@dereekb/dbx-cli 13.11.11 → 13.11.12

package/index.esm.js

@@ -9,13 +9,13 @@ import { createInterface } from 'node:readline';
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
 
-function _array_like_to_array$b(arr, len) {
+function _array_like_to_array$c(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$8(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$b(arr);
+function _array_without_holes$9(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$c(arr);
 }
 function _assert_this_initialized(self) {
     if (self === void 0) {
@@ -23,6 +23,35 @@ function _assert_this_initialized(self) {
     }
     return self;
 }
+function asyncGeneratorStep$m(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$m(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$m(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$m(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
 function _call_super(_this, derived, args) {
     derived = _get_prototype_of(derived);
     return _possible_constructor_return(_this, _is_native_reflect_construct() ? Reflect.construct(derived, args || [], _get_prototype_of(_this).constructor) : derived.apply(_this, args));
@@ -49,7 +78,7 @@ function _construct(Parent, args, Class) {
     }
     return _construct.apply(null, arguments);
 }
-function _define_property$d(obj, key, value) {
+function _define_property$e(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -92,13 +121,13 @@ function _instanceof$6(left, right) {
 function _is_native_function(fn) {
     return Function.toString.call(fn).indexOf("[native code]") !== -1;
 }
-function _iterable_to_array$8(iter) {
+function _iterable_to_array$9(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$8() {
+function _non_iterable_spread$9() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$d(target) {
+function _object_spread$e(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -108,7 +137,26 @@ function _object_spread$d(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$d(target, key, source[key]);
+            _define_property$e(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$a(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$a(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$a(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
@@ -126,20 +174,20 @@ function _set_prototype_of(o, p) {
     };
     return _set_prototype_of(o, p);
 }
-function _to_consumable_array$8(arr) {
-    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$b(arr) || _non_iterable_spread$8();
+function _to_consumable_array$9(arr) {
+    return _array_without_holes$9(arr) || _iterable_to_array$9(arr) || _unsupported_iterable_to_array$c(arr) || _non_iterable_spread$9();
 }
 function _type_of$3(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$b(o, minLen) {
+function _unsupported_iterable_to_array$c(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$b(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$c(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$b(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$c(o, minLen);
 }
 function _wrap_native_super(Class) {
     var _cache = typeof Map === "function" ? new Map() : undefined;
@@ -175,6 +223,114 @@ function _is_native_reflect_construct() {
         return !!result;
     })();
 }
+function _ts_generator$m(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Standard exit code used when a CLI command handler throws.
+ *
+ * Used by {@link wrapCommandHandler} when no override is supplied.
+ */ var CLI_EXIT_CODE_HANDLER = 1;
+/**
+ * Exit code used when the auth middleware itself fails (no env, no token, expired refresh,
+ * etc.) — distinct from a handler error so scripts can disambiguate auth from logic failures.
+ */ var CLI_EXIT_CODE_AUTH = 4;
 /**
  * Default secret-redaction patterns. Covers OAuth bearer tokens, access/refresh tokens, and client secrets.
  *
@@ -188,8 +344,10 @@ function _is_native_reflect_construct() {
     /id_token[=:]\s*\S+/gi
 ];
 var _outputOptions = {};
-var _secretPatterns = _to_consumable_array$8(DEFAULT_CLI_SECRET_PATTERNS);
+var _secretPatterns = _to_consumable_array$9(DEFAULT_CLI_SECRET_PATTERNS);
 var _errorMapper;
+var _verbose = false;
+var _timeoutMs;
 /**
  * Configures output options from parsed CLI arguments.
  *
@@ -207,6 +365,117 @@ var _errorMapper;
  */ function getOutputOptions() {
     return _outputOptions;
 }
+/**
+ * Toggles the process-wide verbose flag. The HTTP layer (`call-model.client.ts`,
+ * `oidc.client.ts`) checks {@link isCliVerbose} before each request and emits a
+ * `[<method> <url>]` trace line to stderr when enabled.
+ *
+ * @param value - Whether verbose tracing is on.
+ */ function setCliVerbose(value) {
+    _verbose = value;
+}
+/**
+ * @returns Whether the verbose flag is currently enabled.
+ */ function isCliVerbose() {
+    return _verbose;
+}
+/**
+ * Writes a one-line stderr trace prefixed with `[verbose]` when the verbose
+ * flag is on. No-op otherwise. Kept off stdout so the JSON envelope on stdout
+ * stays parseable.
+ *
+ * @param message - The trace message.
+ */ function verboseLog(message) {
+    if (_verbose) {
+        process.stderr.write("[verbose] ".concat(message, "\n"));
+    }
+}
+/**
+ * Drop-in `fetch` replacement that wraps the request with the configured verbose-trace
+ * and `--timeout` behavior. Aborts via `AbortController` after the configured timeout.
+ *
+ * Translates an aborted request into a {@link CliError} with code `TIMEOUT`.
+ *
+ * @param fetcher - The underlying fetch impl (defaults to global `fetch`). Allows tests to inject.
+ * @param input - The first arg to fetch (URL or Request).
+ * @param init - The RequestInit. Any existing `signal` is preserved; we only attach our own when no signal was supplied.
+ * @returns The fetch Response.
+ */ function tracedFetch(fetcher, input, init) {
+    return _async_to_generator$m(function() {
+        var _ref, fetchImpl, timeoutMs, method, url, controller, timeoutHandle, finalInit, localController, e;
+        return _ts_generator$m(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    fetchImpl = fetcher !== null && fetcher !== void 0 ? fetcher : fetch;
+                    timeoutMs = _timeoutMs;
+                    method = (_ref = init === null || init === void 0 ? void 0 : init.method) !== null && _ref !== void 0 ? _ref : 'GET';
+                    url = typeof input === 'string' ? input : _instanceof$6(input, URL) ? input.toString() : input.url;
+                    verboseLog("".concat(method, " ").concat(url));
+                    finalInit = init;
+                    if (timeoutMs != null && (init === null || init === void 0 ? void 0 : init.signal) == null) {
+                        localController = new AbortController();
+                        controller = localController;
+                        timeoutHandle = setTimeout(function() {
+                            return localController.abort();
+                        }, timeoutMs);
+                        finalInit = _object_spread_props$a(_object_spread$e({}, init !== null && init !== void 0 ? init : {}), {
+                            signal: localController.signal
+                        });
+                    }
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        3,
+                        4,
+                        5
+                    ]);
+                    return [
+                        4,
+                        fetchImpl(input, finalInit)
+                    ];
+                case 2:
+                    return [
+                        2,
+                        _state.sent()
+                    ];
+                case 3:
+                    e = _state.sent();
+                    if (controller === null || controller === void 0 ? void 0 : controller.signal.aborted) {
+                        throw new CliError({
+                            message: "".concat(method, " ").concat(url, ": request aborted after ").concat(timeoutMs, "ms."),
+                            code: 'TIMEOUT'
+                        });
+                    }
+                    throw e;
+                case 4:
+                    if (timeoutHandle) clearTimeout(timeoutHandle);
+                    return [
+                        7
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Sets the process-wide HTTP timeout (in milliseconds) honored by the HTTP layer.
+ *
+ * Pass `undefined` to clear. The HTTP helpers thread this into an `AbortController`
+ * so individual `fetch` calls cancel after the configured duration.
+ *
+ * @param ms - Timeout in ms, or `undefined` to clear.
+ */ function setCliTimeoutMs(ms) {
+    _timeoutMs = ms;
+}
+/**
+ * @returns The current process-wide HTTP timeout in ms, or `undefined` when unset.
+ */ function getCliTimeoutMs() {
+    return _timeoutMs;
+}
 /**
  * Replaces the active secret-redaction pattern list with the given patterns.
  *
@@ -294,7 +563,7 @@ function dumpResponse(data, meta) {
     if (!filePath) {
         return;
     }
-    var content = _object_spread$d({
+    var content = _object_spread$e({
         ok: true,
         data: data
     }, meta ? {
@@ -351,32 +620,38 @@ function pickFromObject(obj, fields) {
     }
     return result;
 }
+function stringifyEnvelope(value) {
+    return _outputOptions.pretty ? JSON.stringify(value, null, 2) : JSON.stringify(value);
+}
 /**
  * Prints a successful command result as a `{ ok: true, data, meta? }` JSON envelope on stdout.
  *
  * Also writes a full unfiltered dump to disk when `dumpDir` is configured, then applies any
- * configured `pick` filter to the stdout payload.
+ * configured `pick` filter to the stdout payload. Honors the global `--pretty` flag for the
+ * stdout payload only (the dump-to-disk path is always pretty-printed).
  *
  * @param data - The command result to emit.
  * @param meta - Optional additional metadata to attach to the envelope.
  */ function outputResult(data, meta) {
     dumpResponse(data, meta);
     var outputData = _outputOptions.pick ? pickFields(data, _outputOptions.pick) : data;
-    var output = _object_spread$d({
+    var output = _object_spread$e({
         ok: true,
         data: outputData
     }, meta ? {
         meta: meta
     } : {});
-    console.log(JSON.stringify(output));
+    console.log(stringifyEnvelope(output));
 }
 /**
  * Prints a failed command result as a `{ ok: false, error, code, suggestion? }` JSON envelope on stdout.
  *
+ * Honors the global `--pretty` flag.
+ *
  * @param error - The thrown value to convert. Mapped via {@link buildErrorOutput} (which consults any registered {@link CliErrorMapper}).
  */ function outputError(error) {
     var output = buildErrorOutput(error);
-    console.log(JSON.stringify(output));
+    console.log(stringifyEnvelope(output));
 }
 /**
  * An error that carries a stable code and optional suggestion for the user.
@@ -389,7 +664,7 @@ function pickFromObject(obj, fields) {
         var _this;
         _this = _call_super(this, CliError, [
             input.message
-        ]), _define_property$d(_this, "code", void 0), _define_property$d(_this, "suggestion", void 0);
+        ]), _define_property$e(_this, "code", void 0), _define_property$e(_this, "suggestion", void 0);
         _this.name = 'CliError';
         _this.code = input.code;
         _this.suggestion = input.suggestion;
@@ -419,7 +694,7 @@ function pickFromObject(obj, fields) {
         }
     }
     if (_instanceof$6(error, CliError)) {
-        return _object_spread$d({
+        return _object_spread$e({
             ok: false,
             error: sanitizeString(error.message),
             code: error.code
@@ -441,7 +716,15 @@ function pickFromObject(obj, fields) {
     };
 }
 
