@dereekb/firebase 13.29.0 → 13.31.0

package/eslint/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/firebase/eslint",
-  "version": "13.29.0",
+  "version": "13.31.0",
   "peerDependencies": {
-    "@dereekb/util": "13.29.0",
+    "@dereekb/util": "13.31.0",
     "@marcbachmann/cel-js": "^7.6.1",
     "@typescript-eslint/parser": "8.59.3",
     "@typescript-eslint/utils": "8.59.3",
     "typescript": "5.9.3"
   },
   "devDependencies": {
-    "@dereekb/firebase": "13.29.0",
+    "@dereekb/firebase": "13.31.0",
     "eslint": "10.4.0",
     "firebase": "^12.12.1"
   },

package/index.cjs.js

@@ -11904,6 +11904,271 @@ function _class_call_check$c(instance, Constructor) {
  * `model.*` scope for a callModel CRUD operation.
  */ var CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE = 'CALL_MODEL_MISSING_OIDC_SCOPE';
 
+/**
+ * The `client_secret_basic` confidential-client auth method (RFC 6749 §2.3.1, the
+ * OAuth 2.0 default): the client sends its `client_id` and `client_secret` in the
+ * `Authorization: Basic` header on token-endpoint requests. Standard pick for
+ * server-side confidential clients.
+ *
+ * @example
+ * ```ts
+ * await oidcClientService.createClient({
+ *   token_endpoint_auth_method: CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD,
+ *   // ...
+ * });
+ * ```
+ */ var CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_basic';
+/**
+ * The `client_secret_post` confidential-client auth method (RFC 6749 §2.3.1, the
+ * form-body variant): the client sends `client_id` and `client_secret` as form-encoded
+ * parameters in the token-endpoint request body. Equivalent in security to
+ * {@link CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD}; pick it for clients that
+ * cannot set the `Authorization` header (some older HTTP stacks).
+ *
+ * @example
+ * ```ts
+ * await oidcClientService.createClient({
+ *   token_endpoint_auth_method: CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD,
+ *   // ...
+ * });
+ * ```
+ */ var CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_post';
+/**
+ * The `client_secret_jwt` confidential-client auth method (OIDC Core §9): the client
+ * signs a JWT client assertion using its `client_secret` as the HMAC key (HS256/HS384/HS512)
+ * and sends it as `client_assertion` on token-endpoint requests. The secret never goes on
+ * the wire — only the signed assertion — which is the upgrade over the plain
+ * `client_secret_*` methods, without requiring asymmetric keys like
+ * {@link PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD}.
+ *
+ * @example
+ * ```ts
+ * await oidcClientService.createClient({
+ *   token_endpoint_auth_method: CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD,
+ *   // ...
+ * });
+ * ```
+ */ var CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_jwt';
+/**
+ * The `private_key_jwt` confidential-client auth method (OIDC Core §9): the client signs
+ * a JWT client assertion with its private key (RS256/ES256/PS256) and sends it as
+ * `client_assertion`; the server verifies via the client's published `jwks` / `jwks_uri`.
+ * Strongest of the confidential-client methods — no shared secret is ever held by the
+ * server — and the canonical pick for high-trust server-to-server integrations.
+ *
+ * @example
+ * ```ts
+ * await oidcClientService.createClient({
+ *   token_endpoint_auth_method: PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD,
+ *   jwks: { keys: [publicJwk] },
+ *   // ...
+ * });
+ * ```
+ */ var PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD = 'private_key_jwt';
+/**
+ * The public-client auth method (`'none'`): no client secret, PKCE-only. The client
+ * authenticates the `authorization_code` flow with PKCE (RFC 7636) alone — there is no
+ * shared secret and no client assertion. Canonical pick for clients that cannot keep a
+ * secret (native apps, SPAs, CLIs) and what the MCP / Claude connector ecosystem
+ * (claude.ai connector, Claude Code CLI, mcp-inspector via DCR) registers as.
+ *
+ * Mirrors {@link PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD}. `oidc-provider` still
+ * enforces PKCE on the `authorization_code` flow for every client regardless of auth
+ * method, so `'none'` simply unlocks the secret-less variant rather than disabling any
+ * client authentication.
+ *
+ * @example
+ * ```ts
+ * await oidcClientService.createClient({
+ *   token_endpoint_auth_method: PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD,
+ *   // no client_secret — public PKCE client
+ *   // ...
