider in its install graph.
+ *
+ * @param config - The provider's module config plus any extra trusted projects / audiences.
+ * @returns The issuer-profile config to hand to `buildIssuerProfiles()`.
+ *
+ * @example
+ * ```ts
+ * // inside the API, to hand its satellites a config they cannot get wrong
+ * const profilesConfig = firebaseServerIssuerProfiles({ oidcModuleConfig, firebaseProjectIds: [projectId] });
+ * const profiles = buildIssuerProfiles(profilesConfig);
+ * ```
+ */ function firebaseServerIssuerProfiles(config) {
+    var _config_audiences, _config_firebaseProjectIds;
+    var _config_oidcModuleConfig = config.oidcModuleConfig, issuer = _config_oidcModuleConfig.issuer, resourceServers = _config_oidcModuleConfig.resourceServers;
+    var audiences = unique(_to_consumable_array$7(oidcResourceServerAudiences(resourceServers)).concat(_to_consumable_array$7((_config_audiences = config.audiences) !== null && _config_audiences !== void 0 ? _config_audiences : [])));
+    return {
+        firebaseProjectIds: (_config_firebaseProjectIds = config.firebaseProjectIds) !== null && _config_firebaseProjectIds !== void 0 ? _config_firebaseProjectIds : [],
+        oidcIssuers: [
+            {
+                issuer: issuer,
+                audiences: audiences,
+                getKey: config.getKey
+            }
+        ],
+        audiences: audiences,
+        fetch: config.fetch
+    };
+}
+/**
+ * Reads every audience a registered resource-server map can put on an access token: each entry's
+ * key (the resource indicator, which oidc-provider uses as the audience by default) plus its
+ * explicit `audience` when one is configured.
+ *
+ * @param resourceServers - The provider's registered resource servers, if any.
+ * @returns The unique audience values.
+ */ function oidcResourceServerAudiences(resourceServers) {
+    var entries = Object.entries(resourceServers !== null && resourceServers !== void 0 ? resourceServers : {});
+    return unique(entries.flatMap(function(param) {
+        var _param = _sliced_to_array(param, 2), url = _param[0], info = _param[1];
+        return info.audience == null ? [
+            url
+        ] : [
+            url,
+            info.audience
+        ];
+    }));
+}
+
+function asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
     }
-    return target;
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
 }
-function _to_consumable_array$4(arr) {
-    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$4();
+function _async_to_generator$7(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
 }
-function _ts_generator$5(thisArg, body) {
+function _ts_generator$7(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3860,62 +3953,459 @@ function _ts_generator$5(thisArg, body) {
         };
     }
 }
-function _unsupported_iterable_to_array$4(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
+// MARK: Keys
+/**
+ * Builds a jose {@link JWTVerifyGetKey} backed by the provider's OWN published JWKS, read directly
+ * from {@link JwksService} rather than over HTTP.
+ *
+ * An in-process verifier must not `createRemoteJWKSet` against its own `/.well-known/jwks.json`:
+ * that would make every bearer-authenticated request depend on the process being able to reach
+ * itself over the network (which it may not be, behind a load balancer, in a Functions emulator,
+ * or under supertest).
+ *
+ * The key set is cached and re-read only when a token presents a `kid` the cache does not hold —
+ * so a freshly rotated key is picked up on its first use instead of after a fixed TTL.
+ *
+ * @param jwksService - The provider's JWKS service.
+ * @returns The key resolver.
+ */ function jwksServiceVerifyGetKey(jwksService) {
+    var cached;
+    function loadKeySet() {
+        return _async_to_generator$7(function() {
+            var jwks, next;
+            return _ts_generator$7(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        return [
+                            4,
+                            jwksService.getLatestPublicJwks()
+                        ];
+                    case 1:
+                        jwks = _state.sent();
+                        next = {
+                            kids: new Set(jwks.keys.map(function(key) {
+                                return key.kid;
+                            })),
+                            getKey: createLocalJWKSet({
+                                keys: jwks.keys
+                            })
+                        };
+                        cached = next;
+                        return [
+                            2,
+                            next
+                        ];
+                }
+            });
+        })();
+    }
+    return function(protectedHeader, token) {
+        return _async_to_generator$7(function() {
+            var keySet, _tmp, kid;
+            return _ts_generator$7(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        if (!(cached !== null && cached !== void 0)) return [
+                            3,
+                            1
+                        ];
+                        _tmp = cached;
+                        return [
+                            3,
+                            3
+                        ];
+                    case 1:
+                        return [
+                            4,
+                            loadKeySet()
+                        ];
+                    case 2:
+                        _tmp = _state.sent();
+                        _state.label = 3;
+                    case 3:
+                        keySet = _tmp;
+                        kid = protectedHeader === null || protectedHeader === void 0 ? void 0 : protectedHeader.kid;
+                        if (!(kid != null && !keySet.kids.has(kid))) return [
+                            3,
+                            5
+                        ];
+                        return [
+                            4,
+                            loadKeySet()
+                        ];
+                    case 4:
+                        keySet = _state.sent();
+                        _state.label = 5;
+                    case 5:
+                        return [
+                            2,
+                            keySet.getKey(protectedHeader, token)
+                        ];
+                }
+            });
+        })();
+    };
 }
-var OidcService_1;
-// MARK: Service
+// MARK: Profiles
 /**
- * Core OIDC service that wraps the oidc-provider instance and exposes
- * typed methods for interaction handling, provider initialization, and JWKS management.
- */ var OidcService = OidcService_1 = /*#__PURE__*/ function() {
-    function OidcService(config, providerConfigService, jwksService, accountService, collections, encryptionService) {
-        var _this = this;
-        _class_call_check$8(this, OidcService);
-        _define_property$8(this, "config", void 0);
-        _define_property$8(this, "providerConfigService", void 0);
-        _define_property$8(this, "jwksService", void 0);
-        _define_property$8(this, "accountService", void 0);
-        _define_property$8(this, "collections", void 0);
-        _define_property$8(this, "encryptionService", void 0);
-        _define_property$8(this, "_logger", new Logger(OidcService_1.name));
-        _define_property$8(this, "_getProvider", cachedGetter(function() {
-            return _this._buildProvider();
-        }));
-        this.config = config;
-        this.providerConfigService = providerConfigService;
-        this.jwksService = jwksService;
-        this.accountService = accountService;
-        this.collections = collections;
-        this.encryptionService = encryptionService;
+ * Builds the {@link IssuerProfiles} the provider uses to verify its OWN JWT-format access tokens
+ * in-process.
+ *
+ * A JWT access token is issued for a specific `resource=`, so it carries THAT resource server's
+ * audience — not the API's own identity. The accepted audiences are therefore every registered
+ * `resourceServers` key and audience, plus the issuer itself. The trust decision that implies is
+ * deliberate and narrow: a resource server the user consented to may present the token it was
+ * given back to the API that issued it. Scope enforcement is unchanged and still does the real
+ * authorization work (e.g. the admin-only `session.firestore` consent gate and the endpoint's own
+ * admin predicate).
+ *
+ * @param config - The provider's module config.
+ * @param jwksService - The provider's JWKS service, used for local key resolution.
+ * @returns The issuer profiles, holding exactly this provider.
+ */ function oidcProviderIssuerProfiles(config, jwksService) {
+    var getKey = jwksServiceVerifyGetKey(jwksService);
+    return buildIssuerProfiles(firebaseServerIssuerProfiles({
+        oidcModuleConfig: config,
+        audiences: [
+            config.issuer
+        ],
+        getKey: function getKey1() {
+            return _async_to_generator$7(function() {
+                return _ts_generator$7(this, function(_state) {
+                    return [
+                        2,
+                        getKey
+                    ];
+                });
+            })();
+        }
+    }));
+}
+
+function _array_like_to_array$6(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$6(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
+}
+function asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
     }
-    _create_class$6(OidcService, [
-        {
-            /**
-     * Returns the oidc-provider instance, initializing it on first access.
-     *
-     * @returns The lazily-initialized oidc-provider instance.
-     */ key: "getProvider",
-            value: function getProvider() {
-                return this._getProvider();
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
+}
+function _async_to_generator$6(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "next", value);
             }
-        },
-        {
-            // MARK: Login Duration
-            /**
-     * Resolves the login-duration TTL (seconds) for a Grant being created from a fresh consent submission.
-     *
-     * The Grant TTL configured on the oidc-provider only fires when oidc-provider's koa middleware drives
-     * `grant.save()` (so `AsyncLocalStorage` carries the request context). Our consent flow saves grants
-     * from a NestJS controller, so we resolve the TTL up-front and pre-set `grant.expiresIn` before saving.
-     *
-     * Mirrors the resolution used by the `Grant`/`Session` TTL functions in {@link buildProviderConfiguration}.
-     *
+            function _throw(err) {
+                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check$9(instance, Constructor) {
+    if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
+}
+function _defineProperties$7(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class$7(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$7(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$9(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _instanceof$2(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else return left instanceof right;
+}
+function _iterable_to_array$6(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
+        return Array.from(iter);
+    }
+}
+function _non_iterable_spread$6() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread$4(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$9(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _object_without_properties(source, excluded) {
+    if (source == null) return {};
+    var target = {}, sourceKeys, key, i;
+    if (typeof Reflect !== "undefined" && Reflect.ownKeys) {
+        sourceKeys = Reflect.ownKeys(Object(source));
+        for(i = 0; i < sourceKeys.length; i++){
+            key = sourceKeys[i];
+            if (excluded.indexOf(key) >= 0) continue;
+            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+            target[key] = source[key];
+        }
+        return target;
+    }
+    target = _object_without_properties_loose(source, excluded);
+    if (Object.getOwnPropertySymbols) {
+        sourceKeys = Object.getOwnPropertySymbols(source);
+        for(i = 0; i < sourceKeys.length; i++){
+            key = sourceKeys[i];
+            if (excluded.indexOf(key) >= 0) continue;
+            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+            target[key] = source[key];
+        }
+    }
+    return target;
+}
+function _object_without_properties_loose(source, excluded) {
+    if (source == null) return {};
+    var target = {}, sourceKeys = Object.getOwnPropertyNames(source), key, i;
+    for(i = 0; i < sourceKeys.length; i++){
+        key = sourceKeys[i];
+        if (excluded.indexOf(key) >= 0) continue;
+        if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+        target[key] = source[key];
+    }
+    return target;
+}
+function _to_consumable_array$6(arr) {
+    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$6();
+}
+function _ts_generator$6(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+function _unsupported_iterable_to_array$6(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
+}
+var OidcService_1;
+// MARK: JWT Access Tokens
+/**
+ * Claims a JWT access token carries that the {@link OidcAuthData} shape sets explicitly, and that
+ * are therefore NOT app account claims.
+ */ var OIDC_JWT_ACCESS_TOKEN_RESERVED_CLAIMS = [
+    'iss',
+    'sub',
+    'aud',
+    'exp',
+    'iat',
+    'nbf',
+    'jti',
+    'auth_time',
+    'uid',
+    'scope',
+    'client_id',
+    'firebase'
+];
+var filterReservedJwtAccessTokenClaims = filterKeysOnPOJOFunction(OIDC_JWT_ACCESS_TOKEN_RESERVED_CLAIMS, true);
+// MARK: Service
+/**
+ * Core OIDC service that wraps the oidc-provider instance and exposes
+ * typed methods for interaction handling, provider initialization, and JWKS management.
+ */ var OidcService = OidcService_1 = /*#__PURE__*/ function() {
+    function OidcService(config, providerConfigService, jwksService, accountService, collections, encryptionService) {
+        var _this = this;
+        _class_call_check$9(this, OidcService);
+        _define_property$9(this, "config", void 0);
+        _define_property$9(this, "providerConfigService", void 0);
+        _define_property$9(this, "jwksService", void 0);
+        _define_property$9(this, "accountService", void 0);
+        _define_property$9(this, "collections", void 0);
+        _define_property$9(this, "encryptionService", void 0);
+        _define_property$9(this, "_logger", new Logger(OidcService_1.name));
+        _define_property$9(this, "_getProvider", cachedGetter(function() {
+            return _this._buildProvider();
+        }));
+        _define_property$9(this, "_getIssuerProfiles", cachedGetter(function() {
+            return oidcProviderIssuerProfiles(_this.config, _this.jwksService);
+        }));
+        this.config = config;
+        this.providerConfigService = providerConfigService;
+        this.jwksService = jwksService;
+        this.accountService = accountService;
+        this.collections = collections;
+        this.encryptionService = encryptionService;
+    }
+    _create_class$7(OidcService, [
+        {
+            /**
+     * Returns the oidc-provider instance, initializing it on first access.
+     *
+     * @returns The lazily-initialized oidc-provider instance.
+     */ key: "getProvider",
+            value: function getProvider() {
+                return this._getProvider();
+            }
+        },
+        {
+            // MARK: Login Duration
+            /**
+     * Resolves the login-duration TTL (seconds) for a Grant being created from a fresh consent submission.
+     *
+     * The Grant TTL configured on the oidc-provider only fires when oidc-provider's koa middleware drives
+     * `grant.save()` (so `AsyncLocalStorage` carries the request context). Our consent flow saves grants
+     * from a NestJS controller, so we resolve the TTL up-front and pre-set `grant.expiresIn` before saving.