-function asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, key, arg) {
+function _array_like_to_array$b(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$8(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$b(arr);
+}
+function asyncGeneratorStep$l(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -455,26 +738,90 @@ function asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$j(fn) {
+function _async_to_generator$l(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$l(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$l(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
+function _define_property$d(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _iterable_to_array$8(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$8() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread$d(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$d(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$9(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$9(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$9(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _to_consumable_array$8(arr) {
+    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$b(arr) || _non_iterable_spread$8();
+}
 function _type_of$2(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _ts_generator$j(thisArg, body) {
+function _unsupported_iterable_to_array$b(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$b(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$b(o, minLen);
+}
+function _ts_generator$l(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -584,61 +931,22 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * The function name is referenced via {@link CALL_MODEL_APP_FUNCTION_KEY} for consistency with the demo's wiring.
  *
  * @param input - The call envelope describing the API target, access token, model params, and optional fetch override.
- * @param input.apiBaseUrl - The API base URL (the `/model/call` path is appended automatically).
- * @param input.accessToken - The Bearer access token sent in the `Authorization` header.
- * @param input.params - The {@link OnCallTypedModelParams} payload posted as JSON.
- * @param input.fetcher - Optional fetch implementation override (used by tests).
  * @returns The parsed JSON response body cast to `R`.
  */ function callModelOverHttp(input) {
-    return _async_to_generator$j(function() {
-        var _input_fetcher, fetcher, url, res, text, body, _input_params_call, bodyMessage, messageString, message;
-        return _ts_generator$j(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    fetcher = (_input_fetcher = input.fetcher) !== null && _input_fetcher !== void 0 ? _input_fetcher : fetch;
-                    url = "".concat(trimSlash$1(input.apiBaseUrl)).concat(CALL_MODEL_API_PATH);
-                    return [
-                        4,
-                        fetcher(url, {
-                            method: 'POST',
-                            headers: {
-                                'Content-Type': 'application/json',
-                                Accept: 'application/json',
-                                Authorization: "Bearer ".concat(input.accessToken)
-                            },
-                            body: JSON.stringify(input.params)
-                        })
-                    ];
-                case 1:
-                    res = _state.sent();
-                    return [
-                        4,
-                        res.text()
-                    ];
-                case 2:
-                    text = _state.sent();
-                    if (text.length > 0) {
-                        try {
-                            body = JSON.parse(text);
-                        } catch (unused) {
-                            body = text;
-                        }
-                    }
-                    if (!res.ok) {
-                        bodyMessage = (typeof body === "undefined" ? "undefined" : _type_of$2(body)) === 'object' && body && 'message' in body ? body.message : undefined;
-                        messageString = typeof bodyMessage === 'string' ? bodyMessage : undefined;
-                        message = messageString !== null && messageString !== void 0 ? messageString : text || "".concat(res.status, " ").concat(res.statusText);
-                        throw new CliError({
-                            message: "callModel ".concat(input.params.modelType, "/").concat((_input_params_call = input.params.call) !== null && _input_params_call !== void 0 ? _input_params_call : 'unknown', " failed: ").concat(message),
-                            code: codeForStatus(res.status),
-                            suggestion: res.status === 401 || res.status === 403 ? 'Run `<cli> auth login` to refresh credentials.' : undefined
-                        });
-                    }
-                    return [
-                        2,
-                        body
-                    ];
-            }
+    return _async_to_generator$l(function() {
+        var _input_params_call;
+        return _ts_generator$l(this, function(_state) {
+            return [
+                2,
+                requestJson({
+                    method: 'POST',
+                    url: "".concat(trimSlash$1(input.apiBaseUrl)).concat(CALL_MODEL_API_PATH),
+                    accessToken: input.accessToken,
+                    jsonBody: input.params,
+                    fetcher: input.fetcher,
+                    errorPrefix: "callModel ".concat(input.params.modelType, "/").concat((_input_params_call = input.params.call) !== null && _input_params_call !== void 0 ? _input_params_call : 'unknown', " failed")
+                })
+            ];
         });
     })();
 }
@@ -655,90 +963,183 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The request envelope describing the API target, access token, model + key, and optional fetch override.
  * @returns The parsed `{ key, data }` envelope.
  */ function getModelOverHttp(input) {
-    return _async_to_generator$j(function() {
-        var _input_fetcher, fetcher, url, res, _ref, ok, body, fallbackMessage;
-        return _ts_generator$j(this, function(_state) {
+    return _async_to_generator$l(function() {
+        return _ts_generator$l(this, function(_state) {
+            return [
+                2,
+                requestJson({
+                    method: 'GET',
+                    url: "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get?key=").concat(encodeURIComponent(input.key)),
+                    accessToken: input.accessToken,
+                    fetcher: input.fetcher,
+                    errorPrefix: "get ".concat(input.modelType, "/").concat(input.key, " failed")
+                })
+            ];
+        });
+    })();
+}
+/**
+ * Batch-reads up to {@link MAX_MODEL_ACCESS_MULTI_READ_KEYS} Firestore documents in a single request.
+ *
+ * Calls `POST <apiBaseUrl>/model/<modelType>/get` with body `{ keys }` and returns the
+ * `{ results, errors }` envelope. The 50-key cap is enforced client-side so the error surfaces
+ * with a clear `INVALID_ARGUMENT` code before the request is made.
+ *
+ * Backend route: `ModelApiController.getMany` (packages/firebase-server). Same `'read'` role enforcement.
+ *
+ * For >50 keys, use {@link getMultipleModelsOverHttpChunked} to auto-batch and merge.
+ *
+ * @param input - The request envelope describing the API target, access token, model, keys, and optional fetch override.
+ * @returns The parsed `{ results, errors }` envelope.
+ */ function getMultipleModelsOverHttp(input) {
+    return _async_to_generator$l(function() {
+        return _ts_generator$l(this, function(_state) {
+            if (input.keys.length === 0) {
+                throw new CliError({
+                    message: 'get-many requires at least one key.',
+                    code: 'INVALID_ARGUMENT'
+                });
+            }
+            if (input.keys.length > MAX_MODEL_ACCESS_MULTI_READ_KEYS) {
+                throw new CliError({
+                    message: "get-many supports at most ".concat(MAX_MODEL_ACCESS_MULTI_READ_KEYS, " keys (got ").concat(input.keys.length, "). Use getMultipleModelsOverHttpChunked to auto-batch."),
+                    code: 'INVALID_ARGUMENT'
+                });
+            }
+            return [
+                2,
+                requestJson({
+                    method: 'POST',
+                    url: "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get"),
+                    accessToken: input.accessToken,
+                    jsonBody: {
+                        keys: input.keys
+                    },
+                    fetcher: input.fetcher,
+                    errorPrefix: "get-many ".concat(input.modelType, " failed")
+                })
+            ];
+        });
+    })();
+}
+/**
+ * Batch-reads any number of keys by chunking into requests of {@link MAX_MODEL_ACCESS_MULTI_READ_KEYS}
+ * keys each and merging the `{ results, errors }` envelopes across batches.
+ *
+ * Chunks are sent sequentially so a single env doesn't see a burst of concurrent connections.
+ *
+ * @param input - Same shape as {@link GetMultipleModelsOverHttpInput} but without the 50-key cap.
+ * @returns The merged `{ results, errors }` envelope across all chunks.
+ */ function getMultipleModelsOverHttpChunked(input) {
+    return _async_to_generator$l(function() {
+        var chunks, i, mergedResults, mergedErrors, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, chunk, _mergedResults, _mergedErrors, batch, err;
+        return _ts_generator$l(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    fetcher = (_input_fetcher = input.fetcher) !== null && _input_fetcher !== void 0 ? _input_fetcher : fetch;
-                    url = "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get?key=").concat(encodeURIComponent(input.key));
+                    if (input.keys.length === 0) {
+                        throw new CliError({
+                            message: 'get-many requires at least one key.',
+                            code: 'INVALID_ARGUMENT'
+                        });
+                    }
+                    chunks = [];
+                    for(i = 0; i < input.keys.length; i += MAX_MODEL_ACCESS_MULTI_READ_KEYS){
+                        chunks.push(input.keys.slice(i, i + MAX_MODEL_ACCESS_MULTI_READ_KEYS));
+                    }
+                    mergedResults = [];
+                    mergedErrors = [];
+                    _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        6,
+                        7,
+                        8
+                    ]);
+                    _iterator = chunks[Symbol.iterator]();
+                    _state.label = 2;
+                case 2:
+                    if (!!(_iteratorNormalCompletion = (_step = _iterator.next()).done)) return [
+                        3,
+                        5
+                    ];
+                    chunk = _step.value;
                     return [
                         4,
-                        fetcher(url, {
-                            method: 'GET',
-                            headers: {
-                                Accept: 'application/json',
-                                Authorization: "Bearer ".concat(input.accessToken)
-                            }
-                        })
+                        getMultipleModelsOverHttp(_object_spread_props$9(_object_spread$d({}, input), {
+                            keys: chunk
+                        }))
                     ];
-                case 1:
-                    res = _state.sent();
+                case 3:
+                    batch = _state.sent();
+                    (_mergedResults = mergedResults).push.apply(_mergedResults, _to_consumable_array$8(batch.results));
+                    (_mergedErrors = mergedErrors).push.apply(_mergedErrors, _to_consumable_array$8(batch.errors));
+                    _state.label = 4;
+                case 4:
+                    _iteratorNormalCompletion = true;
+                    return [
+                        3,
+                        2
+                    ];
+                case 5:
+                    return [
+                        3,
+                        8
+                    ];
+                case 6:
+                    err = _state.sent();
+                    _didIteratorError = true;
+                    _iteratorError = err;
+                    return [
+                        3,
+                        8
+                    ];
+                case 7:
+                    try {
+                        if (!_iteratorNormalCompletion && _iterator.return != null) {
+                            _iterator.return();
+                        }
+                    } finally{
+                        if (_didIteratorError) {
+                            throw _iteratorError;
+                        }
+                    }
                     return [
-                        4,
-                        readJsonResponse(res)
+                        7
                     ];
-                case 2:
-                    _ref = _state.sent(), ok = _ref.ok, body = _ref.body, fallbackMessage = _ref.fallbackMessage;
-                    if (!ok) {
-                        throw new CliError({
-                            message: "get ".concat(input.modelType, "/").concat(input.key, " failed: ").concat(extractMessage(body, fallbackMessage, res)),
-                            code: codeForStatus(res.status),
-                            suggestion: res.status === 401 || res.status === 403 ? 'Run `<cli> auth login` to refresh credentials.' : undefined
-                        });
-                    }
+                case 8:
                     return [
                         2,
-                        body
+                        {
+                            results: mergedResults,
+                            errors: mergedErrors
+                        }
                     ];
             }
         });
     })();
 }
-/**
- * Batch-reads up to {@link MAX_MODEL_ACCESS_MULTI_READ_KEYS} Firestore documents in a single request.
- *
- * Calls `POST <apiBaseUrl>/model/<modelType>/get` with body `{ keys }` and returns the
- * `{ results, errors }` envelope. The 50-key cap is enforced client-side so the error surfaces
- * with a clear `INVALID_ARGUMENT` code before the request is made.
- *
- * Backend route: `ModelApiController.getMany` (packages/firebase-server). Same `'read'` role enforcement.
- *
- * @param input - The request envelope describing the API target, access token, model, keys, and optional fetch override.
- * @returns The parsed `{ results, errors }` envelope.
- */ function getMultipleModelsOverHttp(input) {
-    return _async_to_generator$j(function() {
-        var _input_fetcher, fetcher, url, res, _ref, ok, body, fallbackMessage;
-        return _ts_generator$j(this, function(_state) {
+function requestJson(input) {
+    return _async_to_generator$l(function() {
+        var init, res, _ref, ok, body, fallbackMessage;
+        return _ts_generator$l(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    if (input.keys.length === 0) {
-                        throw new CliError({
-                            message: 'get-many requires at least one key.',
-                            code: 'INVALID_ARGUMENT'
-                        });
-                    }
-                    if (input.keys.length > MAX_MODEL_ACCESS_MULTI_READ_KEYS) {
-                        throw new CliError({
-                            message: "get-many supports at most ".concat(MAX_MODEL_ACCESS_MULTI_READ_KEYS, " keys (got ").concat(input.keys.length, ")."),
-                            code: 'INVALID_ARGUMENT'
-                        });
-                    }
-                    fetcher = (_input_fetcher = input.fetcher) !== null && _input_fetcher !== void 0 ? _input_fetcher : fetch;
-                    url = "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get");
+                    init = _object_spread$d({
+                        method: input.method,
+                        headers: _object_spread$d({
+                            Accept: 'application/json',
+                            Authorization: "Bearer ".concat(input.accessToken)
+                        }, input.jsonBody !== undefined ? {
+                            'Content-Type': 'application/json'
+                        } : {})
+                    }, input.jsonBody !== undefined ? {
+                        body: JSON.stringify(input.jsonBody)
+                    } : {});
                     return [
                         4,
-                        fetcher(url, {
-                            method: 'POST',
-                            headers: {
-                                'Content-Type': 'application/json',
-                                Accept: 'application/json',
-                                Authorization: "Bearer ".concat(input.accessToken)
-                            },
-                            body: JSON.stringify({
-                                keys: input.keys
-                            })
-                        })
+                        tracedFetch(input.fetcher, input.url, init)
                     ];
                 case 1:
                     res = _state.sent();
@@ -750,7 +1151,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                     _ref = _state.sent(), ok = _ref.ok, body = _ref.body, fallbackMessage = _ref.fallbackMessage;
                     if (!ok) {
                         throw new CliError({
-                            message: "get-many ".concat(input.modelType, " failed: ").concat(extractMessage(body, fallbackMessage, res)),
+                            message: "".concat(input.errorPrefix, ": ").concat(extractMessage(body, fallbackMessage, res)),
                             code: codeForStatus(res.status),
                             suggestion: res.status === 401 || res.status === 403 ? 'Run `<cli> auth login` to refresh credentials.' : undefined
                         });
@@ -764,9 +1165,9 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
     })();
 }
 function readJsonResponse(res) {
-    return _async_to_generator$j(function() {
+    return _async_to_generator$l(function() {
         var text, body;
-        return _ts_generator$j(this, function(_state) {
+        return _ts_generator$l(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -902,7 +1303,7 @@ var getCliContext = _cliContextSlot.get;
             });
         },
         getMultipleModels: function getMultipleModels(modelType, keys) {
-            return getMultipleModelsOverHttp({
+            return getMultipleModelsOverHttpChunked({
                 apiBaseUrl: apiBaseUrl,
                 accessToken: accessToken,
                 modelType: modelType,
@@ -912,7 +1313,7 @@ var getCliContext = _cliContextSlot.get;
     };
 }
 