+ * });
+ * ```
+ */ var PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD = 'none';
+/**
+ * All available token endpoint auth method options with display labels.
+ */ var ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS = [
+    {
+        label: 'Client Secret Basic',
+        value: CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD
+    },
+    {
+        label: 'Client Secret Post',
+        value: CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD
+    },
+    {
+        label: 'Client Secret JWT',
+        value: CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD
+    },
+    {
+        label: 'Private Key JWT',
+        value: PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD
+    },
+    {
+        label: 'None (Public PKCE)',
+        value: PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD
+    }
+];
+/**
+ * All available OIDC token endpoint auth methods for the demo app, suitable for use in auth method picker fields.
+ */ var ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHODS = ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS.map(function(x) {
+    return x.value;
+});
+
+/**
+ * Suffix appended to a default profile's description in {@link oidcProviderProfileDetails}, so an
+ * admin viewing the picker sees that leaving the field empty still grants that profile's scopes.
+ */ var OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX = 'Applied by default when no profiles are assigned.';
+// MARK: Utility
+/**
+ * Filters the provider-profile registry to the profiles matching the given assigned keys.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @param keys - The profile keys assigned to a client (e.g. `OidcEntry` `dbx_provider_profiles`).
+ * @returns The registry profiles whose key is in `keys`.
+ */ function oidcProviderProfilesForKeys(profiles, keys) {
+    var keySet = new Set(keys !== null && keys !== void 0 ? keys : []);
+    return profiles.filter(function(profile) {
+        return keySet.has(profile.key);
+    });
+}
+/**
+ * Filters the provider-profile registry to the profiles marked {@link OidcProviderProfile.isDefault}.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The registry profiles that apply to a client with no assigned profiles.
+ */ function defaultOidcProviderProfiles(profiles) {
+    return profiles.filter(function(profile) {
+        return profile.isDefault === true;
+    });
+}
+/**
+ * Resolves the profiles that apply to a client: its assigned profiles, or — when it has NO profiles
+ * assigned — the registry's default profiles.
+ *
+ * The fallback is exclusive: a client with any assigned key resolves to exactly
+ * {@link oidcProviderProfilesForKeys}, so a non-default assignment never additionally confers the
+ * default profiles' scopes. A registry declaring no default behaves identically to
+ * {@link oidcProviderProfilesForKeys}.
+ *
+ * The fallback keys off the assigned key list being empty/absent rather than off the resolved set
+ * being empty, so a client whose assigned profile was later removed from the registry resolves to no
+ * profiles (fail-closed) rather than silently picking up the default.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @param keys - The profile keys assigned to the client (its `dbx_provider_profiles`).
+ * @returns The client's assigned profiles, or the default profiles when none are assigned.
+ */ function oidcProviderProfilesForClient(profiles, keys) {
+    return (keys === null || keys === void 0 ? void 0 : keys.length) ? oidcProviderProfilesForKeys(profiles, keys) : defaultOidcProviderProfiles(profiles);
+}
+/**
+ * Collects every scope referenced by the given profiles.
+ *
+ * Passed the full registry, this is the set of "profile-gated" scopes — scopes a client may only
+ * obtain via a profile. Passed a client's assigned profiles, this is the set of scopes those
+ * profiles unlock for that client.
+ *
+ * Note a gated scope is not necessarily unavailable to an unassigned client: a scope unlocked by a
+ * default profile is gated yet reachable by every client. Use
+ * {@link assignmentOnlyScopesForOidcProviderProfiles} for the "requires an explicit assignment"
+ * subset (e.g. to exclude scopes from a general picker or from advertised scope metadata).
+ *
+ * @param profiles - The profiles to collect scopes from.
+ * @returns The union of every profile's scopes.
+ */ function scopesForOidcProviderProfiles(profiles) {
+    var result = new Set();
+    profiles.forEach(function(profile) {
+        return profile.scopes.forEach(function(scopeConfig) {
+            return result.add(scopeConfig.scope);
+        });
+    });
+    return result;
+}
+/**
+ * Collects the scopes marked `require: 'required'` across the given profiles.
+ *
+ * @param profiles - The profiles to collect required scopes from (typically a client's assigned profiles).
+ * @returns The union of every profile's `required` scopes.