+     *
+     * Mirrors the resolution used by the `Grant`/`Session` TTL functions in {@link buildProviderConfiguration}.
+     *
      * The `serverMaxSeconds` ceiling is tiered by {@link resolveTieredServerMaxSeconds}: a non-admin
      * caps at the non-admin tier, an admin at the admin tier, and an admin whose grant carries a
      * service-token scope at the (highest) service-token tier. This tiered value replaces the flat
@@ -3952,17 +4442,30 @@ var OidcService_1;
             key: "verifyAccessToken",
             value: // MARK: Token Verification
             /**
-     * Verifies an opaque access token and returns the {@link OidcAuthData}.
+     * Verifies an access token and returns the {@link OidcAuthData}.
+     *
+     * Two formats are accepted, because oidc-provider issues two:
      *
-     * Uses the provider's `AccessToken` model to look up the token and extract
-     * the account ID, scope, and client ID.
+     * - **opaque** (the default) — a database key. Looked up through the provider's `AccessToken`
+     *   model, which reads the Firestore adapter record written at issuance.
+     * - **JWT** (a resource server registered with `accessTokenFormat: 'jwt'`) — verified by
+     *   signature against this provider's own JWKS via `@dereekb/oauth-resource`. A JWT access token
+     *   is deliberately NOT persisted by oidc-provider (`lib/models/formats/jwt.js` returns no
+     *   payload, so `base_model.js` skips the `adapter.upsert`), which means `AccessToken.find()`
+     *   always misses for one and the store lookup alone would 401 every token the provider just
+     *   issued.
      *
-     * @param rawToken - The opaque access token string.
+     * The same absence of an adapter record is why a JWT access token **cannot be revoked before
+     * `exp`**: {@link revokeGrant} deletes the Grant and every persisted token referencing it, which
+     * stops refresh and future issuance, but an outstanding JWT stays verifiable until it expires.
+     * Keep `accessTokenTTL` short on any resource server that opts into the JWT format.
+     *
+     * @param rawToken - The access token string, opaque or JWT.
      * @returns The auth context, or `undefined` if the token is invalid or expired.
      */ function verifyAccessToken(rawToken) {
-                return _async_to_generator$5(function() {
+                return _async_to_generator$6(function() {
                     var provider, accessToken, result, _accessToken_extra, _accessToken_exp, accountClaims, token;
-                    return _ts_generator$5(this, function(_state) {
+                    return _ts_generator$6(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -3977,42 +4480,147 @@ var OidcService_1;
                                 ];
                             case 2:
                                 accessToken = _state.sent();
-                                if (accessToken) {
-                                    // Extract account claims baked into the access token at issuance time.
-                                    // These are the claims built by OidcAccountServiceDelegate.buildClaimsForUser()
-                                    // (e.g., `a` for admin, `o` for onboarded) based on the granted scopes.
-                                    // Read the account claims baked into the token at issuance time via extraAccessTokenClaims.
-                                    accountClaims = (_accessToken_extra = accessToken.extra) !== null && _accessToken_extra !== void 0 ? _accessToken_extra : {};
-                                    token = _object_spread_props(_object_spread$3({}, accountClaims), {
-                                        // Standard JWT claims — sourced from the access token
-                                        aud: firstValue(accessToken.aud),
-                                        iss: this.config.issuer,
+                                if (!accessToken) return [
+                                    3,
+                                    3
+                                ];
+                                // Extract account claims baked into the access token at issuance time.
+                                // These are the claims built by OidcAccountServiceDelegate.buildClaimsForUser()
+                                // (e.g., `a` for admin, `o` for onboarded) based on the granted scopes.
+                                // Read the account claims baked into the token at issuance time via extraAccessTokenClaims.
+                                accountClaims = (_accessToken_extra = accessToken.extra) !== null && _accessToken_extra !== void 0 ? _accessToken_extra : {};
+                                token = _object_spread_props(_object_spread$4({}, accountClaims), {
+                                    // Standard JWT claims — sourced from the access token
+                                    aud: firstValue(accessToken.aud),
+                                    iss: this.config.issuer,
+                                    sub: accessToken.accountId,
+                                    iat: accessToken.iat,
+                                    exp: (_accessToken_exp = accessToken.exp) !== null && _accessToken_exp !== void 0 ? _accessToken_exp : unixDateTimeSecondsNumberForNow() + accessToken.expiration,
+                                    auth_time: accessToken.iat,
+                                    // Firebase UID (copied from sub)
+                                    uid: accessToken.accountId,
+                                    // OIDC-specific claims carried on the token
+                                    scope: accessToken.scope,
+                                    client_id: accessToken.clientId,
+                                    // Firebase sign-in info — marked as OIDC provider
+                                    firebase: {
+                                        identities: {},
+                                        sign_in_provider: 'dbx_oidc'
+                                    }
+                                });
+                                result = {
+                                    uid: accessToken.accountId,
+                                    token: token,
+                                    rawToken: rawToken,
+                                    oidcValidatedToken: _object_spread$4({
                                         sub: accessToken.accountId,
-                                        iat: accessToken.iat,
-                                        exp: (_accessToken_exp = accessToken.exp) !== null && _accessToken_exp !== void 0 ? _accessToken_exp : unixDateTimeSecondsNumberForNow() + accessToken.expiration,
-                                        auth_time: accessToken.iat,
-                                        // Firebase UID (copied from sub)
-                                        uid: accessToken.accountId,
-                                        // OIDC-specific claims carried on the token
                                         scope: accessToken.scope,
-                                        client_id: accessToken.clientId,
-                                        // Firebase sign-in info — marked as OIDC provider
-                                        firebase: {
-                                            identities: {},
-                                            sign_in_provider: 'dbx_oidc'
-                                        }
-                                    });
-                                    result = {
-                                        uid: accessToken.accountId,
-                                        token: token,
-                                        rawToken: rawToken,
-                                        oidcValidatedToken: _object_spread$3({
-                                            sub: accessToken.accountId,
-                                            scope: accessToken.scope,
-                                            client_id: accessToken.clientId
-                                        }, accountClaims)
-                                    };
-                                }
+                                        client_id: accessToken.clientId
+                                    }, accountClaims)
+                                };
+                                return [
+                                    3,
+                                    5
+                                ];
+                            case 3:
+                                return [
+                                    4,
+                                    this._verifyJwtAccessToken(rawToken)
+                                ];
+                            case 4:
+                                result = _state.sent();
+                                _state.label = 5;
+                            case 5:
+                                return [
+                                    2,
+                                    result
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "_verifyJwtAccessToken",
+            value: /**
+     * Verifies a JWT-format access token issued by THIS provider for one of its registered resource
+     * servers, and builds the same {@link OidcAuthData} shape the opaque path produces.
+     *
+     * `sub` is the `accountId` oidc-provider stamped at issuance, which IS the Firebase uid (the
+     * opaque path reads the identical value off `accessToken.accountId`), so no mapping table is
+     * involved.
+     *
+     * @param rawToken - The raw token, which may not be a JWT at all.
+     * @returns The auth context, or `undefined` when the token is not a verifiable JWT from this provider.
+     */ function _verifyJwtAccessToken(rawToken) {
+                return _async_to_generator$6(function() {
+                    var result, verified, claims, scope, clientId, accountClaims, token, e;
+                    return _ts_generator$6(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                _state.trys.push([
+                                    0,
+                                    2,
+                                    ,
+                                    3
+                                ]);
+                                return [
+                                    4,
+                                    verifyBearerJwt(rawToken, {
+                                        profiles: this._getIssuerProfiles()
+                                    })
+                                ];
+                            case 1:
+                                verified = _state.sent();
+                                claims = verified.claims;
+                                scope = typeof claims['scope'] === 'string' ? claims['scope'] : undefined;
+                                clientId = typeof claims['client_id'] === 'string' ? claims['client_id'] : undefined;
+                                // Account claims baked into the token at issuance time via extraAccessTokenClaims, minus the
+                                // standard JWT + OAuth claims the shape below sets explicitly.
+                                accountClaims = filterReservedJwtAccessTokenClaims(_object_spread$4({}, claims));
+                                token = _object_spread_props(_object_spread$4(_object_spread_props(_object_spread$4({}, accountClaims), {
+                                    // `aud` is always present — jose rejected the token otherwise
+                                    aud: firstValue(claims.aud),
+                                    iss: this.config.issuer,
+                                    sub: verified.subject,
+                                    iat: claims.iat,
+                                    exp: claims.exp,
+                                    auth_time: claims.iat,
+                                    uid: verified.subject
+                                }), scope == null ? {} : {
+                                    scope: scope
+                                }, clientId == null ? {} : {
+                                    client_id: clientId
+                                }), {
+                                    firebase: {
+                                        identities: {},
+                                        sign_in_provider: 'dbx_oidc'
+                                    }
+                                });
+                                result = {
+                                    uid: verified.subject,
+                                    token: token,
+                                    rawToken: rawToken,
+                                    oidcValidatedToken: _object_spread$4({
+                                        sub: verified.subject,
+                                        scope: scope,
+                                        client_id: clientId
+                                    }, accountClaims)
+                                };
+                                return [
+                                    3,
+                                    3
+                                ];
+                            case 2:
+                                e = _state.sent();
+                                // Not a verifiable JWT from this provider — indistinguishable from an unknown opaque token,
+                                // so report it the same way and let the caller emit the 401.
+                                this._logger.debug("verifyAccessToken: token is neither a known opaque token nor a verifiable JWT (".concat(e.message, ")."));
+                                return [
+                                    3,
+                                    3
+                                ];
+                            case 3:
                                 return [
                                     2,
                                     result
@@ -4038,9 +4646,9 @@ var OidcService_1;
      * @param grantId - The grant id (and Grant adapter entry id) to revoke.
      * @throws {Error} When the Grant entry does not exist.
      */ function revokeGrant(grantId) {
-                return _async_to_generator$5(function() {
+                return _async_to_generator$6(function() {
                     var provider, ProviderGrant, existing;
-                    return _ts_generator$5(this, function(_state) {
+                    return _ts_generator$6(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -4091,9 +4699,9 @@ var OidcService_1;
      * @param clientId - The client's document/adapter entry ID.
      * @returns The client payload data, or `undefined` if not found.
      */ function findClientPayload(clientId) {
-                return _async_to_generator$5(function() {
+                return _async_to_generator$6(function() {
                     var provider, ProviderClient, existing, result;
-                    return _ts_generator$5(this, function(_state) {
+                    return _ts_generator$6(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
@@ -4162,10 +4770,10 @@ var OidcService_1;
                         defaultSeconds: overrideDefaultSeconds !== null && overrideDefaultSeconds !== void 0 ? overrideDefaultSeconds : perModelDefaultSeconds
                     });
                 };
-                return _object_spread_props(_object_spread$3({
-                    routes: _object_spread$3({}, this.providerConfigService.routes),
-                    claims: _object_spread$3({}, providerConfig.claims),
-                    responseTypes: _to_consumable_array$4(providerConfig.responseTypes),
+                return _object_spread_props(_object_spread$4({
+                    routes: _object_spread$4({}, this.providerConfigService.routes),
+                    claims: _object_spread$4({}, providerConfig.claims),
+                    responseTypes: _to_consumable_array$6(providerConfig.responseTypes),
                     pkce: {
                         required: function required() {
                             return true;
@@ -4197,16 +4805,16 @@ var OidcService_1;
                                 return true;
                             },
                             getResourceServerInfo: function getResourceServerInfo(_ctx, resourceIndicator) {
-                                return _async_to_generator$5(function() {
+                                return _async_to_generator$6(function() {
                                     var _config_resourceServers, info;
-                                    return _ts_generator$5(this, function(_state) {
+                                    return _ts_generator$6(this, function(_state) {
                                         info = (_config_resourceServers = config.resourceServers) === null || _config_resourceServers === void 0 ? void 0 : _config_resourceServers[resourceIndicator];
                                         if (!info) {
                                             throw new errors.InvalidTarget("Unrecognized resource indicator: ".concat(resourceIndicator));
                                         }
                                         return [
                                             2,
-                                            _object_spread$3({
+                                            _object_spread$4({
                                                 scope: info.scope
                                             }, info.audience === undefined ? {} : {
                                                 audience: info.audience
@@ -4283,9 +4891,9 @@ var OidcService_1;
                     },
                     interactions: {
                         url: function url(_ctx, interaction) {
-                            return _async_to_generator$5(function() {
+                            return _async_to_generator$6(function() {
                                 var baseUrl, client_id, paramsToEncode, client, _client_dbx_provider_profiles, requestedScopes, isAdmin, adminOnlyScopes, offeredScopes, scopes, requestedScopeSet, required, requiredScopes, interactionLoginDetails, paramsString;
-                                return _ts_generator$5(this, function(_state) {
+                                return _ts_generator$6(this, function(_state) {
                                     switch(_state.label){
                                         case 0:
                                             client_id = interaction.params['client_id'];
@@ -4334,7 +4942,7 @@ var OidcService_1;
                                             requiredScopes = Array.from(required).filter(function(scope) {
                                                 return requestedScopeSet.has(scope);
                                             });
-                                            interactionLoginDetails = _object_spread$3({
+                                            interactionLoginDetails = _object_spread$4({
                                                 client_id: client_id,
                                                 client_name: client.client_name,
                                                 client_uri: client.client_uri,
@@ -4343,7 +4951,7 @@ var OidcService_1;
                                             }, requiredScopes.length > 0 ? {
                                                 requiredScopes: requiredScopes.join(' ')
                                             } : {});
-                                            paramsToEncode = _object_spread$3({}, paramsToEncode, interactionLoginDetails);
+                                            paramsToEncode = _object_spread$4({}, paramsToEncode, interactionLoginDetails);
                                             _state.label = 4;
                                         case 4:
                                             paramsString = makeUrlSearchParamsString(paramsToEncode, {
@@ -4398,9 +5006,9 @@ var OidcService_1;
                     // Bake account claims into the access token at issuance time so they're
                     // available via `accessToken.extra` during verification without an extra DB call.