-function asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$k(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -926,22 +1327,227 @@ function asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$i(fn) {
+function _async_to_generator$k(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$k(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$k(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$i(thisArg, body) {
+function _ts_generator$k(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Wraps a yargs command handler with the standard structured-error boilerplate:
+ * any thrown error is converted to a `{ ok: false, ... }` envelope via {@link outputError}
+ * and the process exits with the supplied code (default {@link CLI_EXIT_CODE_HANDLER} = 1).
+ *
+ * Lets command files drop the per-handler `try { ... } catch (e) { outputError(e); process.exit(1); }`
+ * block while keeping the same observable behavior.
+ *
+ * @param handler - The inner command handler to invoke. May be sync or async.
+ * @param exitCode - Optional override for the exit code on failure (defaults to {@link CLI_EXIT_CODE_HANDLER}).
+ * @returns An async handler that delegates to `handler` and converts thrown errors into the standard envelope.
+ */ function wrapCommandHandler(handler) {
+    var exitCode = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : CLI_EXIT_CODE_HANDLER;
+    return function(argv) {
+        return _async_to_generator$k(function() {
+            var e;
+            return _ts_generator$k(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            2,
+                            ,
+                            3
+                        ]);
+                        return [
+                            4,
+                            handler(argv)
+                        ];
+                    case 1:
+                        _state.sent();
+                        return [
+                            3,
+                            3
+                        ];
+                    case 2:
+                        e = _state.sent();
+                        outputError(e);
+                        process.exit(exitCode);
+                        return [
+                            3,
+                            3
+                        ];
+                    case 3:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    };
+}
+/**
+ * Sync variant of {@link wrapCommandHandler} for handlers that never return a Promise.
+ *
+ * Yargs invokes the wrapped function synchronously when registered, so errors thrown by the
+ * inner handler (and by `process.exit` itself when stubbed in tests) propagate synchronously —
+ * which is what `parseSync()`-based tests assert against via `expect(() => ...).toThrow(...)`.
+ *
+ * Use this when the inner handler does not perform any I/O. For async handlers (HTTP calls,
+ * disk reads, prompts) keep using {@link wrapCommandHandler}.
+ *
+ * @param handler - The inner sync command handler.
+ * @param exitCode - Optional override for the exit code on failure.
+ * @returns A sync handler that converts thrown errors into the standard envelope.
+ */ function wrapSyncCommandHandler(handler) {
+    var exitCode = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : CLI_EXIT_CODE_HANDLER;
+    return function(argv) {
+        try {
+            handler(argv);
+        } catch (e) {
+            outputError(e);
+            process.exit(exitCode);
+        }
+    };
+}
+
+function asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$j(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$j(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _ts_generator$j(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1060,18 +1666,12 @@ function _ts_generator$i(thisArg, body) {
             var built = spec.builder ? spec.builder(yargs) : yargs;
             return spec.helpEpilogue ? built.epilogue(spec.helpEpilogue) : built;
         },
-        handler: function handler(argv) {
-            return _async_to_generator$i(function() {
-                var context, result, e;
-                return _ts_generator$i(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$j(function() {
+                var context, result;
+                return _ts_generator$j(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                2,
-                                ,
-                                3
-                            ]);
                             context = requireCliContext();
                             return [
                                 4,
@@ -1083,26 +1683,13 @@ function _ts_generator$i(thisArg, body) {
                         case 1:
                             result = _state.sent();
                             outputResult(spec.mapResult ? spec.mapResult(result) : result);
-                            return [
-                                3,
-                                3
-                            ];
-                        case 2:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                3
-                            ];
-                        case 3:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
 }
 
@@ -1318,7 +1905,7 @@ function _array_with_holes$5(arr) {
 function _array_without_holes$6(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$9(arr);
 }
-function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1332,16 +1919,16 @@ function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$h(fn) {
+function _async_to_generator$i(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$i(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -1441,7 +2028,7 @@ function _unsupported_iterable_to_array$9(o, minLen) {
     if (n === "Map" || n === "Set") return Array.from(n);
     if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$9(o, minLen);
 }
-function _ts_generator$h(thisArg, body) {
+function _ts_generator$i(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1565,9 +2152,9 @@ function _defaultBuildRequestData(params, state, limit) {
     return base;
 }
 function _runItemTasks(input) {
-    return _async_to_generator$h(function() {
+    return _async_to_generator$i(function() {
         var context, items, keys, pageIndex, iterateItem, itemPerformTasksConfig, maxParallelPerPage, indexed, taskConfig, performResult;
-        return _ts_generator$h(this, function(_state) {
+        return _ts_generator$i(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, items = input.items, keys = input.keys, pageIndex = input.pageIndex, iterateItem = input.iterateItem, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -1612,9 +2199,9 @@ function _runItemTasks(input) {
     })();
 }
 function _processPage(input) {
-    return _async_to_generator$h(function() {
+    return _async_to_generator$i(function() {
         var context, raw, pageIndex, responseAdapter, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, items, keys, nextCursorDocumentKey, hasMore, itemResults, _tmp, pageResult, _tmp1, output;
-        return _ts_generator$h(this, function(_state) {
+        return _ts_generator$i(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, raw = input.raw, pageIndex = input.pageIndex, responseAdapter = input.responseAdapter, iterateItem = input.iterateItem, iteratePage = input.iteratePage, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -1749,9 +2336,9 @@ function _evaluateLoopExit(input) {
  * @param config - Iterator configuration.
  * @returns The aggregate result.
  */ function iterateDbxCliCallModel(config) {
-    return _async_to_generator$h(function() {
+    return _async_to_generator$i(function() {
         var context, modelType, call, specifier, params, _config_buildRequestData, buildRequestData, _config_responseAdapter, responseAdapter, limitPerPage, totalItemsLimit, maxPages, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, _config_collectItems, collectItems, _config_collectItemResults, collectItemResults, _config_collectPageResults, collectPageResults, allItems, allItemResults, allPageResults, pageIndex, totalItems, cursorDocumentKey, hitLimit, keepGoing, collectItemsForPage, collectItemResultsForPage, collectPageResultsForPage, effectiveLimit, data, raw, pageOutcome, _allItems, _allItemResults, exit, result;
-        return _ts_generator$h(this, function(_state) {
+        return _ts_generator$i(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = config.context, modelType = config.modelType, call = config.call, specifier = config.specifier, params = config.params, _config_buildRequestData = config.buildRequestData, buildRequestData = _config_buildRequestData === void 0 ? _defaultBuildRequestData : _config_buildRequestData, _config_responseAdapter = config.responseAdapter, responseAdapter = _config_responseAdapter === void 0 ? _defaultResponseAdapter : _config_responseAdapter, limitPerPage = config.limitPerPage, totalItemsLimit = config.totalItemsLimit, maxPages = config.maxPages, iterateItem = config.iterateItem, iteratePage = config.iteratePage, itemPerformTasksConfig = config.itemPerformTasksConfig, maxParallelPerPage = config.maxParallelPerPage, _config_collectItems = config.collectItems, collectItems = _config_collectItems === void 0 ? true : _config_collectItems, _config_collectItemResults = config.collectItemResults, collectItemResults = _config_collectItemResults === void 0 ? iterateItem != null : _config_collectItemResults, _config_collectPageResults = config.collectPageResults, collectPageResults = _config_collectPageResults === void 0 ? iteratePage != null : _config_collectPageResults;
@@ -1852,7 +2439,7 @@ function _evaluateLoopExit(input) {
     })();
 }
 
-function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1866,16 +2453,16 @@ function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$g(fn) {
+function _async_to_generator$h(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -1928,7 +2515,7 @@ function _object_spread_props$7(target, source) {
     }
     return target;
 }
-function _ts_generator$g(thisArg, body) {
+function _ts_generator$h(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2043,18 +2630,12 @@ function _ts_generator$g(thisArg, body) {
         builder: function builder(yargs) {
             return spec.builder ? spec.builder(yargs) : yargs;
         },
-        handler: function handler(argv) {
-            return _async_to_generator$g(function() {
-                var context, data, params, result, e;
-                return _ts_generator$g(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$h(function() {
+                var context, data, params, result;
+                return _ts_generator$h(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                2,
-                                ,
-                                3
-                            ]);
                             context = requireCliContext();
                             data = spec.buildParams(argv);
                             params = _object_spread_props$7(_object_spread$b({
@@ -2072,26 +2653,13 @@ function _ts_generator$g(thisArg, body) {
                         case 1:
                             result = _state.sent();
                             outputResult(spec.mapResult ? spec.mapResult(result) : result);
-                            return [
-                                3,
-                                3
-                            ];
-                        case 2:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                3
-                            ];
-                        case 3:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
 }
 