+ */ function requiredScopesForOidcProviderProfiles(profiles) {
+    var result = new Set();
+    profiles.forEach(function(profile) {
+        return profile.scopes.forEach(function(scopeConfig) {
+            if (scopeConfig.require === 'required') {
+                result.add(scopeConfig.scope);
+            }
+        });
+    });
+    return result;
+}
+/**
+ * Collects the scopes unlocked by the registry's default profiles — the scopes every client can
+ * obtain, including one with no profiles assigned.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The union of every default profile's scopes. Empty when no profile is marked default.
+ */ function defaultUnlockedScopesForOidcProviderProfiles(profiles) {
+    return scopesForOidcProviderProfiles(defaultOidcProviderProfiles(profiles));
+}
+/**
+ * Collects the gated scopes that are NOT unlocked by default — the scopes a client can only obtain
+ * via an explicit profile assignment.
+ *
+ * This is the set to exclude from a general scope picker or from advertised scope metadata (e.g. an
+ * MCP protected-resource document's `scopes_supported`). Prefer it over
+ * {@link scopesForOidcProviderProfiles} for that job: the full gated set would wrongly drop a
+ * default-unlocked scope that every client can in fact obtain. With no default declared the two are
+ * identical.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns Every profile-gated scope minus the default-unlocked ones.
+ */ function assignmentOnlyScopesForOidcProviderProfiles(profiles) {
+    var defaultUnlockedScopes = defaultUnlockedScopesForOidcProviderProfiles(profiles);
+    var result = new Set();
+    scopesForOidcProviderProfiles(profiles).forEach(function(scope) {
+        if (!defaultUnlockedScopes.has(scope)) {
+            result.add(scope);
+        }
+    });
+    return result;
+}
+/**
+ * Collects the scopes of every profile marked {@link OidcProviderProfile.adminOnly}.
+ *
+ * Unioned with `OidcProviderConfig.adminOnlyScopes` by the consent admin-only gate: a consent
+ * requesting one of these scopes is hard-rejected with `access_denied` when the resolving user is
+ * not an admin.
+ *
+ * @param profiles - The full provider-profile registry.
+ * @returns The union of every admin-only profile's scopes. Empty when no profile is marked admin-only.
+ */ function adminOnlyScopesForOidcProviderProfiles(profiles) {
+    return scopesForOidcProviderProfiles(profiles.filter(function(profile) {
+        return profile.adminOnly === true;
+    }));
+}
+/**
+ * Builds picker entries for the given provider profiles, suitable for an admin profile-selection field.
+ *
+ * A default profile's description carries {@link OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX} so
+ * an admin isn't surprised that an empty selection still grants scopes. Default profiles are
+ * deliberately not pre-selected — persisting the default as an explicit assignment would opt the
+ * client out of the fallback, so it would stop tracking the registry if the default later changed.
+ *
+ * @param profiles - The provider-profile registry.
+ * @returns One {@link OidcProviderProfileDetails} per profile.
+ */ function oidcProviderProfileDetails(profiles) {
+    return profiles.map(function(profile) {
+        return {
+            value: profile.key,
+            label: profile.label,
+            description: profile.isDefault ? [
+                profile.description,
+                OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX
+            ].filter(Boolean).join(' ') : profile.description
+        };
+    });
+}
+
 /**
  * Prefix shared by every callModel OIDC scope (e.g., `model.create`).
  *
@@ -12074,6 +12339,100 @@ var OFFLINE_ACCESS_OIDC_SCOPE_DETAILS = {
     value: SERVICE_TOKEN_OIDC_SCOPE,
     description: 'Admin-only: issue a long-lived, non-rotating token for server/API use'
 };
+/**
+ * Parses a raw OIDC `scope` claim (a space-delimited string) into the granted scope set consumed by
+ * {@link oidcScopeTermSatisfied} / {@link oidcScopeTermsSatisfied}.
+ *
+ * The single source of truth for scope-string parsing, shared by the server-side `getOidcScopesFromRequest`
+ * (which reads `request.auth.token.scope`) and the model-api-layer enforcement (which reads the OIDC-validated
+ * token off the request auth). Returns `undefined` when the claim is not a string — i.e. the caller is not
+ * OIDC-authenticated (a regular Firebase ID token carries no `scope` claim) — so callers can distinguish
+ * "no OIDC scopes to enforce against" (bypass) from "OIDC caller that was granted zero scopes" (empty set).