                     extraTokenClaims: function extraTokenClaims(_ctx, token) {
-                        return _async_to_generator$5(function() {
+                        return _async_to_generator$6(function() {
                             var accountId, scope, result, account, claims, extraClaims, _providerConfig_nonRotatingScopes, nonRotatingScopes, scopeSet, provider, grant;
-                            return _ts_generator$5(this, function(_state) {
+                            return _ts_generator$6(this, function(_state) {
                                 switch(_state.label){
                                     case 0:
                                         accountId = token.accountId;
@@ -4479,9 +5087,9 @@ var OidcService_1;
             key: "_buildProvider",
             value: // MARK: Internal
             function _buildProvider() {
-                return _async_to_generator$5(function() {
+                return _async_to_generator$6(function() {
                     var _this, _config_trustProxy, config, findAccount, signingKey, result, getEncryptionKey, cookieKey, adapterFactory, providerConfiguration, _ref, ProviderClass, interactionPolicy, provider;
-                    return _ts_generator$5(this, function(_state) {
+                    return _ts_generator$6(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 _this = this;
@@ -4522,11 +5130,11 @@ var OidcService_1;
                                 ];
                             case 4:
                                 _ref = _state.sent(), ProviderClass = _ref.default, interactionPolicy = _ref.interactionPolicy;
-                                provider = new ProviderClass(config.issuer, _object_spread_props(_object_spread$3({}, providerConfiguration), {
+                                provider = new ProviderClass(config.issuer, _object_spread_props(_object_spread$4({}, providerConfiguration), {
                                     // The policy is applied here rather than in buildProviderConfiguration() because it needs the
                                     // `interactionPolicy` namespace off the dynamic (ESM-only) import, which that sync method has no
                                     // access to. Spread the configured `interactions` so its `url` builder survives.
-                                    interactions: _object_spread_props(_object_spread$3({}, providerConfiguration.interactions), {
+                                    interactions: _object_spread_props(_object_spread$4({}, providerConfiguration.interactions), {
                                         policy: buildOidcInteractionPolicy(interactionPolicy)
                                     }),
                                     adapter: adapterFactory,
@@ -4567,9 +5175,9 @@ var OidcService_1;
      * @param interaction - The interaction whose session account should be checked.
      * @returns True when the interaction's account resolves to an admin user.
      */ function _isAdminInteractionUser(interaction) {
-                return _async_to_generator$5(function() {
+                return _async_to_generator$6(function() {
                     var _ref, _interaction_session, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, accountId;
-                    return _ts_generator$5(this, function(_state) {
+                    return _ts_generator$6(this, function(_state) {
                         accountId = (_interaction_session = interaction.session) === null || _interaction_session === void 0 ? void 0 : _interaction_session.accountId;
                         return [
                             2,
@@ -4622,10 +5230,10 @@ OidcService = OidcService_1 = __decorate([
     __param(5, Inject(OidcEncryptionService))
 ], OidcService);
 
-function _class_call_check$7(instance, Constructor) {
+function _class_call_check$8(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
-function _define_property$7(obj, key, value) {
+function _define_property$8(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4661,14 +5269,14 @@ function _define_property$7(obj, key, value) {
  * export class MyApiModule {}
  * ```
  */ var OidcAuthMiddlewareConfig = function OidcAuthMiddlewareConfig() {
-    _class_call_check$7(this, OidcAuthMiddlewareConfig);
+    _class_call_check$8(this, OidcAuthMiddlewareConfig);
     /**
      * Path prefixes that require OAuth bearer token verification.
      *
      * Only requests matching one of these prefixes will be checked.
      * Paths under the global API route prefix should not be included
      * since those are protected by AppCheck.
-     */ _define_property$7(this, "protectedPaths", void 0);
+     */ _define_property$8(this, "protectedPaths", void 0);
     /**
      * Absolute URL of the OAuth 2.0 Protected Resource Metadata document
      * (RFC 9728). When set, included as the `resource_metadata` parameter
@@ -4676,7 +5284,7 @@ function _define_property$7(obj, key, value) {
      * clients can locate the discovery doc explicitly rather than relying on
      * origin-rooted path-walkback (which fails when the function isn't
      * mounted at `/` — e.g. behind the Firebase Functions emulator URL prefix).
-     */ _define_property$7(this, "resourceMetadataUrl", void 0);
+     */ _define_property$8(this, "resourceMetadataUrl", void 0);
 };
 // MARK: WWW-Authenticate
 /**
@@ -4688,16 +5296,17 @@ function _define_property$7(obj, key, value) {
  * included as the RFC 9728 `resource_metadata` hint so clients can locate the
  * discovery doc directly instead of relying on origin-rooted path-walkback.
  *
+ * Delegates to `@dereekb/oauth-resource`'s builder so the challenge an off-box resource server
+ * emits and the one this API emits are produced by the same code.
+ *
  * @param error - The RFC 6750 `error` token (e.g. `invalid_token`, `invalid_request`).
  * @param resourceMetadataUrl - Optional protected-resource metadata URL.
  * @returns Header value, e.g. `Bearer resource_metadata="…", error="invalid_token"`.
  */ function buildBearerChallenge(error, resourceMetadataUrl) {
-    var params = [];
-    if (resourceMetadataUrl) {
-        params.push('resource_metadata="'.concat(resourceMetadataUrl, '"'));
-    }
-    params.push('error="'.concat(error, '"'));
-    return "Bearer ".concat(params.join(', '));
+    return buildBearerChallenge$1({
+        error: error,
+        resourceMetadataUrl: resourceMetadataUrl
+    });
 }
 // MARK: Module
 var _logger = new Logger('applyOidcAuthMiddleware');
@@ -4787,7 +5396,7 @@ var _logger = new Logger('applyOidcAuthMiddleware');
     _logger.debug("Applied OAuth bearer token middleware for paths: ".concat(protectedPaths.join(', ')));
 }
 
-function asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4798,25 +5407,25 @@ function asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$4(fn) {
+function _async_to_generator$5(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _class_call_check$6(instance, Constructor) {
+function _class_call_check$7(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
-function _defineProperties$5(target, props) {
+function _defineProperties$6(target, props) {
     for(var i = 0; i < props.length; i++){
         var descriptor = props[i];
         descriptor.enumerable = descriptor.enumerable || false;
@@ -4825,11 +5434,11 @@ function _defineProperties$5(target, props) {
         Object.defineProperty(target, descriptor.key, descriptor);
     }
 }
-function _create_class$5(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties$5(Constructor.prototype, protoProps);
+function _create_class$6(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$6(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$6(obj, key, value) {
+function _define_property$7(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4846,7 +5455,7 @@ function _instanceof$1(left, right) {
         return !!right[Symbol.hasInstance](left);
     } else return left instanceof right;
 }
-function _ts_generator$4(thisArg, body) {
+function _ts_generator$5(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4975,20 +5584,20 @@ function _ts_generator$4(thisArg, body) {
  * @throws {UnauthorizedException} When the Authorization header is missing, malformed, or the token is invalid/expired.
  */ var OidcAuthBearerTokenMiddleware = /*#__PURE__*/ function() {
     function OidcAuthBearerTokenMiddleware(oidcService, config) {
-        _class_call_check$6(this, OidcAuthBearerTokenMiddleware);
-        _define_property$6(this, "oidcService", void 0);
-        _define_property$6(this, "config", void 0);
-        _define_property$6(this, "logger", new Logger('OidcAuthBearerTokenMiddleware'));
+        _class_call_check$7(this, OidcAuthBearerTokenMiddleware);
+        _define_property$7(this, "oidcService", void 0);
+        _define_property$7(this, "config", void 0);
+        _define_property$7(this, "logger", new Logger('OidcAuthBearerTokenMiddleware'));
         this.oidcService = oidcService;
         this.config = config;
     }
-    _create_class$5(OidcAuthBearerTokenMiddleware, [
+    _create_class$6(OidcAuthBearerTokenMiddleware, [
         {
             key: "use",
             value: function use(req, res, next) {
-                return _async_to_generator$4(function() {
+                return _async_to_generator$5(function() {
                     var authHeader, token, oauthAuth, err;
-                    return _ts_generator$4(this, function(_state) {
+                    return _ts_generator$5(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 authHeader = req.headers.authorization;
@@ -5054,32 +5663,32 @@ OidcAuthBearerTokenMiddleware = __decorate([
     __param(1, Inject(OidcAuthMiddlewareConfig))
 ], OidcAuthBearerTokenMiddleware);
 
-function _array_like_to_array$3(arr, len) {
+function _array_like_to_array$5(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$3(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
 }
-function _iterable_to_array$3(iter) {
+function _iterable_to_array$5(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$3() {
+function _non_iterable_spread$5() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$3(arr) {
-    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$3();
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
 }
-function _unsupported_iterable_to_array$3(o, minLen) {
+function _unsupported_iterable_to_array$5(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
 }
 /**
  * Builds the `cors`-package origin delegate implementing the composed OIDC CORS policy.
@@ -5102,7 +5711,7 @@ function _unsupported_iterable_to_array$3(o, minLen) {
     var clientBased = cors.clientBased === true;
     var allowlist = new Set([
         appUrl
-    ].concat(_to_consumable_array$3((_cors_allowOrigins = cors.allowOrigins) !== null && _cors_allowOrigins !== void 0 ? _cors_allowOrigins : [])));
+    ].concat(_to_consumable_array$5((_cors_allowOrigins = cors.allowOrigins) !== null && _cors_allowOrigins !== void 0 ? _cors_allowOrigins : [])));
     return function(requestOrigin, callback) {
         var resolved;
         if (requestOrigin && allowlist.has(requestOrigin)) {
@@ -5214,7 +5823,7 @@ function _unsupported_iterable_to_array$3(o, minLen) {
  * ```
  */ var FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG = 'FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG';
 
-function _class_call_check$5(instance, Constructor) {
+function _class_call_check$6(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
 }
 /**
@@ -5223,7 +5832,7 @@ function _class_call_check$5(instance, Constructor) {
  * Analogous to the MCP `McpAnalyticsService` but scoped to the OIDC/OAuth transport.
  * Apps extend this class and provide it via {@link OIDC_ANALYTICS_SERVICE}.
  */ var OidcAnalyticsService = function OidcAnalyticsService() {
-    _class_call_check$5(this, OidcAnalyticsService);
+    _class_call_check$6(this, OidcAnalyticsService);
 };
 /**
  * Injection token for the OIDC analytics service.
@@ -5269,9 +5878,280 @@ function _assert_this_initialized(self) {
     if (self === void 0) throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
     return self;
 }
-function _call_super(_this, derived, args) {
-    derived = _get_prototype_of(derived);
-    return _possible_constructor_return(_this, _is_native_reflect_construct() ? Reflect.construct(derived, [], _get_prototype_of(_this).constructor) : derived.apply(_this, args));
+function _call_super(_this, derived, args) {
+    derived = _get_prototype_of(derived);
+    return _possible_constructor_return(_this, _is_native_reflect_construct() ? Reflect.construct(derived, [], _get_prototype_of(_this).constructor) : derived.apply(_this, args));
+}
+function _class_call_check$5(instance, Constructor) {
+    if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
+}
+function _defineProperties$5(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class$5(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties$5(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$6(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _get_prototype_of(o) {
+    _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
+        return o.__proto__ || Object.getPrototypeOf(o);
+    };
+    return _get_prototype_of(o);
+}
+function _inherits(subClass, superClass) {
+    if (typeof superClass !== "function" && superClass !== null) {
+        throw new TypeError("Super expression must either be null or a function");
+    }
+    subClass.prototype = Object.create(superClass && superClass.prototype, {
+        constructor: {
+            value: subClass,
+            writable: true,
+            configurable: true
+        }
+    });
+    if (superClass) _set_prototype_of(subClass, superClass);
+}
+function _is_native_reflect_construct() {
+    try {
+        var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {}));
+    } catch (_) {}
+    return (_is_native_reflect_construct = function() {
+        return !!result;
+    })();
+}
+function _object_spread$3(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$6(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function _possible_constructor_return(self, call) {
+    if (call && (_type_of$1(call) === "object" || typeof call === "function")) return call;
+    return _assert_this_initialized(self);
+}
+function _set_prototype_of(o, p) {
+    _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o, p) {
+        o.__proto__ = p;
+        return o;
+    };
+    return _set_prototype_of(o, p);
+}
+function _type_of$1(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+var FirebaseServerOidcAnalyticsService_1;
+/**
+ * Reusable {@link OidcAnalyticsService} that forwards each high-level OIDC event to the app's
+ * {@link FirebaseServerAnalyticsService}, so OIDC-transport analytics feed the same downstream
+ * pipeline (e.g. Segment) as model and MCP analytics.