@@ -2107,104 +2675,415 @@ function _ts_generator$g(thisArg, body) {
     });
 }
 /**
- * Adds the per-command output flag set: `--dump-dir`, `--pick`, and `--pick-all`.
+ * Adds the per-command output flag set: `--dump-dir`, `--pick`, and `--pick-all`.
+ *
+ * @param yargs - The yargs builder to extend.
+ * @returns The same yargs builder with the output options chained on.
+ */ function withOutput(yargs) {
+    return yargs.option('dump-dir', {
+        type: 'string',
+        describe: 'Directory to save full responses as JSON files (overrides config)'
+    }).option('pick', {
+        type: 'string',
+        describe: 'Comma-separated top-level fields to include in output (overrides config)'
+    }).option('pick-all', {
+        type: 'boolean',
+        describe: 'Ignore any configured pick filters and return full response data'
+    });
+}
+/**
+ * Dump file format for {@link runPaginatedList} when `--dump-dir` is set.
+ *
+ * - `raw`: one full JSON page response (concatenated JSON when `--dump-merge=concat`, not standard JSON).
+ * - `page_by_line`: NDJSON with one page response per line.
+ * - `data_by_line`: NDJSON with one record per line.
+ */ var DUMP_OUTPUT_MODES = [
+    'raw',
+    'page_by_line',
+    'data_by_line'
+];
+/**
+ * Across-pages dump merge mode for {@link runPaginatedList}.
+ *
+ * - `replace`: truncate the file each iteration; only the last page survives.
+ * - `concat`: append each page to the file.
+ */ var DUMP_MERGE_MODES = [
+    'replace',
+    'concat'
+];
+/**
+ * Stdout shape when `--multiple-pages > 1`.
+ *
+ * - `meta`: summary only (low memory).
+ * - `pages`: array of page responses (holds all pages in memory).
+ * - `merged_page`: concat all records into one array (holds all records in memory).
+ */ var MULTIPLE_PAGES_OUTPUT_MODES = [
+    'meta',
+    'pages',
+    'merged_page'
+];
+/**
+ * Adds the multi-page pagination flag set shared by every paginated list command.
+ *
+ * Compose from a CLI-specific page/offset builder (e.g. Zoho's `withPagination` adds
+ * `--page` / `--per-page`, then chains this for the multi-page controls).
+ *
+ * @param yargs - The yargs builder to extend.
+ * @returns The same yargs builder with the multi-page options chained on.
+ */ function withMultiplePages(yargs) {
+    return yargs.option('multiple-pages', {
+        type: 'number',
+        default: 1,
+        describe: 'Pages to fetch in this invocation (>=1). Continues from the per-API page/offset flag.'
+    }).option('multiple-pages-output', {
+        type: 'string',
+        choices: MULTIPLE_PAGES_OUTPUT_MODES,
+        default: 'meta',
+        describe: 'Stdout shape when multiple-pages > 1: meta (summary, low memory), pages (array of page responses, WARNING: holds all pages in memory), merged_page (concat all records into one array, WARNING: holds all records in memory).'
+    }).option('dump-output', {
+        type: 'string',
+        choices: DUMP_OUTPUT_MODES,
+        default: 'raw',
+        describe: 'Dump file format when --dump-dir is set. raw: one full JSON page response (concatenated JSON when --dump-merge=concat, not standard JSON). page_by_line: NDJSON of page responses. data_by_line: NDJSON of records.'
+    }).option('dump-merge', {
+        type: 'string',
+        choices: DUMP_MERGE_MODES,
+        default: 'replace',
+        describe: 'Across pages with multiple-pages > 1: replace (truncate file each iteration; only last page survives) or concat (append).'
+    });
+}
+/**
+ * Adds the standard generic-call positional + flag set: `<model> <verb> [specifier]` plus `--data <json>`.
+ *
+ * @param yargs - The yargs builder to extend.
+ * @returns The same yargs builder with the model-call positionals and `--data` option chained on.
+ */ function withCallModelArgs(yargs) {
+    return yargs.positional('model', {
+        type: 'string',
+        demandOption: true,
+        describe: 'Firestore model type (e.g. profile, guestbook)'
+    }).positional('verb', {
+        type: 'string',
+        demandOption: true,
+        describe: 'CRUD verb or custom action type (create, read, update, delete, query, or app-specific)'
+    }).positional('specifier', {
+        type: 'string',
+        describe: 'Optional sub-function specifier'
+    }).option('data', {
+        type: 'string',
+        describe: 'JSON-encoded payload (defaults to {} when omitted)'
+    });
+}
+
+function _async_iterator(iterable) {
+    var method, async, sync, retry = 2;
+    for("undefined" != typeof Symbol && (async = Symbol.asyncIterator, sync = Symbol.iterator); retry--;){
+        if (async && null != (method = iterable[async])) return method.call(iterable);
+        if (sync && null != (method = iterable[sync])) return new AsyncFromSyncIterator(method.call(iterable));
+        async = "@@asyncIterator", sync = "@@iterator";
+    }
+    throw new TypeError("Object is not async iterable");
+}
+function AsyncFromSyncIterator(s) {
+    function AsyncFromSyncIteratorContinuation(r) {
+        if (Object(r) !== r) return Promise.reject(new TypeError(r + " is not an object."));
+        var done = r.done;
+        return Promise.resolve(r.value).then(function(value) {
+            return {
+                value: value,
+                done: done
+            };
+        });
+    }
+    return AsyncFromSyncIterator = function(s) {
+        this.s = s, this.n = s.next;
+    }, AsyncFromSyncIterator.prototype = {
+        s: null,
+        n: null,
+        next: function() {
+            return AsyncFromSyncIteratorContinuation(this.n.apply(this.s, arguments));
+        },
+        return: function(value) {
+            var ret = this.s.return;
+            return void 0 === ret ? Promise.resolve({
+                value: value,
+                done: true
+            }) : AsyncFromSyncIteratorContinuation(ret.apply(this.s, arguments));
+        },
+        throw: function(value) {
+            var thr = this.s.return;
+            return void 0 === thr ? Promise.reject(value) : AsyncFromSyncIteratorContinuation(thr.apply(this.s, arguments));
+        }
+    }, new AsyncFromSyncIterator(s);
+}
+function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$g(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _ts_generator$g(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Returns `true` when the user passed `-` (the conventional "read from stdin" sentinel) as a
+ * positional or flag value. Centralizes the convention so command handlers can pattern-match
+ * consistently.
  *
- * @param yargs - The yargs builder to extend.
- * @returns The same yargs builder with the output options chained on.
- */ function withOutput(yargs) {
-    return yargs.option('dump-dir', {
-        type: 'string',
-        describe: 'Directory to save full responses as JSON files (overrides config)'
-    }).option('pick', {
-        type: 'string',
-        describe: 'Comma-separated top-level fields to include in output (overrides config)'
-    }).option('pick-all', {
-        type: 'boolean',
-        describe: 'Ignore any configured pick filters and return full response data'
-    });
+ * @param value - The raw argv value to inspect.
+ * @returns `true` when the value is exactly `'-'`.
+ * @__NO_SIDE_EFFECTS__
+ */ function isStdinSentinel(value) {
+    return value === '-';
 }
 /**
- * Dump file format for {@link runPaginatedList} when `--dump-dir` is set.
- *
- * - `raw`: one full JSON page response (concatenated JSON when `--dump-merge=concat`, not standard JSON).
- * - `page_by_line`: NDJSON with one page response per line.
- * - `data_by_line`: NDJSON with one record per line.
- */ var DUMP_OUTPUT_MODES = [
-    'raw',
-    'page_by_line',
-    'data_by_line'
-];
-/**
- * Across-pages dump merge mode for {@link runPaginatedList}.
- *
- * - `replace`: truncate the file each iteration; only the last page survives.
- * - `concat`: append each page to the file.
- */ var DUMP_MERGE_MODES = [
-    'replace',
-    'concat'
-];
-/**
- * Stdout shape when `--multiple-pages > 1`.
- *
- * - `meta`: summary only (low memory).
- * - `pages`: array of page responses (holds all pages in memory).
- * - `merged_page`: concat all records into one array (holds all records in memory).
- */ var MULTIPLE_PAGES_OUTPUT_MODES = [
-    'meta',
-    'pages',
-    'merged_page'
-];
-/**
- * Adds the multi-page pagination flag set shared by every paginated list command.
+ * Reads the entire contents of `process.stdin` as a UTF-8 string.
  *
- * Compose from a CLI-specific page/offset builder (e.g. Zoho's `withPagination` adds
- * `--page` / `--per-page`, then chains this for the multi-page controls).
+ * Used by command handlers that accept `-` to mean "read from stdin" (e.g. `--data -`,
+ * `get-many -`). Resolves once the stream emits `end`; no timeout is applied — callers that
+ * need one should wrap with `Promise.race`.
  *
- * @param yargs - The yargs builder to extend.
- * @returns The same yargs builder with the multi-page options chained on.
- */ function withMultiplePages(yargs) {
-    return yargs.option('multiple-pages', {
-        type: 'number',
-        default: 1,
-        describe: 'Pages to fetch in this invocation (>=1). Continues from the per-API page/offset flag.'
-    }).option('multiple-pages-output', {
-        type: 'string',
-        choices: MULTIPLE_PAGES_OUTPUT_MODES,
-        default: 'meta',
-        describe: 'Stdout shape when multiple-pages > 1: meta (summary, low memory), pages (array of page responses, WARNING: holds all pages in memory), merged_page (concat all records into one array, WARNING: holds all records in memory).'
-    }).option('dump-output', {
-        type: 'string',
-        choices: DUMP_OUTPUT_MODES,
-        default: 'raw',
-        describe: 'Dump file format when --dump-dir is set. raw: one full JSON page response (concatenated JSON when --dump-merge=concat, not standard JSON). page_by_line: NDJSON of page responses. data_by_line: NDJSON of records.'
-    }).option('dump-merge', {
-        type: 'string',
-        choices: DUMP_MERGE_MODES,
-        default: 'replace',
-        describe: 'Across pages with multiple-pages > 1: replace (truncate file each iteration; only last page survives) or concat (append).'
-    });
+ * @returns The UTF-8 decoded stdin contents.
+ */ function readAllStdin() {
+    return _async_to_generator$g(function() {
+        var chunks, _iteratorAbruptCompletion, _didIteratorError, _iteratorError, _iterator, _step, _value, chunk, err;
+        return _ts_generator$g(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    chunks = [];
+                    _iteratorAbruptCompletion = false, _didIteratorError = false;
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        6,
+                        7,
+                        12
+                    ]);
+                    _iterator = _async_iterator(process.stdin);
+                    _state.label = 2;
+                case 2:
+                    return [
+                        4,
+                        _iterator.next()
+                    ];
+                case 3:
+                    if (!(_iteratorAbruptCompletion = !(_step = _state.sent()).done)) return [
+                        3,
+                        5
+                    ];
+                    _value = _step.value;
+                    chunk = _value;
+                    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+                    _state.label = 4;
+                case 4:
+                    _iteratorAbruptCompletion = false;
+                    return [
+                        3,
+                        2
+                    ];
+                case 5:
+                    return [
+                        3,
+                        12
+                    ];
+                case 6:
+                    err = _state.sent();
+                    _didIteratorError = true;
+                    _iteratorError = err;
+                    return [
+                        3,
+                        12
+                    ];
+                case 7:
+                    _state.trys.push([
+                        7,
+                        ,
+                        10,
+                        11
+                    ]);
+                    if (!(_iteratorAbruptCompletion && _iterator.return != null)) return [
+                        3,
+                        9
+                    ];
+                    return [
+                        4,
+                        _iterator.return()
+                    ];
+                case 8:
+                    _state.sent();
+                    _state.label = 9;
+                case 9:
+                    return [
+                        3,
+                        11
+                    ];
+                case 10:
+                    if (_didIteratorError) {
+                        throw _iteratorError;
+                    }
+                    return [
+                        7
+                    ];
+                case 11:
+                    return [
+                        7
+                    ];
+                case 12:
+                    return [
+                        2,
+                        Buffer.concat(chunks).toString('utf8')
+                    ];
+            }
+        });
+    })();
 }
 /**
- * Adds the standard generic-call positional + flag set: `<model> <verb> [specifier]` plus `--data <json>`.
+ * Reads stdin as a list of whitespace-separated tokens (newlines, spaces, tabs).
  *
- * @param yargs - The yargs builder to extend.
- * @returns The same yargs builder with the model-call positionals and `--data` option chained on.
- */ function withCallModelArgs(yargs) {
-    return yargs.positional('model', {
-        type: 'string',
-        demandOption: true,
-        describe: 'Firestore model type (e.g. profile, guestbook)'
-    }).positional('verb', {
-        type: 'string',
-        demandOption: true,
-        describe: 'CRUD verb or custom action type (create, read, update, delete, query, or app-specific)'
-    }).positional('specifier', {
-        type: 'string',
-        describe: 'Optional sub-function specifier'
-    }).option('data', {
-        type: 'string',
-        describe: 'JSON-encoded payload (defaults to {} when omitted)'
-    });
+ * Empty tokens are dropped so a trailing newline doesn't introduce a phantom entry.
+ *
+ * @returns The tokens parsed from stdin.
+ */ function readStdinTokens() {
+    return _async_to_generator$g(function() {
+        var raw;
+        return _ts_generator$g(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        readAllStdin()
+                    ];
+                case 1:
+                    raw = _state.sent();
+                    return [
+                        2,
+                        raw.split(RegExp("\\s+", "u")).filter(function(s) {
+                            return s.length > 0;
+                        })
+                    ];
+            }
+        });
+    })();
 }
 
 function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
@@ -2401,23 +3280,42 @@ function _ts_generator$f(thisArg, body) {
     builder: function builder(yargs) {
         return withCallModelArgs(yargs);
     },
-    handler: function handler(argv) {
+    handler: wrapCommandHandler(function(argv) {
         return _async_to_generator$f(function() {
-            var context, data, params, result, e;
+            var context, data, rawData, _tmp, params, result;
             return _ts_generator$f(this, function(_state) {
                 switch(_state.label){
                     case 0:
-                        _state.trys.push([
-                            0,
-                            2,
-                            ,
-                            3
-                        ]);
                         context = requireCliContext();
                         data = {};
-                        if (typeof argv.data === 'string' && argv.data.length > 0) {
+                        if (!(typeof argv.data === 'string' && argv.data.length > 0)) return [
+                            3,
+                            4
+                        ];
+                        if (!isStdinSentinel(argv.data)) return [
+                            3,
+                            2
+                        ];
+                        return [
+                            4,
+                            readAllStdin()
+                        ];
+                    case 1:
+                        _tmp = _state.sent().trim();
+                        return [
+                            3,
+                            3
+                        ];
+                    case 2:
+                        _tmp = argv.data;
+                        _state.label = 3;
+                    case 3:
+                        rawData = _tmp;
+                        _state.label = 4;
+                    case 4:
+                        if (rawData) {
                             try {
-                                data = JSON.parse(argv.data);
+                                data = JSON.parse(rawData);
                             } catch (e) {
                                 throw new CliError({
                                     message: "--data must be valid JSON: ".concat(_instanceof$5(e, Error) ? e.message : String(e)),
@@ -2437,29 +3335,16 @@ function _ts_generator$f(thisArg, body) {
                             4,
                             context.callModel(params)
                         ];
-                    case 1:
+                    case 5:
                         result = _state.sent();
                         outputResult(result);
-                        return [
-                            3,
-                            3
-                        ];
-                    case 2:
-                        e = _state.sent();
-                        outputError(e);
-                        process.exit(1);
-                        return [
-                            3,
-                            3
-                        ];
-                    case 3:
                         return [
                             2
                         ];
                 }
             });
         })();
-    }
+    })
 };
 
 function _array_like_to_array$8(arr, len) {
@@ -2717,14 +3602,9 @@ function _unsupported_iterable_to_array$7(o, minLen) {
                 describe: 'Emit a structured JSON envelope instead of the human-readable block.'
             });
         },
-        handler: function handler(argv) {
-            try {
-                runHandler$1(manifest, argv);
-            } catch (e) {
-                outputError(e);
-                process.exit(1);
-            }
-        }
+        handler: wrapSyncCommandHandler(function(argv) {
+            runHandler$1(manifest, argv);
+        })
     };
 }
 function runHandler$1(manifest, argv) {
@@ -3228,18 +4108,12 @@ function _ts_generator$e(thisArg, body) {
             describe: 'Document key when the first positional is a model name.'
         });
     },
-    handler: function handler(argv) {
+    handler: wrapCommandHandler(function(argv) {
         return _async_to_generator$e(function() {
-            var context, _parseGetArgs, modelType, key, result, e;
+            var context, _parseGetArgs, modelType, key, result;
             return _ts_generator$e(this, function(_state) {
                 switch(_state.label){
                     case 0:
-                        _state.trys.push([
-                            0,
-                            2,
-                            ,
-                            3
-                        ]);
                         context = requireCliContext();
                         _parseGetArgs = parseGetArgs({
                             modelOrKey: typeof argv.modelOrKey === 'string' ? argv.modelOrKey : undefined,
@@ -3252,27 +4126,14 @@ function _ts_generator$e(thisArg, body) {
                         ];
                     case 1:
                         result = _state.sent();
-                        outputResult(result);
-                        return [
-                            3,
-                            3
-                        ];
-                    case 2:
-                        e = _state.sent();
-                        outputError(e);
-                        process.exit(1);
-                        return [
-                            3,
-                            3
-                        ];
-                    case 3:
+                        outputResult(result);
                         return [
                             2
                         ];
                 }
             });
         })();
-    }
+    })
 };
 