+ *
+ * @param scope - The raw `scope` claim value, typically a space-delimited string.
+ * @returns A `Set` of the granted scopes, or `undefined` when `scope` is not a string.
+ */ function oidcScopesFromScopeClaim(scope) {
+    var result = typeof scope === 'string' ? new Set(scope.split(' ').filter(function(value) {
+        return value.length > 0;
+    })) : undefined;
+    return result;
+}
+/**
+ * Returns whether a single {@link OidcScopeTerm} is satisfied by the granted scope set.
+ *
+ * A string term requires that exact scope; an array term is an OR-group satisfied by ANY member (an
+ * empty group is vacuously satisfied — no requirement).
+ *
+ * @param term - The scope term to test.
+ * @param grantedScopes - The scopes the caller holds.
+ * @returns `true` when the caller satisfies the term.
+ */ function oidcScopeTermSatisfied(term, grantedScopes) {
+    return typeof term === 'string' ? grantedScopes.has(term) : term.length === 0 || term.some(function(scope) {
+        return grantedScopes.has(scope);
+    });
+}
+/**
+ * Returns whether EVERY {@link OidcScopeTerm} is satisfied by the granted scope set (AND-of-ORs).
+ *
+ * The single source of truth shared by the server-side callModel scope enforcement
+ * (`assertModelApiOidcScope`) and the MCP tool-visibility filter, so enforcement and tool-list
+ * visibility never drift. An empty term list is vacuously satisfied.
+ *
+ * @param terms - The AND-ed scope terms; each is a single scope or an OR-group.
+ * @param grantedScopes - The scopes the caller holds.
+ * @returns `true` when the caller satisfies every term.
+ */ function oidcScopeTermsSatisfied(terms, grantedScopes) {
+    return terms.every(function(term) {
+        return oidcScopeTermSatisfied(term, grantedScopes);
+    });
+}
+/**
+ * Resolves the effective {@link OidcScopeTerm} an {@link OidcModelScopeRequirement} imposes for a
+ * given call verb.
+ *
+ * A single-term requirement applies to every verb; a verb-keyed requirement returns the matching
+ * verb entry, falling back to its `default`. Returns `undefined` when the requirement imposes no
+ * term for the verb.
+ *
+ * @param requirement - The per-model requirement.
+ * @param call - The call verb being resolved.
+ * @returns The effective term for the verb, or `undefined`.
+ */ function resolveOidcModelScopeRequirement(requirement, call) {
+    var _verbMap_call;
+    var isTerm = typeof requirement === 'string' || Array.isArray(requirement);
+    var verbMap = requirement;
+    return isTerm ? requirement : (_verbMap_call = verbMap[call]) !== null && _verbMap_call !== void 0 ? _verbMap_call : verbMap.default;
+}
+/**
+ * Resolves the full AND-ed list of {@link OidcScopeTerm}s enforced for one callModel op — the single
+ * composition rule shared by the server model-api scope gate and the MCP visibility filter (no drift).
+ *
+ * The list is the per-verb scope AND the effective GROUP term, where the group term is resolved by
+ * precedence: per-function `requiredScope` (finest) > model-level requirement (verb-resolved; covers
+ * plain reads) > configured default. Nullish and empty-OR-group terms are dropped, so an op with no
+ * requirement yields an empty list (no scope gate — the caller can skip reading scopes). With no
+ * config supplied and no per-function scope, the list is exactly `[perVerbScope]` (or empty), matching
+ * the pre-grouping behavior.
+ *
+ * @param input - The per-verb scope, per-function scope, model requirement, verb, and default.
+ * @returns The AND-ed scope terms to enforce (possibly empty).