+ *
+ * Each {@link OidcAnalyticsEvent.type} resolves to a distinct downstream event name
+ * (`eventNamePrefix` + per-type name, e.g. `'OIDC Login'`). Registered globally via
+ * {@link appOidcAnalyticsModuleMetadata}; tuned via {@link FirebaseServerOidcAnalyticsConfig}.
+ * When no analytics service is available the call is a no-op aside from the optional log line.
+ */ var FirebaseServerOidcAnalyticsService = FirebaseServerOidcAnalyticsService_1 = /*#__PURE__*/ function(OidcAnalyticsService) {
+    _inherits(FirebaseServerOidcAnalyticsService, OidcAnalyticsService);
+    function FirebaseServerOidcAnalyticsService(firebaseServerEnvService, analyticsService, config) {
+        _class_call_check$5(this, FirebaseServerOidcAnalyticsService);
+        var _this;
+        var _ref, _ref1;
+        _this = _call_super(this, FirebaseServerOidcAnalyticsService), _define_property$6(_this, "firebaseServerEnvService", void 0), _define_property$6(_this, "analyticsService", void 0), _define_property$6(_this, "_logger", new Logger(FirebaseServerOidcAnalyticsService_1.name)), _define_property$6(_this, "_eventNamePrefix", void 0), _define_property$6(_this, "_eventNames", void 0), _define_property$6(_this, "_logEvents", void 0);
+        _this.firebaseServerEnvService = firebaseServerEnvService;
+        _this.analyticsService = analyticsService;
+        _this._eventNamePrefix = (_ref = config === null || config === void 0 ? void 0 : config.eventNamePrefix) !== null && _ref !== void 0 ? _ref : DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX;
+        _this._eventNames = _object_spread$3({}, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, config === null || config === void 0 ? void 0 : config.eventNames);
+        _this._logEvents = (_ref1 = config === null || config === void 0 ? void 0 : config.logEvents) !== null && _ref1 !== void 0 ? _ref1 : !_this.firebaseServerEnvService.isProduction;
+        return _this;
+    }
+    _create_class$5(FirebaseServerOidcAnalyticsService, [
+        {
+            key: "handleOidcAnalyticsEvent",
+            value: function handleOidcAnalyticsEvent(event) {
+                var _this__eventNames_event_type;
+                var name = "".concat(this._eventNamePrefix).concat((_this__eventNames_event_type = this._eventNames[event.type]) !== null && _this__eventNames_event_type !== void 0 ? _this__eventNames_event_type : event.type);
+                if (this._logEvents) {
+                    var uidSuffix = event.uid ? " uid=".concat(event.uid) : '';
+                    var durationSuffix = event.durationMs == null ? '' : " (".concat(event.durationMs, "ms)");
+                    var outcome = event.isSuccessful ? 'Succeeded' : 'Failed';
+                    var reasonSuffix = event.reason ? " reason=".concat(event.reason) : '';
+                    this._logger.log("".concat(name, " ").concat(outcome).concat(uidSuffix).concat(reasonSuffix).concat(durationSuffix));
+                }
+                if (this.analyticsService != null) {
+                    var _event_clientId, _event_serviceToken, _event_isAdmin, _event_denied, _event_reason;
+                    // Drop undefined values so the downstream payload stays clean.
+                    var data = filterUndefinedValues({
+                        clientId: (_event_clientId = event.clientId) !== null && _event_clientId !== void 0 ? _event_clientId : undefined,
+                        scopes: event.scopes != null && event.scopes.length > 0 ? event.scopes.join(' ') : undefined,
+                        serviceToken: (_event_serviceToken = event.serviceToken) !== null && _event_serviceToken !== void 0 ? _event_serviceToken : undefined,
+                        isAdmin: (_event_isAdmin = event.isAdmin) !== null && _event_isAdmin !== void 0 ? _event_isAdmin : undefined,
+                        denied: (_event_denied = event.denied) !== null && _event_denied !== void 0 ? _event_denied : undefined,
+                        reason: (_event_reason = event.reason) !== null && _event_reason !== void 0 ? _event_reason : undefined,
+                        success: event.isSuccessful
+                    });
+                    this.analyticsService.sendEventData(event.uid, name, data);
+                }
+            }
+        }
+    ]);
+    return FirebaseServerOidcAnalyticsService;
+}(OidcAnalyticsService);
+FirebaseServerOidcAnalyticsService = FirebaseServerOidcAnalyticsService_1 = __decorate([
+    Injectable(),
+    __param(0, Inject(FirebaseServerEnvService)),
+    __param(1, Optional()),
+    __param(1, Inject(FirebaseServerAnalyticsService)),
+    __param(2, Optional()),
+    __param(2, Inject(FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG))
+], FirebaseServerOidcAnalyticsService);
+
+function _array_like_to_array$4(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$4(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
+}
+function _iterable_to_array$4(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
+        return Array.from(iter);
+    }
+}
+function _non_iterable_spread$4() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array$4(arr) {
+    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$4();
+}
+function _unsupported_iterable_to_array$4(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
+}
+/**
+ * Generates NestJS module metadata that registers {@link FirebaseServerOidcAnalyticsService} as the
+ * OIDC analytics consumer, aliased to {@link OIDC_ANALYTICS_SERVICE}.
+ *
+ * Mirrors the convention used by `appMcpAnalyticsModuleMetadata`. Requires no dependency module —
+ * `FirebaseServerAnalyticsService` is resolved optionally and is expected to be supplied globally by
+ * the app's analytics module.
+ *
+ * Decorate a `@Global()` module with the result so the `OIDC_ANALYTICS_SERVICE` token is visible to
+ * the OIDC controllers and services provided by the app's OIDC module.
+ *
+ * @param config - Optional metadata + analytics config to merge in.
+ * @returns NestJS module metadata providing + exporting the OIDC analytics service and token.
+ *
+ * @example
+ * ```typescript
+ * @Global()
+ * @Module(appOidcAnalyticsModuleMetadata())
+ * export class AppOidcAnalyticsModule {}
+ * ```
+ */ function appOidcAnalyticsModuleMetadata() {
+    var config = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
+    var oidcAnalyticsConfig = config.oidcAnalyticsConfig, imports = config.imports, exports = config.exports, providers = config.providers;
+    var configProviders = oidcAnalyticsConfig ? [
+        {
+            provide: FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG,
+            useValue: oidcAnalyticsConfig
+        }
+    ] : [];
+    return {
+        imports: _to_consumable_array$4(imports !== null && imports !== void 0 ? imports : []),
+        exports: [
+            OIDC_ANALYTICS_SERVICE,
+            FirebaseServerOidcAnalyticsService
+        ].concat(_to_consumable_array$4(exports !== null && exports !== void 0 ? exports : [])),
+        providers: [
+            FirebaseServerOidcAnalyticsService,
+            {
+                provide: OIDC_ANALYTICS_SERVICE,
+                useExisting: FirebaseServerOidcAnalyticsService
+            }
+        ].concat(_to_consumable_array$4(configProviders), _to_consumable_array$4(providers !== null && providers !== void 0 ? providers : []))
+    };
+}
+
+// MARK: Scopes
+/**
+ * Reads the set of OIDC scopes carried by a callable request's bearer token.
+ *
+ * The `ModelApiCallModelDispatchService` builds a synthetic `CallableRequest` with
+ * `auth.token = oidcValidatedToken ?? {}`, so the OIDC scope string lives at
+ * `request.auth.token.scope` for OIDC callers and is `undefined` for non-OIDC
+ * (regular Firebase ID-token) callers.
+ *
+ * Returning `undefined` for non-OIDC callers lets consumers (e.g. the MCP tool-visibility filter)
+ * skip scope enforcement instead of falsely treating the missing claim as "no scopes granted".
+ *
+ * The parameter is intentionally typed as `unknown` because `DecodedIdToken` (Firebase
+ * Auth's typed token shape) does not declare a `scope` field, while OIDC bearer-token
+ * callers attach one at runtime. Reading is done defensively.
+ *
+ * @param request - The callable request as seen inside an `onCallModel` handler.
+ * @returns A `Set<string>` of granted scopes, or `undefined` when the request carries no OIDC `scope` claim.
+ */ function getOidcScopesFromRequest(request) {
+    var _request_auth_token, _request_auth;
+    var scope = request === null || request === void 0 ? void 0 : (_request_auth = request.auth) === null || _request_auth === void 0 ? void 0 : (_request_auth_token = _request_auth.token) === null || _request_auth_token === void 0 ? void 0 : _request_auth_token.scope;
+    return oidcScopesFromScopeClaim(scope);
+}
+
+function asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
+}
+function _async_to_generator$4(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
 }
 function _class_call_check$4(instance, Constructor) {
     if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
@@ -5300,33 +6180,6 @@ function _define_property$5(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _get_prototype_of(o) {
-    _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
-        return o.__proto__ || Object.getPrototypeOf(o);
-    };
-    return _get_prototype_of(o);
-}
-function _inherits(subClass, superClass) {
-    if (typeof superClass !== "function" && superClass !== null) {
-        throw new TypeError("Super expression must either be null or a function");
-    }
-    subClass.prototype = Object.create(superClass && superClass.prototype, {
-        constructor: {
-            value: subClass,
-            writable: true,
-            configurable: true
-        }
-    });
-    if (superClass) _set_prototype_of(subClass, superClass);
-}
-function _is_native_reflect_construct() {
-    try {
-        var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {}));
-    } catch (_) {}
-    return (_is_native_reflect_construct = function() {
-        return !!result;
-    })();
-}
 function _object_spread$2(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
@@ -5342,182 +6195,519 @@ function _object_spread$2(target) {
     }
     return target;
 }
-function _possible_constructor_return(self, call) {
-    if (call && (_type_of(call) === "object" || typeof call === "function")) return call;
-    return _assert_this_initialized(self);
-}
-function _set_prototype_of(o, p) {
-    _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o, p) {
-        o.__proto__ = p;
-        return o;
-    };
-    return _set_prototype_of(o, p);
-}
-function _type_of(obj) {
-    "@swc/helpers - typeof";
-    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+function _ts_generator$4(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
 }
-var FirebaseServerOidcAnalyticsService_1;
+// MARK: Service
 /**
- * Reusable {@link OidcAnalyticsService} that forwards each high-level OIDC event to the app's
- * {@link FirebaseServerAnalyticsService}, so OIDC-transport analytics feed the same downstream
- * pipeline (e.g. Segment) as model and MCP analytics.
- *
- * Each {@link OidcAnalyticsEvent.type} resolves to a distinct downstream event name
- * (`eventNamePrefix` + per-type name, e.g. `'OIDC Login'`). Registered globally via
- * {@link appOidcAnalyticsModuleMetadata}; tuned via {@link FirebaseServerOidcAnalyticsConfig}.
- * When no analytics service is available the call is a no-op aside from the optional log line.
- */ var FirebaseServerOidcAnalyticsService = FirebaseServerOidcAnalyticsService_1 = /*#__PURE__*/ function(OidcAnalyticsService) {
-    _inherits(FirebaseServerOidcAnalyticsService, OidcAnalyticsService);
-    function FirebaseServerOidcAnalyticsService(firebaseServerEnvService, analyticsService, config) {
-        _class_call_check$4(this, FirebaseServerOidcAnalyticsService);
-        var _this;
-        var _ref, _ref1;
-        _this = _call_super(this, FirebaseServerOidcAnalyticsService), _define_property$5(_this, "firebaseServerEnvService", void 0), _define_property$5(_this, "analyticsService", void 0), _define_property$5(_this, "_logger", new Logger(FirebaseServerOidcAnalyticsService_1.name)), _define_property$5(_this, "_eventNamePrefix", void 0), _define_property$5(_this, "_eventNames", void 0), _define_property$5(_this, "_logEvents", void 0);
-        _this.firebaseServerEnvService = firebaseServerEnvService;
-        _this.analyticsService = analyticsService;
-        _this._eventNamePrefix = (_ref = config === null || config === void 0 ? void 0 : config.eventNamePrefix) !== null && _ref !== void 0 ? _ref : DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX;
-        _this._eventNames = _object_spread$2({}, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, config === null || config === void 0 ? void 0 : config.eventNames);
-        _this._logEvents = (_ref1 = config === null || config === void 0 ? void 0 : config.logEvents) !== null && _ref1 !== void 0 ? _ref1 : !_this.firebaseServerEnvService.isProduction;
-        return _this;
+ * Service for handling OIDC interactions.