 function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
@@ -3406,18 +4267,22 @@ function _ts_generator$d(thisArg, body) {
 /**
  * Top-level `get-many <firstArg> [rest..]` command.
  *
- * Batch-reads up to 50 Firestore documents in a single request. The first positional can either
- * be an explicit modelType (followed by ≥1 keys) or a full key (followed by additional keys whose
- * prefixes must resolve to the same modelType).
+ * Batch-reads Firestore documents by key. The first positional can either be an explicit
+ * modelType (followed by ≥1 keys) or a full key (followed by additional keys whose prefixes
+ * must resolve to the same modelType). Beyond 50 keys the request is automatically chunked
+ * via `context.getMultipleModels`.
+ *
+ * Stdin: pass `-` as the only positional to read whitespace-separated keys from stdin
+ * (e.g. `cat keys.txt | <cli> get-many -`).
  *
  * Backend: `POST <apiBaseUrl>/model/<modelType>/get` with body `{ keys }` (ModelApiController.getMany).
  */ var getManyCommand = {
     command: 'get-many <firstArg> [rest..]',
-    describe: 'Read up to 50 documents by key. ModelType is inferred from key prefixes when they all agree.',
+    describe: 'Read documents by key (auto-chunks beyond 50). Pass `-` to read keys from stdin.',
     builder: function builder(yargs) {
         return yargs.positional('firstArg', {
             type: 'string',
-            describe: 'Full key (e.g. "jws/abc") or model name when the remaining positionals are bare ids.'
+            describe: 'Full key (e.g. "jws/abc"), model name, or "-" to read keys from stdin.'
         }).positional('rest', {
             type: 'string',
             array: true,
@@ -3425,51 +4290,50 @@ function _ts_generator$d(thisArg, body) {
             describe: 'Additional keys (or bare ids when the first positional is a model name).'
         });
     },
-    handler: function handler(argv) {
+    handler: wrapCommandHandler(function(argv) {
         return _async_to_generator$d(function() {
-            var context, _parseGetManyArgs, modelType, keys, result, e;
+            var context, firstArg, rest, resolvedFirst, resolvedRest, stdinKeys, _parseGetManyArgs, modelType, keys, result;
             return _ts_generator$d(this, function(_state) {
                 switch(_state.label){
                     case 0:
-                        _state.trys.push([
-                            0,
-                            2,
-                            ,
-                            3
-                        ]);
                         context = requireCliContext();
+                        firstArg = typeof argv.firstArg === 'string' ? argv.firstArg : undefined;
+                        rest = Array.isArray(argv.rest) ? argv.rest : [];
+                        resolvedFirst = firstArg;
+                        resolvedRest = rest;
+                        if (!(firstArg && isStdinSentinel(firstArg))) return [
+                            3,
+                            2
+                        ];
+                        return [
+                            4,
+                            readStdinTokens()
+                        ];
+                    case 1:
+                        stdinKeys = _state.sent();
+                        resolvedFirst = stdinKeys[0];
+                        resolvedRest = stdinKeys.slice(1);
+                        _state.label = 2;
+                    case 2:
                         _parseGetManyArgs = parseGetManyArgs({
-                            firstArg: typeof argv.firstArg === 'string' ? argv.firstArg : undefined,
-                            rest: Array.isArray(argv.rest) ? argv.rest : [],
+                            firstArg: resolvedFirst,
+                            rest: resolvedRest,
                             manifest: context.modelManifest
                         }), modelType = _parseGetManyArgs.modelType, keys = _parseGetManyArgs.keys;
                         return [
                             4,
                             context.getMultipleModels(modelType, keys)
                         ];
-                    case 1:
+                    case 3:
                         result = _state.sent();
                         outputResult(result);
-                        return [
-                            3,
-                            3
-                        ];
-                    case 2:
-                        e = _state.sent();
-                        outputError(e);
-                        process.exit(1);
-                        return [
-                            3,
-                            3
-                        ];
-                    case 3:
                         return [
                             2
                         ];
                 }
             });
         })();
-    }
+    })
 };
 
 function asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, key, arg) {
@@ -3628,6 +4492,27 @@ function _ts_generator$c(thisArg, body) {
         };
     }
 }
+/**
+ * Returns a copy of the env config with the OAuth client id and secret masked via
+ * {@link maskSecret}. The remaining URLs/scopes pass through untouched.
+ *
+ * Used by every command that surfaces an env to the user (`auth status`, `auth show`,
+ * `env list`, `env show`, …) so secrets never end up in the JSON envelope.
+ *
+ * @param env - The env config to mask.
+ * @returns A plain object suitable for the structured stdout envelope.
+ * @__NO_SIDE_EFFECTS__
+ */ function maskEnv(env) {
+    return {
+        apiBaseUrl: env.apiBaseUrl,
+        oidcIssuer: env.oidcIssuer,
+        appClientUrl: env.appClientUrl,
+        clientId: env.clientId ? maskSecret(env.clientId) : undefined,
+        clientSecret: env.clientSecret ? maskSecret(env.clientSecret) : undefined,
+        redirectUri: env.redirectUri,
+        scopes: env.scopes
+    };
+}
 /**
  * Loads the persisted CLI config from disk. Returns `undefined` when the file is missing.
  *
@@ -3914,6 +4799,245 @@ function nonEmpty(value) {
     return Boolean((env === null || env === void 0 ? void 0 : env.apiBaseUrl) && (env === null || env === void 0 ? void 0 : env.oidcIssuer) && (env === null || env === void 0 ? void 0 : env.clientId) && (env === null || env === void 0 ? void 0 : env.clientSecret) && (env === null || env === void 0 ? void 0 : env.redirectUri));
 }
 
+function asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$b(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _ts_generator$b(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Builds the conventional `<CLINAME>_ENV` env var name from the CLI binary name.
+ *
+ * Example: `demo-cli` → `DEMO_CLI_ENV`.
+ *
+ * @param cliName - The CLI's binary name (typically a kebab-case slug).
+ * @returns The uppercased, underscored env var name used to override the active env.
+ * @__NO_SIDE_EFFECTS__
+ */ function getCliEnvVarName(cliName) {
+    return "".concat(cliName.replaceAll('-', '_').toUpperCase(), "_ENV");
+}
+/**
+ * Resolves the active env for a CLI invocation in one call.
+ *
+ * Performs the env-resolution dance that every per-env command needs:
+ *   1. Load `<configDir>/config.json` (may be missing — returns `{}` in that case).
+ *   2. Resolve env name: `flagEnv` → `process.env[<CLINAME>_ENV]` → `config.activeEnv`.
+ *   3. Look up the stored env block (may be missing).
+ *   4. Merge with the matching {@link CliEnvDefault} (when one is registered).
+ *   5. Overlay `<CLINAME>_*` env var overrides.
+ *
+ * Non-throwing: returns `{ env: undefined, envName: undefined }` when the user has not
+ * configured anything. Use {@link resolveCliEnvOrThrow} for the "command requires an env"
+ * variant.
+ *
+ * @param input - Resolution inputs.
+ * @returns The resolved env triple.
+ */ function resolveCliEnv(input) {
+    return _async_to_generator$b(function() {
+        var _ref, _input_envVarName, _ref1, _input_flagEnv, _config_envs, _findCliEnvDefault, config, envVarName, envName, stored, defaultEnv, merged, env;
+        return _ts_generator$b(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        loadCliConfig({
+                            configFilePath: input.paths.configFilePath
+                        })
+                    ];
+                case 1:
+                    config = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : {};
+                    envVarName = (_input_envVarName = input.envVarName) !== null && _input_envVarName !== void 0 ? _input_envVarName : getCliEnvVarName(input.cliName);
+                    envName = (_ref1 = (_input_flagEnv = input.flagEnv) !== null && _input_flagEnv !== void 0 ? _input_flagEnv : process.env[envVarName]) !== null && _ref1 !== void 0 ? _ref1 : config.activeEnv;
+                    stored = envName ? (_config_envs = config.envs) === null || _config_envs === void 0 ? void 0 : _config_envs[envName] : undefined;
+                    defaultEnv = envName ? (_findCliEnvDefault = findCliEnvDefault({
+                        name: envName,
+                        defaults: input.defaultEnvs
+                    })) === null || _findCliEnvDefault === void 0 ? void 0 : _findCliEnvDefault.env : undefined;
+                    merged = mergeCliEnvWithDefault({
+                        env: stored,
+                        defaultEnv: defaultEnv
+                    });
+                    env = applyEnvVarOverrides({
+                        cliName: input.cliName,
+                        env: merged
+                    });
+                    return [
+                        2,
+                        {
+                            config: config,
+                            envName: envName,
+                            env: env
+                        }
+                    ];
+            }
+        });
+    })();
+}
+function resolveCliEnvOrThrow(input) {
+    return _async_to_generator$b(function() {
+        var _ref, config, envName, env;
+        return _ts_generator$b(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        resolveCliEnv(input)
+                    ];
+                case 1:
+                    _ref = _state.sent(), config = _ref.config, envName = _ref.envName, env = _ref.env;
+                    if (!envName) {
+                        throw new CliError({
+                            message: 'No env selected. Run `<cli> env add <name>` and `<cli> env use <name>`, or pass `--env <name>`.',
+                            code: 'NO_ACTIVE_ENV'
+                        });
+                    }
+                    if (!env) {
+                        throw new CliError({
+                            message: 'Env "'.concat(envName, '" is not configured. Run `').concat(input.cliName, " auth setup --env ").concat(envName, "`."),
+                            code: 'ENV_NOT_FOUND'
+                        });
+                    }
+                    if (input.requireComplete && !isCliEnvConfigComplete(env)) {
+                        throw new CliError({
+                            message: 'Env "'.concat(envName, '" is missing OIDC fields. Run `').concat(input.cliName, " auth setup --env ").concat(envName, "` first."),
+                            code: 'AUTH_ENV_INCOMPLETE'
+                        });
+                    }
+                    return [
+                        2,
+                        {
+                            config: config,
+                            envName: envName,
+                            env: env
+                        }
+                    ];
+            }
+        });
+    })();
+}
+
 /**
  * Builds the on-disk path layout for a CLI's config directory.
  *
@@ -3969,7 +5093,7 @@ function nonEmpty(value) {
     }).hasExpired();
 }
 