+ */ function resolveEffectiveOidcScopeTerms(input) {
+    var _ref;
+    var perVerbScope = input.perVerbScope, requiredScope = input.requiredScope, modelRequirement = input.modelRequirement, call = input.call, defaultRequiredScope = input.defaultRequiredScope;
+    var modelTerm = modelRequirement == null ? undefined : resolveOidcModelScopeRequirement(modelRequirement, call);
+    var effectiveGroupTerm = (_ref = requiredScope !== null && requiredScope !== void 0 ? requiredScope : modelTerm) !== null && _ref !== void 0 ? _ref : defaultRequiredScope;
+    var result = [];
+    for(var _i = 0, _iter = [
+        perVerbScope,
+        effectiveGroupTerm
+    ]; _i < _iter.length; _i++){
+        var term = _iter[_i];
+        if (term != null && !(Array.isArray(term) && term.length === 0)) {
+            result.push(term);
+        }
+    }
+    return result;
+}
 
 function _array_like_to_array$6(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
@@ -18858,180 +19217,6 @@ var OIDC_MODEL_CRUD_FUNCTIONS_CONFIG = {
  * ```
  */ var oidcModelFunctionMap = callModelFirebaseFunctionMapFactory(OIDC_FUNCTION_TYPE_CONFIG_MAP, OIDC_MODEL_CRUD_FUNCTIONS_CONFIG);
 
-/**
- * The `client_secret_basic` confidential-client auth method (RFC 6749 §2.3.1, the
- * OAuth 2.0 default): the client sends its `client_id` and `client_secret` in the
- * `Authorization: Basic` header on token-endpoint requests. Standard pick for
- * server-side confidential clients.
- *
- * @example
- * ```ts
- * await oidcClientService.createClient({
- *   token_endpoint_auth_method: CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD,
- *   // ...
- * });
- * ```
- */ var CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_basic';
-/**
- * The `client_secret_post` confidential-client auth method (RFC 6749 §2.3.1, the
- * form-body variant): the client sends `client_id` and `client_secret` as form-encoded
- * parameters in the token-endpoint request body. Equivalent in security to
- * {@link CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD}; pick it for clients that
- * cannot set the `Authorization` header (some older HTTP stacks).
- *
- * @example
- * ```ts
- * await oidcClientService.createClient({
- *   token_endpoint_auth_method: CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD,
- *   // ...
- * });
- * ```
- */ var CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_post';
-/**
- * The `client_secret_jwt` confidential-client auth method (OIDC Core §9): the client
- * signs a JWT client assertion using its `client_secret` as the HMAC key (HS256/HS384/HS512)
- * and sends it as `client_assertion` on token-endpoint requests. The secret never goes on
- * the wire — only the signed assertion — which is the upgrade over the plain
- * `client_secret_*` methods, without requiring asymmetric keys like
- * {@link PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD}.
- *
- * @example
- * ```ts
- * await oidcClientService.createClient({
- *   token_endpoint_auth_method: CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD,
- *   // ...
- * });
- * ```
- */ var CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD = 'client_secret_jwt';
-/**
- * The `private_key_jwt` confidential-client auth method (OIDC Core §9): the client signs
- * a JWT client assertion with its private key (RS256/ES256/PS256) and sends it as
- * `client_assertion`; the server verifies via the client's published `jwks` / `jwks_uri`.
- * Strongest of the confidential-client methods — no shared secret is ever held by the
- * server — and the canonical pick for high-trust server-to-server integrations.
- *
- * @example
- * ```ts
- * await oidcClientService.createClient({
- *   token_endpoint_auth_method: PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD,
- *   jwks: { keys: [publicJwk] },
- *   // ...
- * });
- * ```
- */ var PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD = 'private_key_jwt';
-/**
- * The public-client auth method (`'none'`): no client secret, PKCE-only. The client
- * authenticates the `authorization_code` flow with PKCE (RFC 7636) alone — there is no
- * shared secret and no client assertion. Canonical pick for clients that cannot keep a
- * secret (native apps, SPAs, CLIs) and what the MCP / Claude connector ecosystem
- * (claude.ai connector, Claude Code CLI, mcp-inspector via DCR) registers as.
- *
- * Mirrors {@link PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD}. `oidc-provider` still
- * enforces PKCE on the `authorization_code` flow for every client regardless of auth
- * method, so `'none'` simply unlocks the secret-less variant rather than disabling any
- * client authentication.
- *
- * @example
- * ```ts
- * await oidcClientService.createClient({
- *   token_endpoint_auth_method: PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD,
- *   // no client_secret — public PKCE client
- *   // ...
- * });
- * ```
- */ var PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD = 'none';
-/**
- * All available token endpoint auth method options with display labels.