+ */ var OidcInteractionService = /*#__PURE__*/ function() {
+    function OidcInteractionService(oidcService, clientService) {
+        _class_call_check$4(this, OidcInteractionService);
+        _define_property$5(this, "oidcService", void 0);
+        _define_property$5(this, "clientService", void 0);
+        this.oidcService = oidcService;
+        this.clientService = clientService;
     }
-    _create_class$4(FirebaseServerOidcAnalyticsService, [
+    _create_class$4(OidcInteractionService, [
+        {
+            key: "getInteractionDetails",
+            value: /**
+     * Loads the interaction details for a given request/response pair.
+     *
+     * Requires the oidc-provider interaction cookie to be present on the request.
+     *
+     * @param req - The Express request containing the interaction cookie.
+     * @param res - The Express response.
+     * @returns The oidc-provider interaction details.
+     */ function getInteractionDetails(req, res) {
+                return _async_to_generator$4(function() {
+                    var provider;
+                    return _ts_generator$4(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    this.oidcService.getProvider()
+                                ];
+                            case 1:
+                                provider = _state.sent();
+                                return [
+                                    2,
+                                    provider.interactionDetails(req, res)
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "findInteractionByUid",
+            value: /**
+     * Finds an interaction by its UID directly from the adapter store.
+     *
+     * Bypasses the cookie-based lookup used by `provider.interactionDetails()`.
+     * This is necessary when the interaction cookie is scoped to a different path
+     * (e.g., the frontend) and is not sent with backend API requests.
+     *
+     * @param uid - The interaction UID to look up.
+     * @returns The interaction details for the given UID.
+     * @throws {Error} When the interaction is not found or has expired.
+     */ function findInteractionByUid(uid) {
+                return _async_to_generator$4(function() {
+                    var provider, interaction;
+                    return _ts_generator$4(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    this.oidcService.getProvider()
+                                ];
+                            case 1:
+                                provider = _state.sent();
+                                return [
+                                    4,
+                                    provider.Interaction.find(uid)
+                                ];
+                            case 2:
+                                interaction = _state.sent();
+                                if (!interaction) {
+                                    throw new Error('Interaction not found');
+                                }
+                                return [
+                                    2,
+                                    interaction
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
         {
-            key: "handleOidcAnalyticsEvent",
-            value: function handleOidcAnalyticsEvent(event) {
-                var _this__eventNames_event_type;
-                var name = "".concat(this._eventNamePrefix).concat((_this__eventNames_event_type = this._eventNames[event.type]) !== null && _this__eventNames_event_type !== void 0 ? _this__eventNames_event_type : event.type);
-                if (this._logEvents) {
-                    var uidSuffix = event.uid ? " uid=".concat(event.uid) : '';
-                    var durationSuffix = event.durationMs == null ? '' : " (".concat(event.durationMs, "ms)");
-                    var outcome = event.isSuccessful ? 'Succeeded' : 'Failed';
-                    var reasonSuffix = event.reason ? " reason=".concat(event.reason) : '';
-                    this._logger.log("".concat(name, " ").concat(outcome).concat(uidSuffix).concat(reasonSuffix).concat(durationSuffix));
-                }
-                if (this.analyticsService != null) {
-                    var _event_clientId, _event_serviceToken, _event_isAdmin, _event_denied, _event_reason;
-                    // Drop undefined values so the downstream payload stays clean.
-                    var data = filterUndefinedValues({
-                        clientId: (_event_clientId = event.clientId) !== null && _event_clientId !== void 0 ? _event_clientId : undefined,
-                        scopes: event.scopes != null && event.scopes.length > 0 ? event.scopes.join(' ') : undefined,
-                        serviceToken: (_event_serviceToken = event.serviceToken) !== null && _event_serviceToken !== void 0 ? _event_serviceToken : undefined,
-                        isAdmin: (_event_isAdmin = event.isAdmin) !== null && _event_isAdmin !== void 0 ? _event_isAdmin : undefined,
-                        denied: (_event_denied = event.denied) !== null && _event_denied !== void 0 ? _event_denied : undefined,
-                        reason: (_event_reason = event.reason) !== null && _event_reason !== void 0 ? _event_reason : undefined,
-                        success: event.isSuccessful
+            key: "finishInteractionByUid",
+            value: /**
+     * Completes an interaction by UID without requiring the interaction cookie.
+     *
+     * Looks up the interaction directly by UID, applies the result, saves it,
+     * and returns the `returnTo` URL for the client to redirect to.
+     *
+     * @param uid - The interaction UID to complete.
+     * @param result - The interaction results to apply.
+     * @param options - Optional settings for merging with the last submission.
+     * @param options.mergeWithLastSubmission - Whether to merge with the last submission (defaults to true)
+     * @returns The interaction that was completed. It includes the returnTo property for the next step of the interaction.
+     */ function finishInteractionByUid(uid, result, options) {
+                return _async_to_generator$4(function() {
+                    var _ref, interaction, mergeWithLastSubmission;
+                    return _ts_generator$4(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    this.findInteractionByUid(uid)
+                                ];
+                            case 1:
+                                interaction = _state.sent();
+                                mergeWithLastSubmission = (_ref = options === null || options === void 0 ? void 0 : options.mergeWithLastSubmission) !== null && _ref !== void 0 ? _ref : true;
+                                if (mergeWithLastSubmission && !('error' in result)) {
+                                    interaction.result = _object_spread$2({}, interaction.lastSubmission, result);
+                                } else {
+                                    interaction.result = result;
+                                }
+                                return [
+                                    4,
+                                    interaction.save(interaction.exp - unixDateTimeSecondsNumberForNow())
+                                ];
+                            case 2:
+                                _state.sent();
+                                return [
+                                    2,
+                                    interaction
+                                ];
+                        }
                     });
-                    this.analyticsService.sendEventData(event.uid, name, data);
-                }
+                }).call(this);
+            }
+        },
+        {
+            key: "findOrCreateGrant",
+            value: /**
+     * Finds an existing grant by ID, or creates a new one.
+     *
+     * For new grants, optionally pre-set `expiresIn` so {@link Grant#save} writes the requested TTL
+     * instead of falling through to the configured Grant TTL function (which cannot read the original
+     * `dbx_session_ttl` request param when save is driven from a NestJS controller — see
+     * {@link OidcService#resolveLoginDurationForGrant}).
+     *
+     * @param grantId - The existing grant ID to look up, or undefined to create a new grant.
+     * @param accountId - The account ID for creating a new grant.
+     * @param clientId - The client ID for creating a new grant.
+     * @param expiresInSeconds - Optional TTL (seconds) to assign to a newly-created grant.
+     * @returns The found or newly created grant.
+     */ // eslint-disable-next-line @typescript-eslint/max-params -- positional args mirror the existing call sites
+            function findOrCreateGrant(grantId, accountId, clientId, expiresInSeconds) {
+                return _async_to_generator$4(function() {
+                    var provider, grant, found, grantInit;
+                    return _ts_generator$4(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    this.oidcService.getProvider()
+                                ];
+                            case 1:
+                                provider = _state.sent();
+                                if (!grantId) return [
+                                    3,
+                                    3
+                                ];
+                                return [
+                                    4,
+                                    provider.Grant.find(grantId)
+                                ];
+                            case 2:
+                                found = _state.sent();
+                                if (!found) {
+                                    throw new Error("Grant not found for grantId: ".concat(grantId));
+                                }
+                                grant = found;
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 3:
+                                grantInit = {
+                                    accountId: accountId,
+                                    clientId: clientId
+                                };
+                                if (expiresInSeconds != null) {
+                                    grantInit.expiresIn = expiresInSeconds;
+                                }
+                                grant = new provider.Grant(grantInit);
+                                _state.label = 4;
+                            case 4:
+                                return [
+                                    2,
+                                    grant
+                                ];
+                        }
+                    });
+                }).call(this);
             }
         }
     ]);
-    return FirebaseServerOidcAnalyticsService;
-}(OidcAnalyticsService);
-FirebaseServerOidcAnalyticsService = FirebaseServerOidcAnalyticsService_1 = __decorate([
+    return OidcInteractionService;
+}();
+OidcInteractionService = __decorate([
     Injectable(),
-    __param(0, Inject(FirebaseServerEnvService)),
-    __param(1, Optional()),
-    __param(1, Inject(FirebaseServerAnalyticsService)),
-    __param(2, Optional()),
-    __param(2, Inject(FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG))
-], FirebaseServerOidcAnalyticsService);
+    __param(0, Inject(OidcService)),
+    __param(1, Inject(OidcClientService))
+], OidcInteractionService);
 
-function _array_like_to_array$2(arr, len) {
+function _array_like_to_array$3(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$2(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
+function _array_without_holes$3(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
 }
-function _iterable_to_array$2(iter) {
+function _iterable_to_array$3(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
     }
 }
-function _non_iterable_spread$2() {
+function _non_iterable_spread$3() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$2(arr) {
-    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$2();
+function _to_consumable_array$3(arr) {
+    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$3();
 }
-function _unsupported_iterable_to_array$2(o, minLen) {
+function _type_of(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+function _unsupported_iterable_to_array$3(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
 }
 /**
- * Generates NestJS module metadata that registers {@link FirebaseServerOidcAnalyticsService} as the
- * OIDC analytics consumer, aliased to {@link OIDC_ANALYTICS_SERVICE}.
+ * Splits a space-delimited scope string into its non-empty entries.
  *
- * Mirrors the convention used by `appMcpAnalyticsModuleMetadata`. Requires no dependency module —
- * `FirebaseServerAnalyticsService` is resolved optionally and is expected to be supplied globally by
- * the app's analytics module.
+ * @param scope - The space-delimited scope string.
+ * @returns The scope entries.
+ */ function splitScope(scope) {
+    return (scope !== null && scope !== void 0 ? scope : '').split(' ').filter(Boolean);
+}
+/**
+ * Removes previously-rejected OIDC scopes from a Grant's rejected set.
+ *
+ * oidc-provider exposes `rejectOIDCScope()` but no inverse, and a rejected scope is subtracted from
+ * `getOIDCScope()` on every read — so `addOIDCScope()` alone cannot put a once-rejected scope back in
+ * force. `rejected` is plain persisted data (`Pick<Grant, 'openid' | 'resources'>`), which is what
+ * makes editing it directly the supported shape of an un-reject.
+ *
+ * @param grant - The grant to edit in place.
+ * @param scopes - The scopes to un-reject. Scopes not currently rejected are ignored.
+ */ function unrejectOIDCScopes(grant, scopes) {
+    var _grant_rejected;
+    var rejected = (_grant_rejected = grant.rejected) === null || _grant_rejected === void 0 ? void 0 : _grant_rejected.openid;
+    if (rejected === null || rejected === void 0 ? void 0 : rejected.scope) {
+        var remove = new Set(scopes);
+        var remaining = splitScope(rejected.scope).filter(function(scope) {
+            return !remove.has(scope);
+        });
+        rejected.scope = remaining.length > 0 ? remaining.join(' ') : undefined;
+    }
+}
+/**
+ * Removes previously-rejected OIDC claims from a Grant's rejected set.
+ *
+ * @param grant - The grant to edit in place.
+ * @param claims - The claims to un-reject. Claims not currently rejected are ignored.
+ * @see unrejectOIDCScopes
+ */ function unrejectOIDCClaims(grant, claims) {
+    var _grant_rejected, _rejected_claims;
+    var rejected = (_grant_rejected = grant.rejected) === null || _grant_rejected === void 0 ? void 0 : _grant_rejected.openid;
+    if (rejected === null || rejected === void 0 ? void 0 : (_rejected_claims = rejected.claims) === null || _rejected_claims === void 0 ? void 0 : _rejected_claims.length) {
+        var remove = new Set(claims);
+        var remaining = rejected.claims.filter(function(claim) {
+            return !remove.has(claim);
+        });
+        rejected.claims = remaining.length > 0 ? remaining : undefined;
+    }
+}
+/**
+ * Removes previously-rejected resource scopes for one resource indicator from a Grant's rejected set.
+ *
+ * @param grant - The grant to edit in place.
+ * @param resource - The resource indicator.
+ * @param scopes - The scopes to un-reject. Scopes not currently rejected for the resource are ignored.
+ * @see unrejectOIDCScopes
+ */ function unrejectResourceScopes(grant, resource, scopes) {
+    var _grant_rejected;
+    var rejectedResources = (_grant_rejected = grant.rejected) === null || _grant_rejected === void 0 ? void 0 : _grant_rejected.resources;
+    if (rejectedResources === null || rejectedResources === void 0 ? void 0 : rejectedResources[resource]) {
+        var remove = new Set(scopes);
+        var remaining = splitScope(rejectedResources[resource]).filter(function(scope) {
+            return !remove.has(scope);
+        });
+        if (remaining.length > 0) {
+            rejectedResources[resource] = remaining.join(' ');
+        } else {
+            delete rejectedResources[resource];
+        }
+    }
+}
+/**
+ * Moves previously-rejected values the current request asks for again from the "encountered" set back into
+ * the "missing" set, so a re-consent decides them afresh.
  *
- * Decorate a `@Global()` module with the result so the `OIDC_ANALYTICS_SERVICE` token is visible to
- * the OIDC controllers and services provided by the app's OIDC module.