-function asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3983,16 +5107,16 @@ function asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$b(fn) {
+function _async_to_generator$a(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$b(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -4034,7 +5158,7 @@ function _object_spread$8(target) {
     }
     return target;
 }
-function _ts_generator$b(thisArg, body) {
+function _ts_generator$a(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4179,9 +5303,9 @@ function _ts_generator$b(thisArg, body) {
  * @param input.fallbackBaseUrl - Optional sibling base URL tried after the issuer-prefixed and origin-rooted candidates.
  * @returns The parsed {@link OidcDiscoveryMetadata}. Throws a {@link CliError} (`OIDC_DISCOVERY_FAILED`) when every candidate fails.
  */ function discoverOidcMetadata(input) {
-    return _async_to_generator$b(function() {
+    return _async_to_generator$a(function() {
         var _ref, candidates, lastError, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, url, res, e, err;
-        return _ts_generator$b(this, function(_state) {
+        return _ts_generator$a(this, function(_state) {
             switch(_state.label){
                 case 0:
                     candidates = buildOidcDiscoveryCandidates(input);
@@ -4212,7 +5336,7 @@ function _ts_generator$b(thisArg, body) {
                     ]);
                     return [
                         4,
-                        fetch(url, {
+                        tracedFetch(undefined, url, {
                             headers: {
                                 Accept: 'application/json'
                             }
@@ -4302,9 +5426,9 @@ function _ts_generator$b(thisArg, body) {
  * @param input.codeVerifier - The PKCE code verifier originally paired with the code challenge in the authorization request.
  * @returns The parsed {@link OidcTokenResponse} with access/refresh tokens.
  */ function exchangeAuthorizationCode(input) {
-    return _async_to_generator$b(function() {
+    return _async_to_generator$a(function() {
         var params;
-        return _ts_generator$b(this, function(_state) {
+        return _ts_generator$a(this, function(_state) {
             params = new URLSearchParams({
                 grant_type: 'authorization_code',
                 client_id: input.clientId,
@@ -4333,9 +5457,9 @@ function _ts_generator$b(thisArg, body) {
  * @param input.refreshToken - The cached refresh token to redeem.
  * @returns The parsed {@link OidcTokenResponse} with the refreshed access token.
  */ function refreshAccessToken(input) {
-    return _async_to_generator$b(function() {
+    return _async_to_generator$a(function() {
         var params;
-        return _ts_generator$b(this, function(_state) {
+        return _ts_generator$a(this, function(_state) {
             params = new URLSearchParams({
                 grant_type: 'refresh_token',
                 client_id: input.clientId,
@@ -4363,9 +5487,9 @@ function _ts_generator$b(thisArg, body) {
  * @param input.tokenTypeHint - Optional hint passed as `token_type_hint` (`access_token` or `refresh_token`).
  * @returns Resolves when the server returns a non-error status. Throws a {@link CliError} (`TOKEN_REVOCATION_FAILED`) on error.
  */ function revokeToken(input) {
-    return _async_to_generator$b(function() {
+    return _async_to_generator$a(function() {
         var params, res;
-        return _ts_generator$b(this, function(_state) {
+        return _ts_generator$a(this, function(_state) {
             switch(_state.label){
                 case 0:
                     params = new URLSearchParams(_object_spread$8({
@@ -4377,7 +5501,7 @@ function _ts_generator$b(thisArg, body) {
                     } : {}));
                     return [
                         4,
-                        fetch(input.revocationEndpoint, {
+                        tracedFetch(undefined, input.revocationEndpoint, {
                             method: 'POST',
                             headers: {
                                 'Content-Type': 'application/x-www-form-urlencoded',
@@ -4409,14 +5533,14 @@ function _ts_generator$b(thisArg, body) {
  * @param input.accessToken - The Bearer access token sent in the `Authorization` header.
  * @returns The parsed userinfo claims. Throws a {@link CliError} (`USERINFO_FAILED`) on a non-OK response.
  */ function fetchUserInfo(input) {
-    return _async_to_generator$b(function() {
+    return _async_to_generator$a(function() {
         var res;
-        return _ts_generator$b(this, function(_state) {
+        return _ts_generator$a(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
                         4,
-                        fetch(input.userinfoEndpoint, {
+                        tracedFetch(undefined, input.userinfoEndpoint, {
                             headers: {
                                 Authorization: "Bearer ".concat(input.accessToken),
                                 Accept: 'application/json'
@@ -4446,14 +5570,14 @@ function _ts_generator$b(thisArg, body) {
     })();
 }
 function postTokenEndpoint(input) {
-    return _async_to_generator$b(function() {
+    return _async_to_generator$a(function() {
         var res, body, _ref, _body_error_description, message;
-        return _ts_generator$b(this, function(_state) {
+        return _ts_generator$a(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
                         4,
-                        fetch(input.tokenEndpoint, {
+                        tracedFetch(undefined, input.tokenEndpoint, {
                             method: 'POST',
                             headers: {
                                 'Content-Type': 'application/x-www-form-urlencoded',
@@ -4506,7 +5630,7 @@ function _array_like_to_array$5(arr, len) {
 function _array_with_holes$2(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4520,16 +5644,16 @@ function asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$a(fn) {
+function _async_to_generator$9(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$a(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -4573,7 +5697,7 @@ function _unsupported_iterable_to_array$5(o, minLen) {
     if (n === "Map" || n === "Set") return Array.from(n);
     if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
 }
-function _ts_generator$a(thisArg, body) {
+function _ts_generator$9(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4815,9 +5939,9 @@ function _ts_generator$a(thisArg, body) {
  *
  * @returns A {@link PkceMaterial} pair consisting of the random `codeVerifier` and its derived `codeChallenge`.
  */ function generatePkceMaterial() {
-    return _async_to_generator$a(function() {
+    return _async_to_generator$9(function() {
         var codeVerifier, codeChallenge;
-        return _ts_generator$a(this, function(_state) {
+        return _ts_generator$9(this, function(_state) {
             switch(_state.label){
                 case 0:
                     codeVerifier = generatePkceCodeVerifier();
@@ -5021,7 +6145,7 @@ var KEY_DEL = ''; // DEL
     });
 }
 