- */ var ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS = [
-    {
-        label: 'Client Secret Basic',
-        value: CLIENT_SECRET_BASIC_TOKEN_ENDPOINT_AUTH_METHOD
-    },
-    {
-        label: 'Client Secret Post',
-        value: CLIENT_SECRET_POST_TOKEN_ENDPOINT_AUTH_METHOD
-    },
-    {
-        label: 'Client Secret JWT',
-        value: CLIENT_SECRET_JWT_TOKEN_ENDPOINT_AUTH_METHOD
-    },
-    {
-        label: 'Private Key JWT',
-        value: PRIVATE_KEY_JWT_TOKEN_ENDPOINT_AUTH_METHOD
-    },
-    {
-        label: 'None (Public PKCE)',
-        value: PUBLIC_PKCE_TOKEN_ENDPOINT_AUTH_METHOD
-    }
-];
-/**
- * All available OIDC token endpoint auth methods for the demo app, suitable for use in auth method picker fields.
- */ var ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHODS = ALL_OIDC_TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS.map(function(x) {
-    return x.value;
-});
-
-// MARK: Utility
-/**
- * Filters the provider-profile registry to the profiles matching the given assigned keys.
- *
- * @param profiles - The full provider-profile registry.
- * @param keys - The profile keys assigned to a client (e.g. `OidcEntry` `dbx_provider_profiles`).
- * @returns The registry profiles whose key is in `keys`.
- */ function oidcProviderProfilesForKeys(profiles, keys) {
-    var keySet = new Set(keys !== null && keys !== void 0 ? keys : []);
-    return profiles.filter(function(profile) {
-        return keySet.has(profile.key);
-    });
-}
-/**
- * Collects every scope referenced by the given profiles.
- *
- * Passed the full registry, this is the set of "profile-gated" scopes — scopes a client may only
- * obtain via a profile. Passed a client's assigned profiles, this is the set of scopes those
- * profiles unlock for that client.
- *
- * @param profiles - The profiles to collect scopes from.
- * @returns The union of every profile's scopes.
- */ function scopesForOidcProviderProfiles(profiles) {
-    var result = new Set();
-    profiles.forEach(function(profile) {
-        return profile.scopes.forEach(function(scopeConfig) {
-            return result.add(scopeConfig.scope);
-        });
-    });
-    return result;
-}
-/**
- * Collects the scopes marked `require: 'required'` across the given profiles.
- *
- * @param profiles - The profiles to collect required scopes from (typically a client's assigned profiles).
- * @returns The union of every profile's `required` scopes.
- */ function requiredScopesForOidcProviderProfiles(profiles) {
-    var result = new Set();
-    profiles.forEach(function(profile) {
-        return profile.scopes.forEach(function(scopeConfig) {
-            if (scopeConfig.require === 'required') {
-                result.add(scopeConfig.scope);
-            }
-        });
-    });
-    return result;
-}
-/**
- * Builds picker entries for the given provider profiles, suitable for an admin profile-selection field.
- *
- * @param profiles - The provider-profile registry.
- * @returns One {@link OidcProviderProfileDetails} per profile.
- */ function oidcProviderProfileDetails(profiles) {
-    return profiles.map(function(profile) {
-        return {
-            value: profile.key,
-            label: profile.label,
-            description: profile.description
-        };
-    });
-}
-
 /**
  * Thrown if the target uploaded file does not exist.
  */ var UPLOADED_FILE_DOES_NOT_EXIST_ERROR_CODE = 'UPLOADED_FILE_DOES_NOT_EXIST';
@@ -21739,6 +21924,7 @@ exports.OFFLINE_ACCESS_OIDC_SCOPE_DETAILS = OFFLINE_ACCESS_OIDC_SCOPE_DETAILS;
 exports.OIDC_ENTRY_CLIENT_TYPE = OIDC_ENTRY_CLIENT_TYPE;
 exports.OIDC_FUNCTION_TYPE_CONFIG_MAP = OIDC_FUNCTION_TYPE_CONFIG_MAP;
 exports.OIDC_MODEL_CRUD_FUNCTIONS_CONFIG = OIDC_MODEL_CRUD_FUNCTIONS_CONFIG;
+exports.OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX = OIDC_PROVIDER_PROFILE_DEFAULT_DESCRIPTION_SUFFIX;