+ * oidc-provider counts a rejected value as encountered: it never reappears in the prompt's `missing*`
+ * details, so without this a consent that names it again is a silent no-op and the value can never be
+ * granted on that Grant — even when the user explicitly ticks it. Values the Grant has GRANTED are left in
+ * `encountered`: they are already in force and need no re-application.
  *
- * @param config - Optional metadata + analytics config to merge in.
- * @returns NestJS module metadata providing + exporting the OIDC analytics service and token.
+ * @param input - The missing, encountered, rejected, and requested sets.
+ * @returns The adjusted missing/encountered sets plus the reconsidered values.
  *
- * @example
- * ```typescript
- * @Global()
- * @Module(appOidcAnalyticsModuleMetadata())
- * export class AppOidcAnalyticsModule {}
- * ```
- */ function appOidcAnalyticsModuleMetadata() {
-    var config = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
-    var oidcAnalyticsConfig = config.oidcAnalyticsConfig, imports = config.imports, exports = config.exports, providers = config.providers;
-    var configProviders = oidcAnalyticsConfig ? [
-        {
-            provide: FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG,
-            useValue: oidcAnalyticsConfig
-        }
-    ] : [];
+ * @__NO_SIDE_EFFECTS__
+ */ function reconsiderRejectedValues(input) {
+    var missing = input.missing, encountered = input.encountered, rejected = input.rejected, requested = input.requested;
+    var missingSet = new Set(missing);
+    var reconsidered = rejected.filter(function(value) {
+        return requested.has(value) && !missingSet.has(value);
+    });
+    var reconsideredSet = new Set(reconsidered);
     return {
-        imports: _to_consumable_array$2(imports !== null && imports !== void 0 ? imports : []),
-        exports: [
-            OIDC_ANALYTICS_SERVICE,
-            FirebaseServerOidcAnalyticsService
-        ].concat(_to_consumable_array$2(exports !== null && exports !== void 0 ? exports : [])),
-        providers: [
-            FirebaseServerOidcAnalyticsService,
-            {
-                provide: OIDC_ANALYTICS_SERVICE,
-                useExisting: FirebaseServerOidcAnalyticsService
-            }
-        ].concat(_to_consumable_array$2(configProviders), _to_consumable_array$2(providers !== null && providers !== void 0 ? providers : []))
+        missing: _to_consumable_array$3(missing).concat(_to_consumable_array$3(reconsidered)),
+        encountered: encountered.filter(function(value) {
+            return !reconsideredSet.has(value);
+        }),
+        reconsidered: reconsidered
     };
 }
-
-// MARK: Scopes
 /**
- * Reads the set of OIDC scopes carried by a callable request's bearer token.
- *
- * The `ModelApiCallModelDispatchService` builds a synthetic `CallableRequest` with
- * `auth.token = oidcValidatedToken ?? {}`, so the OIDC scope string lives at
- * `request.auth.token.scope` for OIDC callers and is `undefined` for non-OIDC
- * (regular Firebase ID-token) callers.
- *
- * Returning `undefined` for non-OIDC callers lets consumers (e.g. the MCP tool-visibility filter)
- * skip scope enforcement instead of falsely treating the missing claim as "no scopes granted".
+ * Names every claim an authorization request's `claims` parameter asks for, across `id_token` and `userinfo`.
  *
- * The parameter is intentionally typed as `unknown` because `DecodedIdToken` (Firebase
- * Auth's typed token shape) does not declare a `scope` field, while OIDC bearer-token
- * callers attach one at runtime. Reading is done defensively.
+ * @param claimsParam - The raw `claims` request parameter (a JSON string), or undefined.
+ * @returns The requested claim names; empty when the parameter is absent or malformed.
  *
- * @param request - The callable request as seen inside an `onCallModel` handler.
- * @returns A `Set<string>` of granted scopes, or `undefined` when the request carries no OIDC `scope` claim.
- */ function getOidcScopesFromRequest(request) {
-    var _request_auth_token, _request_auth;
-    var scope = request === null || request === void 0 ? void 0 : (_request_auth = request.auth) === null || _request_auth === void 0 ? void 0 : (_request_auth_token = _request_auth.token) === null || _request_auth_token === void 0 ? void 0 : _request_auth_token.scope;
-    return oidcScopesFromScopeClaim(scope);
+ * @__NO_SIDE_EFFECTS__
+ */ function requestedOIDCClaimNames(claimsParam) {
+    var names = new Set();
+    if (typeof claimsParam === 'string' && claimsParam.length > 0) {
+        var parsed;
+        try {
+            parsed = JSON.parse(claimsParam);
+        } catch (unused) {
+            parsed = undefined;
+        }
+        if (parsed != null && (typeof parsed === "undefined" ? "undefined" : _type_of(parsed)) === 'object') {
+            for(var _i = 0, _iter = [
+                'id_token',
+                'userinfo'
+            ]; _i < _iter.length; _i++){
+                var key = _iter[_i];
+                var section = parsed[key];
+                if (section != null && (typeof section === "undefined" ? "undefined" : _type_of(section)) === 'object') {
+                    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                    try {
+                        for(var _iterator = Object.keys(section)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                            var claim = _step.value;
+                            names.add(claim);
+                        }
+                    } catch (err) {
+                        _didIteratorError = true;
+                        _iteratorError = err;
+                    } finally{
+                        try {
+                            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                                _iterator.return();
+                            }
+                        } finally{
+                            if (_didIteratorError) {
+                                throw _iteratorError;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return names;
+}
+/**
+ * Normalizes an authorization request's `resource` parameter to its list of resource indicators.
+ *
+ * @param resourceParam - The raw `resource` request parameter (a string, an array of strings, or undefined).
+ * @returns The resource indicators; empty when the parameter is absent.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function requestedResourceIndicators(resourceParam) {
+    var indicators;
+    if (typeof resourceParam === 'string') {
+        indicators = [
+            resourceParam
+        ];
+    } else if (Array.isArray(resourceParam)) {
+        indicators = resourceParam.filter(function(value) {
+            return typeof value === 'string';
+        });
+    } else {
+        indicators = [];
+    }
+    return indicators;
 }
 
+function _array_like_to_array$2(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$2(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
+}
 function asyncGeneratorStep$3(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -5571,6 +6761,14 @@ function _define_property$4(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
+function _iterable_to_array$2(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
+        return Array.from(iter);
+    }
+}
+function _non_iterable_spread$2() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
 function _object_spread$1(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
@@ -5586,6 +6784,9 @@ function _object_spread$1(target) {
     }
     return target;
 }
+function _to_consumable_array$2(arr) {
+    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$2();
+}
 function _ts_generator$3(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -5685,85 +6886,90 @@ function _ts_generator$3(thisArg, body) {
         };
     }
 }
+function _unsupported_iterable_to_array$2(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
+}
+// MARK: Constants
+/**
+ * Default lifetime of a minted JWT, in seconds.
+ */ var DEFAULT_OIDC_SIGNED_JWT_EXPIRES_IN_SECONDS = 600;
+/**
+ * How long the active signing key is cached before it is re-read from the JWKS store.
+ *
+ * A rotation is picked up within this window; rotated keys stay in the public JWKS for 30 days, so
+ * tokens signed with the previous key keep verifying in the meantime.
+ */ var DEFAULT_OIDC_JWT_SIGNING_KEY_CACHE_MS = 5 * 60 * 1000;
+/**
+ * Header `typ` for a minted JWT: an RFC 9068 JWT access token, matching the format oidc-provider
+ * uses for the `accessTokenFormat: 'jwt'` resource-server tokens.
+ */ var DEFAULT_OIDC_SIGNED_JWT_TYP = 'at+jwt';
 // MARK: Service
 /**
- * Service for handling OIDC interactions.
- */ var OidcInteractionService = /*#__PURE__*/ function() {
-    function OidcInteractionService(oidcService, clientService) {
-        _class_call_check$3(this, OidcInteractionService);
-        _define_property$4(this, "oidcService", void 0);
-        _define_property$4(this, "clientService", void 0);
-        this.oidcService = oidcService;
-        this.clientService = clientService;
+ * Signs first-party JWTs with the OIDC provider's active JWKS signing key.
+ *
+ * The result is an RS256 token with `iss` = this provider's issuer, so any resource server that
+ * already trusts the provider's JWKS for OAuth access tokens verifies it with no new secret or
+ * trust anchor: "the API mints a token for the satellite service" is literally "sign with the
+ * active key, `aud` = the satellite's origin". The counterpart on the resource server is
+ * `verifyBearerJwt` from `@dereekb/oauth-resource`, whose `oidc` issuer profile discovers this
+ * provider's `jwks_uri` from its own discovery document.
+ *
+ * Registered and exported by `oidcModuleMetadata`, so a downstream app injects it with no extra
+ * wiring. Pair it with `createCachedTokenProvider` from `@dereekb/util/oidc` to hold a minted
+ * token until it nears expiry instead of re-signing per call.
+ */ var OidcJwtSigningService = /*#__PURE__*/ function() {
+    function OidcJwtSigningService(_jwks, _config) {
+        _class_call_check$3(this, OidcJwtSigningService);
+        _define_property$4(this, "_jwks", void 0);
+        _define_property$4(this, "_config", void 0);
+        _define_property$4(this, "_cached", void 0);
+        this._jwks = _jwks;
+        this._config = _config;
     }
-    _create_class$3(OidcInteractionService, [
-        {
-            key: "getInteractionDetails",
-            value: /**
-     * Loads the interaction details for a given request/response pair.
-     *
-     * Requires the oidc-provider interaction cookie to be present on the request.
-     *
-     * @param req - The Express request containing the interaction cookie.
-     * @param res - The Express response.
-     * @returns The oidc-provider interaction details.
-     */ function getInteractionDetails(req, res) {
-                return _async_to_generator$3(function() {
-                    var provider;
-                    return _ts_generator$3(this, function(_state) {
-                        switch(_state.label){
-                            case 0:
-                                return [
-                                    4,
-                                    this.oidcService.getProvider()
-                                ];
-                            case 1:
-                                provider = _state.sent();
-                                return [
-                                    2,
-                                    provider.interactionDetails(req, res)
-                                ];
-                        }
-                    });
-                }).call(this);
-            }
-        },
+    _create_class$3(OidcJwtSigningService, [
         {
-            key: "findInteractionByUid",
+            key: "signJwt",
             value: /**
-     * Finds an interaction by its UID directly from the adapter store.
-     *
-     * Bypasses the cookie-based lookup used by `provider.interactionDetails()`.
-     * This is necessary when the interaction cookie is scoped to a different path
-     * (e.g., the frontend) and is not sent with backend API requests.
+     * Mints a signed JWT.
      *
-     * @param uid - The interaction UID to look up.
-     * @returns The interaction details for the given UID.
-     * @throws {Error} When the interaction is not found or has expired.
-     */ function findInteractionByUid(uid) {
+     * @param input - Audience, subject, lifetime, and extra claims.
+     * @returns The compact token, its expiry, and the signing key id.
+     */ function signJwt(input) {
                 return _async_to_generator$3(function() {
-                    var provider, interaction;
+                    var _input_expiresIn, _input_typ, _ref, kid, key, now, exp, token;
                     return _ts_generator$3(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 return [
                                     4,
-                                    this.oidcService.getProvider()
+                                    this._loadSigningKey()
                                 ];
                             case 1:
-                                provider = _state.sent();
+                                _ref = _state.sent(), kid = _ref.kid, key = _ref.key;
+                                now = Math.floor(Date.now() / 1000);
+                                exp = now + ((_input_expiresIn = input.expiresIn) !== null && _input_expiresIn !== void 0 ? _input_expiresIn : DEFAULT_OIDC_SIGNED_JWT_EXPIRES_IN_SECONDS);
                                 return [
                                     4,
-                                    provider.Interaction.find(uid)
+                                    new SignJWT(_object_spread$1({}, input.claims)).setProtectedHeader({
+                                        alg: 'RS256',
+                                        kid: kid,
+                                        typ: (_input_typ = input.typ) !== null && _input_typ !== void 0 ? _input_typ : DEFAULT_OIDC_SIGNED_JWT_TYP
+                                    }).setIssuer(this._config.issuer).setAudience(typeof input.audience === 'string' ? input.audience : _to_consumable_array$2(input.audience)).setSubject(input.subject).setIssuedAt(now).setExpirationTime(exp).setJti(randomUUID()).sign(key)
                                 ];
                             case 2:
-                                interaction = _state.sent();
-                                if (!interaction) {
-                                    throw new Error('Interaction not found');
-                                }
+                                token = _state.sent();
                                 return [
                                     2,
-                                    interaction
+                                    {
+                                        token: token,
+                                        kid: kid,
+                                        expiresAt: new Date(exp * 1000)
+                                    }
                                 ];
                         }
                     });
@@ -5771,111 +6977,57 @@ function _ts_generator$3(thisArg, body) {
             }
         },
         {
-            key: "finishInteractionByUid",
-            value: /**
-     * Completes an interaction by UID without requiring the interaction cookie.