-function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -5035,16 +6159,16 @@ function asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$9(fn) {
+function _async_to_generator$8(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$9(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -5097,7 +6221,7 @@ function _object_spread_props$5(target, source) {
     }
     return target;
 }
-function _ts_generator$9(thisArg, body) {
+function _ts_generator$8(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5196,69 +6320,6 @@ function _ts_generator$9(thisArg, body) {
         };
     }
 }
-function resolveEnvOrThrow(input) {
-    return _async_to_generator$9(function() {
-        var _ref, _ref1, _input_flagEnv, _config_envs, _findCliEnvDefault, config, envName, stored, defaultEnv, merged, env;
-        return _ts_generator$9(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    return [
-                        4,
-                        loadCliConfig({
-                            configFilePath: input.paths.configFilePath
-                        })
-                    ];
-                case 1:
-                    config = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : {};
-                    envName = (_ref1 = (_input_flagEnv = input.flagEnv) !== null && _input_flagEnv !== void 0 ? _input_flagEnv : process.env[input.envVarName]) !== null && _ref1 !== void 0 ? _ref1 : config.activeEnv;
-                    if (!envName) {
-                        throw new CliError({
-                            message: 'No env selected. Run `<cli> env add <name>` and `<cli> env use <name>`, or pass `--env <name>`.',
-                            code: 'NO_ACTIVE_ENV'
-                        });
-                    }
-                    stored = (_config_envs = config.envs) === null || _config_envs === void 0 ? void 0 : _config_envs[envName];
-                    defaultEnv = (_findCliEnvDefault = findCliEnvDefault({
-                        name: envName,
-                        defaults: input.defaultEnvs
-                    })) === null || _findCliEnvDefault === void 0 ? void 0 : _findCliEnvDefault.env;
-                    merged = mergeCliEnvWithDefault({
-                        env: stored,
-                        defaultEnv: defaultEnv
-                    });
-                    env = applyEnvVarOverrides({
-                        cliName: input.cliName,
-                        env: merged
-                    });
-                    if (!env) {
-                        throw new CliError({
-                            message: 'Env "'.concat(envName, '" is not configured. Run `<cli> auth setup --env ').concat(envName, "`."),
-                            code: 'ENV_NOT_FOUND'
-                        });
-                    }
-                    return [
-                        2,
-                        {
-                            envName: envName,
-                            env: env,
-                            config: config
-                        }
-                    ];
-            }
-        });
-    })();
-}
-function maskEnv$1(env) {
-    return {
-        apiBaseUrl: env.apiBaseUrl,
-        oidcIssuer: env.oidcIssuer,
-        appClientUrl: env.appClientUrl,
-        clientId: env.clientId ? maskSecret(env.clientId) : undefined,
-        clientSecret: env.clientSecret ? maskSecret(env.clientSecret) : undefined,
-        redirectUri: env.redirectUri,
-        scopes: env.scopes
-    };
-}
 /**
  * Factory for the built-in `auth` command tree.
  *
@@ -5273,9 +6334,8 @@ function maskEnv$1(env) {
  * @returns A yargs `CommandModule` exposing the full `auth` subcommand surface.
  * @__NO_SIDE_EFFECTS__
  */ function createAuthCommand(input) {
-    var _input_envVarName;
     var cliName = input.cliName;
-    var envVarName = (_input_envVarName = input.envVarName) !== null && _input_envVarName !== void 0 ? _input_envVarName : "".concat(cliName.replaceAll('-', '_').toUpperCase(), "_ENV");
+    var envVarName = input.envVarName;
     var paths = buildCliPaths({
         cliName: cliName
     });
@@ -5315,85 +6375,60 @@ function maskEnv$1(env) {
                 describe: 'Also set the env as the active env after saving'
             });
         },
-        handler: function handler(argv) {
-            return _async_to_generator$9(function() {
-                var resolve, _ref, _argv_env, _ref1, _ref2, _argv_appClientUrl, _ref3, _ref4, _argv_scopes, _this, _envs, _this1, _findCliEnvDefault, envName, _tmp, stored, defaultEnv, existing, apiBaseUrl, oidcIssuer, appClientUrl, clientId, clientSecret, redirectUri, scopes, nextEnv, merged, e;
-                return _ts_generator$9(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$8(function() {
+                var _ref, _ref1, _argv_env, _ref2, _ref3, _argv_appClientUrl, _ref4, _ref5, _argv_scopes, _config_envs, _findCliEnvDefault, config, envName, stored, defaultEnv, existing, apiBaseUrl, oidcIssuer, appClientUrl, clientId, clientSecret, redirectUri, scopes, nextEnv, merged;
+                function resolve(promptInput) {
+                    return _async_to_generator$8(function() {
+                        var argvValue, existingValue, prompt, mask, answer;
+                        return _ts_generator$8(this, function(_state) {
+                            switch(_state.label){
+                                case 0:
+                                    argvValue = promptInput.argvValue, existingValue = promptInput.existingValue, prompt = promptInput.prompt, mask = promptInput.mask;
+                                    if (argvValue) return [
+                                        2,
+                                        argvValue
+                                    ];
+                                    if (existingValue) return [
+                                        2,
+                                        existingValue
+                                    ];
+                                    return [
+                                        4,
+                                        promptLine({
+                                            question: prompt,
+                                            mask: mask
+                                        })
+                                    ];
+                                case 1:
+                                    answer = _state.sent().trim();
+                                    return [
+                                        2,
+                                        answer.length > 0 ? answer : existingValue
+                                    ];
+                            }
+                        });
+                    })();
+                }
+                return _ts_generator$8(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                11,
-                                ,
-                                12
-                            ]);
-                            resolve = function resolve(input) {
-                                return _async_to_generator$9(function() {
-                                    var argvValue, existingValue, prompt, mask, answer;
-                                    return _ts_generator$9(this, function(_state) {
-                                        switch(_state.label){
-                                            case 0:
-                                                argvValue = input.argvValue, existingValue = input.existingValue, prompt = input.prompt, mask = input.mask;
-                                                if (argvValue) return [
-                                                    2,
-                                                    argvValue
-                                                ];
-                                                if (existingValue) return [
-                                                    2,
-                                                    existingValue
-                                                ];
-                                                return [
-                                                    4,
-                                                    promptLine({
-                                                        question: prompt,
-                                                        mask: mask
-                                                    })
-                                                ];
-                                            case 1:
-                                                answer = _state.sent().trim();
-                                                return [
-                                                    2,
-                                                    answer.length > 0 ? answer : existingValue
-                                                ];
-                                        }
-                                    });
-                                })();
-                            };
-                            if (!((_ref = (_argv_env = argv.env) !== null && _argv_env !== void 0 ? _argv_env : process.env[envVarName]) !== null && _ref !== void 0)) return [
-                                3,
-                                1
-                            ];
-                            _tmp = _ref;
-                            return [
-                                3,
-                                3
-                            ];
-                        case 1:
                             return [
                                 4,
                                 loadCliConfig({
                                     configFilePath: paths.configFilePath
                                 })
                             ];
-                        case 2:
-                            _tmp = (_this = _state.sent()) === null || _this === void 0 ? void 0 : _this.activeEnv;
-                            _state.label = 3;
-                        case 3:
-                            envName = _tmp;
+                        case 1:
+                            config = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : {};
+                            envName = (_ref1 = (_argv_env = argv.env) !== null && _argv_env !== void 0 ? _argv_env : process.env[envVarName !== null && envVarName !== void 0 ? envVarName : "".concat(cliName.replaceAll('-', '_').toUpperCase(), "_ENV")]) !== null && _ref1 !== void 0 ? _ref1 : config.activeEnv;
                             if (!envName) {
                                 throw new CliError({
                                     message: 'Provide --env <name> on first setup.',
                                     code: 'NO_ACTIVE_ENV'
                                 });
                             }
-                            return [
-                                4,
-                                loadCliConfig({
-                                    configFilePath: paths.configFilePath
-                                })
-                            ];
-                        case 4:
-                            stored = (_this1 = _state.sent()) === null || _this1 === void 0 ? void 0 : (_envs = _this1.envs) === null || _envs === void 0 ? void 0 : _envs[envName];
+                            stored = (_config_envs = config.envs) === null || _config_envs === void 0 ? void 0 : _config_envs[envName];
                             defaultEnv = (_findCliEnvDefault = findCliEnvDefault({
                                 name: envName,
                                 defaults: defaultEnvs
@@ -5407,20 +6442,20 @@ function maskEnv$1(env) {
                                 resolve({
                                     argvValue: argv.apiBaseUrl,
                                     existingValue: existing === null || existing === void 0 ? void 0 : existing.apiBaseUrl,
-                                    prompt: "API base URL [".concat((_ref1 = existing === null || existing === void 0 ? void 0 : existing.apiBaseUrl) !== null && _ref1 !== void 0 ? _ref1 : '', "]: ")
+                                    prompt: "API base URL [".concat((_ref2 = existing === null || existing === void 0 ? void 0 : existing.apiBaseUrl) !== null && _ref2 !== void 0 ? _ref2 : '', "]: ")
                                 })
                             ];
-                        case 5:
+                        case 2:
                             apiBaseUrl = _state.sent();
                             return [
                                 4,
                                 resolve({
                                     argvValue: argv.oidcIssuer,
                                     existingValue: existing === null || existing === void 0 ? void 0 : existing.oidcIssuer,
-                                    prompt: "OIDC issuer [".concat((_ref2 = existing === null || existing === void 0 ? void 0 : existing.oidcIssuer) !== null && _ref2 !== void 0 ? _ref2 : '', "]: ")
+                                    prompt: "OIDC issuer [".concat((_ref3 = existing === null || existing === void 0 ? void 0 : existing.oidcIssuer) !== null && _ref3 !== void 0 ? _ref3 : '', "]: ")
                                 })
                             ];
-                        case 6:
+                        case 3:
                             oidcIssuer = _state.sent();
                             appClientUrl = (_argv_appClientUrl = argv.appClientUrl) !== null && _argv_appClientUrl !== void 0 ? _argv_appClientUrl : existing === null || existing === void 0 ? void 0 : existing.appClientUrl;
                             return [
@@ -5431,7 +6466,7 @@ function maskEnv$1(env) {
                                     prompt: 'Client ID: '
                                 })
                             ];
-                        case 7:
+                        case 4:
                             clientId = _state.sent();
                             return [
                                 4,
@@ -5442,18 +6477,18 @@ function maskEnv$1(env) {
                                     mask: true
                                 })
                             ];
-                        case 8:
+                        case 5:
                             clientSecret = _state.sent();
                             return [
                                 4,
                                 resolve({
                                     argvValue: argv.redirectUri,
                                     existingValue: existing === null || existing === void 0 ? void 0 : existing.redirectUri,
-                                    prompt: "Redirect URI [".concat((_ref4 = existing === null || existing === void 0 ? void 0 : existing.redirectUri) !== null && _ref4 !== void 0 ? _ref4 : DEFAULT_CLI_REDIRECT_URI, "]: ")
+                                    prompt: "Redirect URI [".concat((_ref5 = existing === null || existing === void 0 ? void 0 : existing.redirectUri) !== null && _ref5 !== void 0 ? _ref5 : DEFAULT_CLI_REDIRECT_URI, "]: ")
                                 })
                             ];
-                        case 9:
-                            redirectUri = (_ref3 = _state.sent()) !== null && _ref3 !== void 0 ? _ref3 : DEFAULT_CLI_REDIRECT_URI;
+                        case 6:
+                            redirectUri = (_ref4 = _state.sent()) !== null && _ref4 !== void 0 ? _ref4 : DEFAULT_CLI_REDIRECT_URI;
                             scopes = (_argv_scopes = argv.scopes) !== null && _argv_scopes !== void 0 ? _argv_scopes : existing === null || existing === void 0 ? void 0 : existing.scopes;
                             if (!apiBaseUrl || !oidcIssuer || !clientId || !clientSecret) {
                                 throw new CliError({
@@ -5484,34 +6519,21 @@ function maskEnv$1(env) {
                                     } : {})
                                 })
                             ];
-                        case 10:
+                        case 7:
                             merged = _state.sent();
                             outputResult({
                                 saved: true,
                                 env: envName,
                                 activeEnv: merged.activeEnv,
-                                config: maskEnv$1(nextEnv)
+                                config: maskEnv(nextEnv)
                             });
-                            return [
-                                3,
-                                12
-                            ];
-                        case 11:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                12
-                            ];
-                        case 12:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
     // MARK: login
     var loginCommand = {
@@ -5534,36 +6556,25 @@ function maskEnv$1(env) {
                 describe: 'Requested login duration with a unit (e.g. 30d, 12h, 3600s). Mixed units are allowed (e.g. "1h30m", "2d 12h"). Subject to server/client caps. Applied to Session, Grant, and RefreshToken.'
             });
         },
-        handler: function handler(argv) {
-            return _async_to_generator$9(function() {
-                var _argv_code, _tokenResponse_expires_in, _ref, envName, env, meta, _ref1, codeVerifier, codeChallenge, state, requestedScopes, requestedSessionTtlSeconds, ms, url, pasted, _tmp, code, tokenResponse, expiresAt, entry, e;
-                return _ts_generator$9(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$8(function() {
+                var _argv_code, _tokenResponse_expires_in, _ref, envName, env, meta, _ref1, codeVerifier, codeChallenge, state, requestedScopes, requestedSessionTtlSeconds, ms, url, pasted, _tmp, code, tokenResponse, expiresAt, entry;
+                return _ts_generator$8(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                9,
-                                ,
-                                10
-                            ]);
                             return [
                                 4,
-                                resolveEnvOrThrow({
-                                    paths: paths,
+                                resolveCliEnvOrThrow({
                                     cliName: cliName,
-                                    envVarName: envVarName,
+                                    paths: paths,
                                     flagEnv: argv.env,
-                                    defaultEnvs: defaultEnvs
+                                    envVarName: envVarName,
+                                    defaultEnvs: defaultEnvs,
+                                    requireComplete: true
                                 })
                             ];
                         case 1:
                             _ref = _state.sent(), envName = _ref.envName, env = _ref.env;
-                            if (!isCliEnvConfigComplete(env)) {
-                                throw new CliError({
-                                    message: 'Env "'.concat(envName, '" is missing OIDC fields. Run `').concat(cliName, " auth setup --env ").concat(envName, "` first."),
-                                    code: 'AUTH_ENV_INCOMPLETE'
-                                });
-                            }
                             return [
                                 4,
                                 discoverOidcMetadata({
@@ -5668,26 +6679,13 @@ function maskEnv$1(env) {
                                 scope: entry.scope,
                                 expiresAt: expiresAt
                             });
-                            return [
-                                3,
-                                10
-                            ];
-                        case 9:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                10
-                            ];
-                        case 10:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
     // MARK: logout
     var logoutCommand = {
@@ -5700,25 +6698,19 @@ function maskEnv$1(env) {
                 describe: 'Call the OIDC revocation endpoint before clearing local tokens'
             });
         },
-        handler: function handler(argv) {
-            return _async_to_generator$9(function() {
-                var _ref, envName, env, entry, meta, e;
-                return _ts_generator$9(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$8(function() {
+                var _ref, envName, env, entry, meta;
+                return _ts_generator$8(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                10,
-                                ,
-                                11
-                            ]);
                             return [
                                 4,
-                                resolveEnvOrThrow({
-                                    paths: paths,
+                                resolveCliEnvOrThrow({
                                     cliName: cliName,
-                                    envVarName: envVarName,
+                                    paths: paths,
                                     flagEnv: argv.env,
+                                    envVarName: envVarName,
                                     defaultEnvs: defaultEnvs
                                 })
                             ];
@@ -5790,26 +6782,13 @@ function maskEnv$1(env) {
                                 loggedOut: true,
                                 env: envName
                             });
-                            return [
-                                3,
-                                11
-                            ];
-                        case 10:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                11
-                            ];
-                        case 11:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
     // MARK: status
     var statusCommand = {
@@ -5818,25 +6797,19 @@ function maskEnv$1(env) {
         builder: function builder(yargs) {
             return withEnv(yargs);
         },
-        handler: function handler(argv) {
-            return _async_to_generator$9(function() {
-                var _ref, envName, env, entry, expired, meta, userinfoEndpoint, claims, e;
-                return _ts_generator$9(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$8(function() {
+                var _ref, envName, env, entry, expired, meta, userinfoEndpoint, claims;
+                return _ts_generator$8(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                5,
-                                ,
-                                6
-                            ]);
                             return [
                                 4,
-                                resolveEnvOrThrow({
-                                    paths: paths,
+                                resolveCliEnvOrThrow({
                                     cliName: cliName,
-                                    envVarName: envVarName,
+                                    paths: paths,
                                     flagEnv: argv.env,
+                                    envVarName: envVarName,
                                     defaultEnvs: defaultEnvs
                                 })
                             ];
@@ -5899,26 +6872,13 @@ function maskEnv$1(env) {
                                 sub: claims.sub,
                                 claims: claims
                             });
-                            return [
-                                3,
-                                6
-                            ];
-                        case 5:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                6
-                            ];
-                        case 6:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
     // MARK: show
     var showCommand = {
@@ -5927,25 +6887,19 @@ function maskEnv$1(env) {
         builder: function builder(yargs) {
             return withEnv(yargs);
         },
-        handler: function handler(argv) {
-            return _async_to_generator$9(function() {
-                var _ref, envName, env, entry, e;
-                return _ts_generator$9(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$8(function() {
+                var _ref, envName, env, entry;
+                return _ts_generator$8(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                3,
-                                ,
-                                4
-                            ]);
                             return [
                                 4,
-                                resolveEnvOrThrow({
-                                    paths: paths,
+                                resolveCliEnvOrThrow({
                                     cliName: cliName,
-                                    envVarName: envVarName,
+                                    paths: paths,
                                     flagEnv: argv.env,
+                                    envVarName: envVarName,
                                     defaultEnvs: defaultEnvs
                                 })
                             ];
@@ -5959,7 +6913,7 @@ function maskEnv$1(env) {
                             entry = _state.sent();
                             outputResult({
                                 env: envName,
-                                config: maskEnv$1(env),
+                                config: maskEnv(env),
                                 token: entry ? {
                                     accessToken: maskSecret(entry.accessToken),
                                     refreshToken: entry.refreshToken ? maskSecret(entry.refreshToken) : undefined,
@@ -5969,26 +6923,13 @@ function maskEnv$1(env) {
                                     expired: isTokenExpired(entry)
                                 } : null
                             });
-                            return [
-                                3,
-                                4
-                            ];
-                        case 3:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                4
-                            ];
-                        case 4:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
     // MARK: check
     var checkCommand = {
@@ -5997,26 +6938,21 @@ function maskEnv$1(env) {
         builder: function builder(yargs) {
             return withEnv(yargs);
         },
-        handler: function handler(argv) {
-            return _async_to_generator$9(function() {
-                var _refreshed_expires_in, _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _ref, envName, env, entry, meta, refreshed, expiresAt, e;
-                return _ts_generator$9(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$8(function() {
+                var _refreshed_expires_in, _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _ref, envName, env, entry, meta, refreshed, expiresAt;
+                return _ts_generator$8(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                6,
-                                ,
-                                7
-                            ]);
                             return [
                                 4,
-                                resolveEnvOrThrow({
-                                    paths: paths,
+                                resolveCliEnvOrThrow({
                                     cliName: cliName,
-                                    envVarName: envVarName,
+                                    paths: paths,
                                     flagEnv: argv.env,
-                                    defaultEnvs: defaultEnvs
+                                    envVarName: envVarName,
+                                    defaultEnvs: defaultEnvs,
+                                    requireComplete: true
                                 })
                             ];
                         case 1:
@@ -6033,12 +6969,6 @@ function maskEnv$1(env) {
                                     code: 'NO_REFRESH_TOKEN'
                                 });
                             }
-                            if (!isCliEnvConfigComplete(env)) {
-                                throw new CliError({
-                                    message: 'Env "'.concat(envName, '" is missing OIDC fields. Run `').concat(cliName, " auth setup --env ").concat(envName, "` first."),
-                                    code: 'AUTH_ENV_INCOMPLETE'
-                                });
-                            }
                             return [
                                 4,
                                 discoverOidcMetadata({
@@ -6077,26 +7007,13 @@ function maskEnv$1(env) {
                                 refreshed: true,
                                 expiresAt: expiresAt
                             });
-                            return [
-                                3,
-                                7
-                            ];
-                        case 6:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                7
-                            ];
-                        case 7:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
     return {
         command: 'auth',
@@ -6116,7 +7033,7 @@ function _array_like_to_array$4(arr, len) {
 function _array_without_holes$3(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$4(arr);
 }
-function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -6130,16 +7047,16 @@ function asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$8(fn) {
+function _async_to_generator$7(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$8(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -6198,7 +7115,7 @@ function _unsupported_iterable_to_array$4(o, minLen) {
     if (n === "Map" || n === "Set") return Array.from(n);
     if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
 }
-function _ts_generator$8(thisArg, body) {
+function _ts_generator$7(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -6305,8 +7222,8 @@ function _ts_generator$8(thisArg, body) {
     return [
         function(param) {
             var config = param.config;
-            return _async_to_generator$8(function() {
-                return _ts_generator$8(this, function(_state) {
+            return _async_to_generator$7(function() {
+                return _ts_generator$7(this, function(_state) {
                     return [
                         2,
                         _object_spread$6({
@@ -6321,8 +7238,8 @@ function _ts_generator$8(thisArg, body) {
         },
         function(param) {
             var envName = param.envName, env = param.env;
-            return _async_to_generator$8(function() {
-                return _ts_generator$8(this, function(_state) {
+            return _async_to_generator$7(function() {
+                return _ts_generator$7(this, function(_state) {
                     return [
                         2,
                         _object_spread$6({
@@ -6340,9 +7257,9 @@ function _ts_generator$8(thisArg, body) {
         },
         function(param) {
             var env = param.env;
-            return _async_to_generator$8(function() {
+            return _async_to_generator$7(function() {
                 var candidates, meta, e;
-                return _ts_generator$8(this, function(_state) {
+                return _ts_generator$7(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             if (!(env === null || env === void 0 ? void 0 : env.oidcIssuer)) {
@@ -6412,9 +7329,9 @@ function _ts_generator$8(thisArg, body) {
         },
         function(param) {
             var cliName = param.cliName, envName = param.envName, env = param.env;
-            return _async_to_generator$8(function() {
+            return _async_to_generator$7(function() {
                 var paths, tokens, entry, expired;
-                return _ts_generator$8(this, function(_state) {
+                return _ts_generator$7(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             if (!envName || !env) {
@@ -6469,9 +7386,9 @@ function _ts_generator$8(thisArg, body) {
         },
         function(param) {
             var cliName = param.cliName, envName = param.envName, env = param.env;
-            return _async_to_generator$8(function() {
+            return _async_to_generator$7(function() {
                 var paths, tokens, entry, meta, e;
-                return _ts_generator$8(this, function(_state) {
+                return _ts_generator$7(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             if (!envName || !(env === null || env === void 0 ? void 0 : env.clientId) || !(env === null || env === void 0 ? void 0 : env.clientSecret)) {
@@ -6567,9 +7484,9 @@ function _ts_generator$8(thisArg, body) {
         },
         function(param) {
             var env = param.env;
-            return _async_to_generator$8(function() {
+            return _async_to_generator$7(function() {
                 var url, res, e;
-                return _ts_generator$8(this, function(_state) {
+                return _ts_generator$7(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             if (!(env === null || env === void 0 ? void 0 : env.apiBaseUrl)) {
@@ -6593,7 +7510,7 @@ function _ts_generator$8(thisArg, body) {
                             ]);
                             return [
                                 4,
-                                fetch(url, {
+                                tracedFetch(undefined, url, {
                                     method: 'OPTIONS'
                                 })
                             ];
@@ -6651,49 +7568,32 @@ function _ts_generator$8(thisArg, body) {
     var cliName = input.cliName;
     var checks = _to_consumable_array$3(defaultDoctorChecks()).concat(_to_consumable_array$3((_input_checks = input.checks) !== null && _input_checks !== void 0 ? _input_checks : []));
     var defaultEnvs = input.defaultEnvs;
+    var paths = buildCliPaths({
+        cliName: cliName
+    });
     return {
         command: 'doctor',
         describe: 'Run diagnostic checks for the active env',
         builder: function builder(yargs) {
             return withEnv(yargs);
         },
-        handler: function handler(argv) {
-            return _async_to_generator$8(function() {
-                var _ref, _argv_env, _config_envs, _findCliEnvDefault, paths, config, envName, stored, defaultEnv, merged, env, checkInput, results, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, check, _, e, err, allOk, e1;
-                return _ts_generator$8(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$7(function() {
+                var _ref, config, envName, env, checkInput, results, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, check, _, e, err, allOk;
+                return _ts_generator$7(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                12,
-                                ,
-                                13
-                            ]);
-                            paths = buildCliPaths({
-                                cliName: cliName
-                            });
                             return [
                                 4,
-                                loadCliConfig({
-                                    configFilePath: paths.configFilePath
+                                resolveCliEnv({
+                                    cliName: cliName,
+                                    paths: paths,
+                                    flagEnv: argv.env,
+                                    defaultEnvs: defaultEnvs
                                 })
                             ];
                         case 1:
-                            config = _state.sent();
-                            envName = (_ref = (_argv_env = argv.env) !== null && _argv_env !== void 0 ? _argv_env : process.env["".concat(cliName.replaceAll('-', '_').toUpperCase(), "_ENV")]) !== null && _ref !== void 0 ? _ref : config === null || config === void 0 ? void 0 : config.activeEnv;
-                            stored = envName ? config === null || config === void 0 ? void 0 : (_config_envs = config.envs) === null || _config_envs === void 0 ? void 0 : _config_envs[envName] : undefined;
-                            defaultEnv = envName ? (_findCliEnvDefault = findCliEnvDefault({
-                                name: envName,
-                                defaults: defaultEnvs
-                            })) === null || _findCliEnvDefault === void 0 ? void 0 : _findCliEnvDefault.env : undefined;
-                            merged = mergeCliEnvWithDefault({
-                                env: stored,
-                                defaultEnv: defaultEnv
-                            });
-                            env = applyEnvVarOverrides({
-                                cliName: cliName,
-                                env: merged
-                            });
+                            _ref = _state.sent(), config = _ref.config, envName = _ref.envName, env = _ref.env;
                             checkInput = {
                                 cliName: cliName,
                                 envName: envName,
@@ -6793,26 +7693,13 @@ function _ts_generator$8(thisArg, body) {
                                 env: envName,
                                 checks: results
                             });
-                            return [
-                                3,
-                                13
-                            ];
-                        case 12:
-                            e1 = _state.sent();
-                            outputError(e1);
-                            process.exit(1);
-                            return [
-                                3,
-                                13
-                            ];
-                        case 13:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
 }
 