 exports.OPENID_OIDC_SCOPE = OPENID_OIDC_SCOPE;
 exports.OPENID_OIDC_SCOPE_DETAILS = OPENID_OIDC_SCOPE_DETAILS;
 exports.OidcEntryDocument = OidcEntryDocument;
@@ -21802,6 +21988,7 @@ exports.abstractSubscribeOrUnsubscribeToNotificationBoxParamsType = abstractSubs
 exports.abstractSubscribeToNotificationBoxParamsType = abstractSubscribeToNotificationBoxParamsType;
 exports.addConstraintToBuilder = addConstraintToBuilder;
 exports.addOrReplaceLimitInConstraints = addOrReplaceLimitInConstraints;
+exports.adminOnlyScopesForOidcProviderProfiles = adminOnlyScopesForOidcProviderProfiles;
 exports.allChildDocumentsUnderParent = allChildDocumentsUnderParent;
 exports.allChildDocumentsUnderParentPath = allChildDocumentsUnderParentPath;
 exports.allChildDocumentsUnderRelativePath = allChildDocumentsUnderRelativePath;
@@ -21819,6 +22006,7 @@ exports.assignDateCellScheduleFunction = assignDateCellScheduleFunction;
 exports.assignUnitedStatesAddressFunction = assignUnitedStatesAddressFunction;
 exports.assignWebsiteFileLinkFunction = assignWebsiteFileLinkFunction;
 exports.assignWebsiteLinkFunction = assignWebsiteLinkFunction;
+exports.assignmentOnlyScopesForOidcProviderProfiles = assignmentOnlyScopesForOidcProviderProfiles;
 exports.buildFirebaseCollectionTypeModelTypeMap = buildFirebaseCollectionTypeModelTypeMap;
 exports.calculateNsForNotificationUserNotificationBoxRecipientConfigs = calculateNsForNotificationUserNotificationBoxRecipientConfigs;
 exports.calculateStorageFileGroupEmbeddedFileUpdate = calculateStorageFileGroupEmbeddedFileUpdate;
@@ -21863,7 +22051,9 @@ exports.createStorageFileSignedUploadUrlParamsType = createStorageFileSignedUplo
 exports.dataFromDocumentSnapshots = dataFromDocumentSnapshots;
 exports.dataFromSnapshotStream = dataFromSnapshotStream;
 exports.decodeFirebaseAuthOobCode = decodeFirebaseAuthOobCode;
+exports.defaultOidcProviderProfiles = defaultOidcProviderProfiles;
 exports.defaultPagedItemPageDataConverter = defaultPagedItemPageDataConverter;
+exports.defaultUnlockedScopesForOidcProviderProfiles = defaultUnlockedScopesForOidcProviderProfiles;
 exports.delayCompletion = delayCompletion;
 exports.deleteAllQueuedStorageFilesParamsType = deleteAllQueuedStorageFilesParamsType;
 exports.deleteOidcClientParamsType = targetModelParamsType;
@@ -22222,7 +22412,11 @@ exports.oidcEntryIdentity = oidcEntryIdentity;
 exports.oidcGrantEntriesByUidQuery = oidcGrantEntriesByUidQuery;
 exports.oidcModelFunctionMap = oidcModelFunctionMap;
 exports.oidcProviderProfileDetails = oidcProviderProfileDetails;
+exports.oidcProviderProfilesForClient = oidcProviderProfilesForClient;
 exports.oidcProviderProfilesForKeys = oidcProviderProfilesForKeys;
+exports.oidcScopeTermSatisfied = oidcScopeTermSatisfied;
+exports.oidcScopeTermsSatisfied = oidcScopeTermsSatisfied;
+exports.oidcScopesFromScopeClaim = oidcScopesFromScopeClaim;
 exports.onCallCreateModelParams = onCallCreateModelParams;
 exports.onCallCreateModelResult = onCallCreateModelResult;
 exports.onCallCreateModelResultWithDocs = onCallCreateModelResultWithDocs;
@@ -22260,6 +22454,8 @@ exports.regenerateAllFlaggedStorageFileGroupsContentParamsType = regenerateAllFl
 exports.regenerateStorageFileGroupContentParamsType = regenerateStorageFileGroupContentParamsType;
 exports.replaceConstraints = replaceConstraints;
 exports.requiredScopesForOidcProviderProfiles = requiredScopesForOidcProviderProfiles;
+exports.resolveEffectiveOidcScopeTerms = resolveEffectiveOidcScopeTerms;
+exports.resolveOidcModelScopeRequirement = resolveOidcModelScopeRequirement;
 exports.resyncAllNotificationUserParamsType = resyncAllNotificationUserParamsType;
 exports.resyncNotificationUserParamsType = targetModelParamsType;
 exports.rotateOidcClientSecretParamsType = targetModelParamsType;