-     *
-     * Looks up the interaction directly by UID, applies the result, saves it,
-     * and returns the `returnTo` URL for the client to redirect to.
-     *
-     * @param uid - The interaction UID to complete.
-     * @param result - The interaction results to apply.
-     * @param options - Optional settings for merging with the last submission.
-     * @param options.mergeWithLastSubmission - Whether to merge with the last submission (defaults to true)
-     * @returns The interaction that was completed. It includes the returnTo property for the next step of the interaction.
-     */ function finishInteractionByUid(uid, result, options) {
+            key: "_loadSigningKey",
+            value: function _loadSigningKey() {
                 return _async_to_generator$3(function() {
-                    var _ref, interaction, mergeWithLastSubmission;
+                    var stale, _ref, jwk, _tmp, _, _tmp1;
                     return _ts_generator$3(this, function(_state) {
                         switch(_state.label){
                             case 0:
-                                return [
-                                    4,
-                                    this.findInteractionByUid(uid)
-                                ];
-                            case 1:
-                                interaction = _state.sent();
-                                mergeWithLastSubmission = (_ref = options === null || options === void 0 ? void 0 : options.mergeWithLastSubmission) !== null && _ref !== void 0 ? _ref : true;
-                                if (mergeWithLastSubmission && !('error' in result)) {
-                                    interaction.result = _object_spread$1({}, interaction.lastSubmission, result);
-                                } else {
-                                    interaction.result = result;
-                                }
-                                return [
-                                    4,
-                                    interaction.save(interaction.exp - unixDateTimeSecondsNumberForNow())
-                                ];
-                            case 2:
-                                _state.sent();
-                                return [
-                                    2,
-                                    interaction
+                                stale = !this._cached || Date.now() - this._cached.loadedAt > DEFAULT_OIDC_JWT_SIGNING_KEY_CACHE_MS;
+                                if (!stale) return [
+                                    3,
+                                    6
                                 ];
-                        }
-                    });
-                }).call(this);
-            }
-        },
-        {
-            key: "findOrCreateGrant",
-            value: /**
-     * Finds an existing grant by ID, or creates a new one.
-     *
-     * For new grants, optionally pre-set `expiresIn` so {@link Grant#save} writes the requested TTL
-     * instead of falling through to the configured Grant TTL function (which cannot read the original
-     * `dbx_session_ttl` request param when save is driven from a NestJS controller — see
-     * {@link OidcService#resolveLoginDurationForGrant}).
-     *
-     * @param grantId - The existing grant ID to look up, or undefined to create a new grant.
-     * @param accountId - The account ID for creating a new grant.
-     * @param clientId - The client ID for creating a new grant.
-     * @param expiresInSeconds - Optional TTL (seconds) to assign to a newly-created grant.
-     * @returns The found or newly created grant.
-     */ // eslint-disable-next-line @typescript-eslint/max-params -- positional args mirror the existing call sites
-            function findOrCreateGrant(grantId, accountId, clientId, expiresInSeconds) {
-                return _async_to_generator$3(function() {
-                    var provider, grant, found, grantInit;
-                    return _ts_generator$3(this, function(_state) {
-                        switch(_state.label){
-                            case 0:
                                 return [
                                     4,
-                                    this.oidcService.getProvider()
+                                    this._jwks.getActiveSigningKey()
                                 ];
                             case 1:
-                                provider = _state.sent();
-                                if (!grantId) return [
+                                if (!((_ref = _state.sent()) !== null && _ref !== void 0)) return [
                                     3,
-                                    3
+                                    2
                                 ];
+                                _tmp = _ref;
                                 return [
-                                    4,
-                                    provider.Grant.find(grantId)
+                                    3,
+                                    4
                                 ];
                             case 2:
-                                found = _state.sent();
-                                if (!found) {
-                                    throw new Error("Grant not found for grantId: ".concat(grantId));
-                                }
-                                grant = found;
                                 return [
-                                    3,
-                                    4
+                                    4,
+                                    this._jwks.generateKeyPair()
                                 ];
                             case 3:
-                                grantInit = {
-                                    accountId: accountId,
-                                    clientId: clientId
-                                };
-                                if (expiresInSeconds != null) {
-                                    grantInit.expiresIn = expiresInSeconds;
-                                }
-                                grant = new provider.Grant(grantInit);
+                                _tmp = _state.sent().signingKey;
                                 _state.label = 4;
                             case 4:
+                                jwk = _tmp;
+                                _ = this;
+                                _tmp1 = {
+                                    kid: jwk.kid
+                                };
+                                return [
+                                    4,
+                                    importJWK(jwk, 'RS256')
+                                ];
+                            case 5:
+                                _._cached = (_tmp1.key = _state.sent(), _tmp1.loadedAt = Date.now(), _tmp1);
+                                _state.label = 6;
+                            case 6:
                                 return [
                                     2,
-                                    grant
+                                    this._cached
                                 ];
                         }
                     });
@@ -5883,22 +7035,19 @@ function _ts_generator$3(thisArg, body) {
             }
         }
     ]);
-    return OidcInteractionService;
+    return OidcJwtSigningService;
 }();
-OidcInteractionService = __decorate([
+OidcJwtSigningService = __decorate([
     Injectable(),
-    __param(0, Inject(OidcService)),
-    __param(1, Inject(OidcClientService))
-], OidcInteractionService);
+    __param(0, Inject(JwksService)),
+    __param(1, Inject(OidcModuleConfig))
+], OidcJwtSigningService);
 
 function _array_like_to_array$1(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes(arr) {
-    if (Array.isArray(arr)) return arr;
-}
 function _array_without_holes$1(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$1(arr);
 }
@@ -5966,39 +7115,9 @@ function _iterable_to_array$1(iter) {
         return Array.from(iter);
     }
 }
-function _iterable_to_array_limit(arr, i) {
-    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
-    if (_i == null) return;
-    var _arr = [];
-    var _n = true;
-    var _d = false;
-    var _s, _e;
-    try {
-        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
-            _arr.push(_s.value);
-            if (i && _arr.length === i) break;
-        }
-    } catch (err) {
-        _d = true;
-        _e = err;
-    } finally{
-        try {
-            if (!_n && _i["return"] != null) _i["return"]();
-        } finally{
-            if (_d) throw _e;
-        }
-    }
-    return _arr;
-}
-function _non_iterable_rest() {
-    throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
 function _non_iterable_spread$1() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array(arr, i) {
-    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array$1(arr, i) || _non_iterable_rest();
-}
 function _to_consumable_array$1(arr) {
     return _array_without_holes$1(arr) || _iterable_to_array$1(arr) || _unsupported_iterable_to_array$1(arr) || _non_iterable_spread$1();
 }
@@ -6306,7 +7425,7 @@ var OidcInteractionController_1;
      * @throws {HttpException} HTTP 400 when the consent interaction cannot be completed.
      */ function postConsent(uid, body, res) {
                 return _async_to_generator$2(function() {
-                    var startedAt, clientId, accountId, _ref, _prompt_details_missingOIDCScope, _ref1, _this_accountService_providerConfig_adminOnlyScopes, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, missingOIDCScope, existingGrant, _tmp, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref5, redirectTo1, missingRequiredScopes, _ref6, redirectTo2, effectiveOIDCScopes, heldOIDCScopes, consentedOIDCScopeSet, configAdminOnlyScopes, adminOnlyScopes, consentedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, encounteredOIDCClaims, missingOIDCClaims, _resolveEffectiveSubset, granted1, rejected1, missingResourceScopes, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, indicator, scopes, _ref8, _body_grantedResourceScopes, requestedSubset, encounteredResourceScopes, _resolveEffectiveSubset1, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref9, redirectTo4, err;
+                    var startedAt, clientId, accountId, _ref, _params_scope, _prompt_details_missingOIDCScope, _ref1, _this_accountService_providerConfig_adminOnlyScopes, _ref2, _ref3, _prompt_details_missingOIDCClaims, _prompt_details_missingResourceScopes, _this_accountService_delegate_isAdminUser, _this_accountService_delegate, _ref4, redirectTo, interaction, prompt, params, session, existingGrant, _tmp, requestedScopeParam, oidcScopes, missingOIDCScope, encounteredOIDCScopes, clientPayload, requestedOIDCScopeSet, providerProfiles, _oidcClientProviderProfileScopes, clientUnlockedScopes, clientRequiredScopes, profileGatedScopes, disallowedGatedScopes, _ref5, redirectTo1, missingRequiredScopes, _ref6, redirectTo2, effectiveOIDCScopes, heldOIDCScopes, consentedOIDCScopeSet, configAdminOnlyScopes, adminOnlyScopes, consentedAdminOnlyScopes, requestsServiceToken, isAdmin, _tmp1, _ref7, redirectTo3, requestedRawTtl, clientMaxSessionTtl, expiresInSeconds, grant, _tmp2, granted, rejected, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, value, _reconsiderRejectedValues, missingOIDCClaims, encounteredOIDCClaims, _resolveEffectiveSubset, granted1, rejected1, missingResourceScopes, resourceIndicators, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, indicator, _missingResourceScopes_indicator, _ref8, _body_grantedResourceScopes, _reconsiderRejectedValues1, scopes, encounteredResourceScopes, requestedSubset, _resolveEffectiveSubset1, granted2, rejected2, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, value1, grantId, _ref9, redirectTo4, err;
                     return _ts_generator$2(this, function(_state) {
                         switch(_state.label){
                             case 0:
@@ -6356,7 +7475,6 @@ var OidcInteractionController_1;
                                 prompt = interaction.prompt, params = interaction.params, session = interaction.session;
                                 clientId = params['client_id'];
                                 accountId = (_ref = session === null || session === void 0 ? void 0 : session.accountId) !== null && _ref !== void 0 ? _ref : '';
-                                missingOIDCScope = (_prompt_details_missingOIDCScope = prompt.details['missingOIDCScope']) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [];
                                 if (!interaction.grantId) return [
                                     3,
                                     7
@@ -6381,7 +7499,20 @@ var OidcInteractionController_1;
                                 // but the consent UI sources its checkbox list from the auth URL's `scope=` param (the full request set)
                                 // and re-submits them all. We accept already-encountered values as silent no-ops so a re-consent on a
                                 // client the user has previously authorized doesn't fail validation.
-                                encounteredOIDCScopes = existingGrant ? existingGrant.getOIDCScopeEncountered().split(' ').filter(Boolean) : [];
+                                //
+                                // A REJECTED value is the exception. oidc-provider counts it as encountered too, so it never comes back
+                                // in `missing*` — and a rejected scope is subtracted from `getOIDCScope()` on every read, so treating it
+                                // as a no-op would make it ungrantable on this Grant for good, even when the user explicitly ticks it
+                                // again. `reconsiderRejectedValues` moves the rejected values this request names back into `missing`
+                                // so this consent decides them afresh; a grant of one of those un-rejects it further down.
+                                requestedScopeParam = new Set(((_params_scope = params['scope']) !== null && _params_scope !== void 0 ? _params_scope : '').split(' ').filter(Boolean));
+                                oidcScopes = reconsiderRejectedValues({
+                                    missing: (_prompt_details_missingOIDCScope = prompt.details['missingOIDCScope']) !== null && _prompt_details_missingOIDCScope !== void 0 ? _prompt_details_missingOIDCScope : [],
+                                    encountered: existingGrant ? existingGrant.getOIDCScopeEncountered().split(' ').filter(Boolean) : [],
+                                    rejected: existingGrant ? existingGrant.getRejectedOIDCScope().split(' ').filter(Boolean) : [],
+                                    requested: requestedScopeParam
+                                });
+                                missingOIDCScope = oidcScopes.missing, encounteredOIDCScopes = oidcScopes.encountered;
                                 return [
                                     4,
                                     this.oidcService.findClientPayload(clientId)
@@ -6596,6 +7727,7 @@ var OidcInteractionController_1;
                                 if (missingOIDCScope.length > 0) {
                                     granted = effectiveOIDCScopes.granted, rejected = effectiveOIDCScopes.rejected;
                                     if (granted.length > 0) {
+                                        unrejectOIDCScopes(grant, granted);
                                         grant.addOIDCScope(granted.join(' '));
                                     }
                                     _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
@@ -6619,8 +7751,14 @@ var OidcInteractionController_1;
                                         }
                                     }
                                 }
-                                encounteredOIDCClaims = grant.getOIDCClaimsEncountered();
-                                missingOIDCClaims = (_prompt_details_missingOIDCClaims = prompt.details['missingOIDCClaims']) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [];
+                                // Same reconsideration as the scopes above: a claim rejected on an earlier consent that this request's
+                                // `claims` parameter names again is decided afresh rather than silently kept rejected.
+                                _reconsiderRejectedValues = reconsiderRejectedValues({
+                                    missing: (_prompt_details_missingOIDCClaims = prompt.details['missingOIDCClaims']) !== null && _prompt_details_missingOIDCClaims !== void 0 ? _prompt_details_missingOIDCClaims : [],
+                                    encountered: grant.getOIDCClaimsEncountered(),
+                                    rejected: grant.getRejectedOIDCClaims(),
+                                    requested: requestedOIDCClaimNames(params['claims'])
+                                }), missingOIDCClaims = _reconsiderRejectedValues.missing, encounteredOIDCClaims = _reconsiderRejectedValues.encountered;
                                 if (missingOIDCClaims.length > 0) {
                                     _resolveEffectiveSubset = resolveEffectiveSubset({
                                         missing: missingOIDCClaims,
@@ -6628,6 +7766,7 @@ var OidcInteractionController_1;
                                         alreadyEncountered: encounteredOIDCClaims
                                     }), granted1 = _resolveEffectiveSubset.granted, rejected1 = _resolveEffectiveSubset.rejected;
                                     if (granted1.length > 0) {
+                                        unrejectOIDCClaims(grant, granted1);
                                         grant.addOIDCClaims(granted1);
                                     }
                                     if (rejected1.length > 0) {
@@ -6635,12 +7774,25 @@ var OidcInteractionController_1;
                                     }
                                 }
                                 missingResourceScopes = (_prompt_details_missingResourceScopes = prompt.details['missingResourceScopes']) !== null && _prompt_details_missingResourceScopes !== void 0 ? _prompt_details_missingResourceScopes : {};
+                                // Resource indicators this consent decides: the ones oidc-provider reports as still undecided, plus any
+                                // the request names (`resource` param) that carry a rejection worth reconsidering. An indicator whose
+                                // every scope was rejected earlier is absent from `missingResourceScopes` entirely, which is exactly the
+                                // case that needs the second source.
+                                resourceIndicators = new Set(_to_consumable_array$1(Object.keys(missingResourceScopes)).concat(_to_consumable_array$1(requestedResourceIndicators(params['resource']).filter(function(indicator) {
+                                    return grant.getRejectedResourceScope(indicator).length > 0;
+                                }))));
                                 _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                                 try {
-                                    for(_iterator1 = Object.entries(missingResourceScopes)[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                                        _step_value = _sliced_to_array(_step1.value, 2), indicator = _step_value[0], scopes = _step_value[1];
+                                    for(_iterator1 = resourceIndicators[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                                        indicator = _step1.value;
                                         ;
                                         ;
+                                        _reconsiderRejectedValues1 = reconsiderRejectedValues({
+                                            missing: (_missingResourceScopes_indicator = missingResourceScopes[indicator]) !== null && _missingResourceScopes_indicator !== void 0 ? _missingResourceScopes_indicator : [],
+                                            encountered: grant.getResourceScopeEncountered(indicator).split(' ').filter(Boolean),
+                                            rejected: grant.getRejectedResourceScope(indicator).split(' ').filter(Boolean),
+                                            requested: requestedScopeParam
+                                        }), scopes = _reconsiderRejectedValues1.missing, encounteredResourceScopes = _reconsiderRejectedValues1.encountered;
                                         // A submission with no explicit per-resource selection falls back to the OIDC scope selection
                                         // rather than granting everything the resource server declares. A resource server's scope list
                                         // is drawn from the same provider scopes the consent UI renders as one checkbox list, so a scope
@@ -6650,13 +7802,13 @@ var OidcInteractionController_1;
                                         requestedSubset = (_ref8 = (_body_grantedResourceScopes = body.grantedResourceScopes) === null || _body_grantedResourceScopes === void 0 ? void 0 : _body_grantedResourceScopes[indicator]) !== null && _ref8 !== void 0 ? _ref8 : body.grantedOIDCScopes ? scopes.filter(function(scope) {
                                             return consentedOIDCScopeSet.has(scope);
                                         }) : undefined;
-                                        encounteredResourceScopes = grant.getResourceScopeEncountered(indicator).split(' ').filter(Boolean);
                                         _resolveEffectiveSubset1 = resolveEffectiveSubset({
                                             missing: scopes,
                                             requestedSubset: requestedSubset,
                                             alreadyEncountered: encounteredResourceScopes
                                         }), granted2 = _resolveEffectiveSubset1.granted, rejected2 = _resolveEffectiveSubset1.rejected;
                                         if (granted2.length > 0) {
+                                            unrejectResourceScopes(grant, indicator, granted2);
                                             grant.addResourceScope(indicator, granted2.join(' '));
                                         }
                                         _iteratorNormalCompletion2 = true, _didIteratorError2 = false, _iteratorError2 = undefined;
@@ -7726,40 +8878,6 @@ function _unsupported_iterable_to_array(o, minLen) {
     var trimmedPath = parsed.pathname.replace(/\/[^/]*\/?$/, '');
     return "".concat(parsed.origin).concat(trimmedPath, "/.well-known/oauth-protected-resource");
 }
-/**
- * Builds a single-entry {@link OidcResourceServerInfo} map for the MCP endpoint
- * declared on `envService.appMcpUrl`, with `scope` set to every scope declared
- * on `providerConfig.claims` (so any scope the provider issues is valid on the
- * resource server) and `audience` set to the MCP URL.
- *
- * Returns `undefined` when no `appMcpUrl` is configured.
- *
- * Used internally by {@link oidcModuleMetadata} when {@link OidcModuleConfig.configureMcpResourceServer}
- * is enabled, and exported for apps that need to combine the MCP resource server
- * with additional app-specific entries:
- *
- * @example
- * ```ts
- * resourceServers: {
- *   ...(buildFirebaseServerMcpResourceServer({ envService, providerConfig: APP_PROVIDER_CONFIG }) ?? {}),
- *   'https://api.example.com/extras': {
- *     scope: 'openid profile',
- *     audience: 'https://api.example.com/extras'
- *   }
- * }
- * ```
- */ function buildFirebaseServerMcpResourceServer(input) {
-    var envService = input.envService, providerConfig = input.providerConfig;
-    var mcpUrl = envService.appMcpUrl;
-    var result;
-    if (mcpUrl) {
-        result = _define_property({}, mcpUrl, {
-            scope: allOidcScopesStringForProviderConfig(providerConfig),
-            audience: mcpUrl
-        });
-    }
-    return result;
-}
 /**
  * Factory that creates {@link OidcServerFirestoreCollections} using the provided Firestore context
  * and JWKS encryption config from {@link OidcModuleConfig}.
@@ -7807,10 +8925,12 @@ function _unsupported_iterable_to_array(o, minLen) {
         exports: [
             OidcClientService,
             OidcService,
+            OidcJwtSigningService,
             OidcProviderConfigService,
             OidcModuleConfig,
             OidcAuthMiddlewareConfig,
-            OidcServerFirestoreCollections
+            OidcServerFirestoreCollections,
+            JwksService
         ].concat(_to_consumable_array(exports !== null && exports !== void 0 ? exports : [])),
         providers: [
             {
@@ -7838,14 +8958,13 @@ function _unsupported_iterable_to_array(o, minLen) {
                     // Auto-derive the MCP resource-server entry from envService.appMcpUrl and the
                     // registered OidcAccountService's providerConfig. Any explicit resourceServers
                     // entry from the consumer wins on key collisions.
-                    if (result.configureMcpResourceServer) {
-                        var mcpResourceServer = buildFirebaseServerMcpResourceServer({
-                            envService: envService,
-                            providerConfig: oidcAccountService.providerConfig
+                    if (result.configureMcpResourceServer && envService.appMcpUrl) {
+                        var mcpResourceServer = buildOidcResourceServer({
+                            url: envService.appMcpUrl,
+                            scope: allOidcScopesStringForProviderConfig(oidcAccountService.providerConfig),
+                            audience: envService.appMcpUrl
                         });
-                        if (mcpResourceServer) {
-                            result.resourceServers = _object_spread({}, mcpResourceServer, result.resourceServers);
-                        }
+                        result.resourceServers = _object_spread({}, mcpResourceServer, result.resourceServers);
                     }
                     return result;
                 }
@@ -7884,6 +9003,7 @@ function _unsupported_iterable_to_array(o, minLen) {
             OidcProviderConfigService,
             OidcEncryptionService,
             OidcService,
+            OidcJwtSigningService,
             JwksService,
             {
                 provide: OidcClientService,
@@ -7898,4 +9018,4 @@ function _unsupported_iterable_to_array(o, minLen) {
     };
 }
 
-export { DBX_FIREBASE_SERVER_OIDC_PROVIDER_PROFILES_CLIENT_METADATA, DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, FirebaseServerOidcAnalyticsService, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ANALYTICS_SERVICE, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JSON_RENDER_ERROR_FUNCTION, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAnalyticsService, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, STALE_SESSION_ACCOUNT_CHECK_REASON, activeJwksKeysQuery, adminOnlyScopesForOidcProviderConfig, allOidcScopesStringForProviderConfig, appOidcAnalyticsModuleMetadata, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, buildBearerChallenge, buildFirebaseServerMcpResourceServer, buildOidcInteractionPolicy, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, deriveResourceMetadataUrlFromEnv, emitOidcAnalyticsEvent, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, noopOidcAnalyticsService, oidcClientProviderProfileScopes, oidcCorsOriginDelegate, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, resolveEffectiveSubset, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, updateOidcClientFactory };
+export { DBX_FIREBASE_SERVER_OIDC_PROVIDER_PROFILES_CLIENT_METADATA, DEFAULT_APP_OAUTH_CONSENT_PATH_PART, DEFAULT_APP_OAUTH_INTERACTION_PATH, DEFAULT_APP_OAUTH_LOGIN_PATH_PART, DEFAULT_MAX_ADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_NONADMIN_LOGIN_DURATION_SECONDS, DEFAULT_MAX_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_MAX_SERVICE_TOKEN_LOGIN_DURATION_SECONDS, DEFAULT_MIN_REQUESTED_LOGIN_DURATION_SECONDS, DEFAULT_OIDC_ANALYTICS_EVENT_NAMES, DEFAULT_OIDC_ANALYTICS_EVENT_NAME_PREFIX, DEFAULT_OIDC_CODE_CHALLENGE_METHODS, DEFAULT_OIDC_ID_TOKEN_SIGNING_ALG_VALUES, DEFAULT_OIDC_ISSUER_PATH, DEFAULT_OIDC_JWT_SIGNING_KEY_CACHE_MS, DEFAULT_OIDC_ROUTES, DEFAULT_OIDC_SIGNED_JWT_EXPIRES_IN_SECONDS, DEFAULT_OIDC_SIGNED_JWT_TYP, DEFAULT_OIDC_SUBJECT_TYPES, DEFAULT_OIDC_TOKEN_ENDPOINT_AUTH_METHODS, DEFAULT_OIDC_TOKEN_LIFETIMES, DEFAULT_ROTATED_KEY_MAX_AGE, FIREBASE_SERVER_OIDC_ANALYTICS_CONFIG, FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, FirebaseServerOidcAnalyticsService, GRANTABLE_MODEL_NAMES, JwksFirestoreCollections, JwksKeyDocument, JwksService, JwksServiceConfig, JwksServiceStorageConfig, OIDC_ANALYTICS_SERVICE, OIDC_ENCRYPTED_PAYLOAD_FIELDS, OIDC_JSON_RENDER_ERROR_FUNCTION, OIDC_JWKS_ENCRYPTION_SECRET_ENV_KEY, OIDC_JWT_ACCESS_TOKEN_RESERVED_CLAIMS, OidcAccountService, OidcAccountServiceDelegate, OidcAccountServiceUserContext, OidcAnalyticsService, OidcAuth, OidcAuthBearerTokenMiddleware, OidcAuthMiddlewareConfig, OidcClientService, OidcEncryptionService, OidcInteractionController, OidcInteractionService, OidcJwtSigningService, OidcModelServerActions, OidcModuleConfig, OidcProviderConfigService, OidcProviderController, OidcServerFirestoreCollections, OidcService, OidcWellKnownController, STALE_SESSION_ACCOUNT_CHECK_REASON, activeJwksKeysQuery, adminOnlyScopesForOidcProviderConfig, allOidcScopesStringForProviderConfig, appOidcAnalyticsModuleMetadata, appOidcModelModuleMetadata, applyOidcAuthMiddleware, applyOidcCorsMiddleware, buildBearerChallenge, buildFirebaseServerMcpResourceServer, buildOidcInteractionPolicy, buildOidcResourceServer, createAdapterFactory, createOidcClientFactory, deleteOidcClientFactory, deleteOidcTokenFactory, deriveResourceMetadataUrlFromEnv, emitOidcAnalyticsEvent, firebaseServerIssuerProfiles, getOidcScopesFromRequest, jwksKeyCollectionReference, jwksKeyConverter, jwksKeyFirestoreCollection, jwksKeyIdentity, jwksKeysWithStatusQuery, nonRetiredJwksKeysQuery, noopOidcAnalyticsService, oidcClientProviderProfileScopes, oidcCorsOriginDelegate, oidcFirestoreCollectionsFactory, oidcModelServerActions, oidcModelServerActionsFactory, oidcModuleConfigFactory, oidcModuleMetadata, oidcResourceServerAudiences, reconsiderRejectedValues, requestedOIDCClaimNames, requestedResourceIndicators, resolveEffectiveSubset, rotateOidcClientSecretFactory, rotatedJwksKeysQuery, unrejectOIDCClaims, unrejectOIDCScopes, unrejectResourceScopes, updateOidcClientFactory };