@@ -6824,7 +7711,7 @@ function _array_like_to_array$3(arr, len) {
 function _array_with_holes$1(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -6838,16 +7725,16 @@ function asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$7(fn) {
+function _async_to_generator$6(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -6946,7 +7833,7 @@ function _unsupported_iterable_to_array$3(o, minLen) {
     if (n === "Map" || n === "Set") return Array.from(n);
     if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
 }
-function _ts_generator$7(thisArg, body) {
+function _ts_generator$6(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7045,17 +7932,6 @@ function _ts_generator$7(thisArg, body) {
         };
     }
 }
-function maskEnv(env) {
-    return {
-        apiBaseUrl: env.apiBaseUrl,
-        oidcIssuer: env.oidcIssuer,
-        appClientUrl: env.appClientUrl,
-        clientId: env.clientId ? maskSecret(env.clientId) : undefined,
-        clientSecret: env.clientSecret ? maskSecret(env.clientSecret) : undefined,
-        redirectUri: env.redirectUri,
-        scopes: env.scopes
-    };
-}
 function resolveEnvWithDefault(input) {
     var def = findCliEnvDefault({
         name: input.name,
@@ -7099,18 +7975,12 @@ function resolveEnvWithDefault(input) {
         builder: function builder(yargs) {
             return yargs;
         },
-        handler: function handler() {
-            return _async_to_generator$7(function() {
-                var _ref, _config_envs, config, envs, e;
-                return _ts_generator$7(this, function(_state) {
+        handler: wrapCommandHandler(function() {
+            return _async_to_generator$6(function() {
+                var _ref, _config_envs, config, envs;
+                return _ts_generator$6(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                2,
-                                ,
-                                3
-                            ]);
                             return [
                                 4,
                                 loadCliConfig({
@@ -7146,26 +8016,13 @@ function resolveEnvWithDefault(input) {
                                     }, d.env)));
                                 })
                             });
-                            return [
-                                3,
-                                3
-                            ];
-                        case 2:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                3
-                            ];
-                        case 3:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
     var useCommand = {
         command: 'use <name>',
@@ -7176,18 +8033,12 @@ function resolveEnvWithDefault(input) {
                 demandOption: true
             });
         },
-        handler: function handler(argv) {
-            return _async_to_generator$7(function() {
-                var _ref, _config_envs, config, merged, e;
-                return _ts_generator$7(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$6(function() {
+                var _ref, _config_envs, config, merged;
+                return _ts_generator$6(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                3,
-                                ,
-                                4
-                            ]);
                             return [
                                 4,
                                 loadCliConfig({
@@ -7217,26 +8068,13 @@ function resolveEnvWithDefault(input) {
                             outputResult({
                                 activeEnv: merged.activeEnv
                             });
-                            return [
-                                3,
-                                4
-                            ];
-                        case 3:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                4
-                            ];
-                        case 4:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
     var addCommand = {
         command: 'add <name>',
@@ -7258,18 +8096,12 @@ function resolveEnvWithDefault(input) {
                 default: false
             });
         },
-        handler: function handler(argv) {
-            return _async_to_generator$7(function() {
-                var _argv_apiBaseUrl, _argv_oidcIssuer, _ref, stored, merged, resolved, e;
-                return _ts_generator$7(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$6(function() {
+                var _argv_apiBaseUrl, _argv_oidcIssuer, _ref, stored, merged, resolved;
+                return _ts_generator$6(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                2,
-                                ,
-                                3
-                            ]);
                             stored = {
                                 apiBaseUrl: (_argv_apiBaseUrl = argv.apiBaseUrl) !== null && _argv_apiBaseUrl !== void 0 ? _argv_apiBaseUrl : '',
                                 oidcIssuer: (_argv_oidcIssuer = argv.oidcIssuer) !== null && _argv_oidcIssuer !== void 0 ? _argv_oidcIssuer : '',
@@ -7303,26 +8135,13 @@ function resolveEnvWithDefault(input) {
                             } : {}), {
                                 env: maskEnv((_ref = resolved === null || resolved === void 0 ? void 0 : resolved.env) !== null && _ref !== void 0 ? _ref : stored)
                             }));
-                            return [
-                                3,
-                                3
-                            ];
-                        case 2:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                3
-                            ];
-                        case 3:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
     var showCommand = {
         command: 'show [name]',
@@ -7332,18 +8151,12 @@ function resolveEnvWithDefault(input) {
                 type: 'string'
             });
         },
-        handler: function handler(argv) {
-            return _async_to_generator$7(function() {
-                var _ref, _argv_name, _config_envs, config, name, stored, resolved, e;
-                return _ts_generator$7(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$6(function() {
+                var _ref, _argv_name, _config_envs, config, name, stored, resolved;
+                return _ts_generator$6(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                2,
-                                ,
-                                3
-                            ]);
                             return [
                                 4,
                                 loadCliConfig({
@@ -7377,26 +8190,13 @@ function resolveEnvWithDefault(input) {
                             }, resolved.defaultName ? {
                                 default: resolved.defaultName
                             } : {}, maskEnv(resolved.env)));
-                            return [
-                                3,
-                                3
-                            ];
-                        case 2:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                3
-                            ];
-                        case 3:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
     var removeCommand = {
         command: 'remove <name>',
@@ -7407,18 +8207,12 @@ function resolveEnvWithDefault(input) {
                 demandOption: true
             });
         },
-        handler: function handler(argv) {
-            return _async_to_generator$7(function() {
-                var _ref, _config_envs, config, nextEnvs, nextActive, next, tokenRemovalWarning, e, e1;
-                return _ts_generator$7(this, function(_state) {
+        handler: wrapCommandHandler(function(argv) {
+            return _async_to_generator$6(function() {
+                var _ref, _config_envs, config, nextEnvs, nextActive, next, tokenRemovalWarning, e;
+                return _ts_generator$6(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                7,
-                                ,
-                                8
-                            ]);
                             return [
                                 4,
                                 loadCliConfig({
@@ -7482,26 +8276,13 @@ function resolveEnvWithDefault(input) {
                             }, tokenRemovalWarning ? {
                                 tokenRemovalWarning: tokenRemovalWarning
                             } : {}));
-                            return [
-                                3,
-                                8
-                            ];
-                        case 7:
-                            e1 = _state.sent();
-                            outputError(e1);
-                            process.exit(1);
-                            return [
-                                3,
-                                8
-                            ];
-                        case 8:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
     return {
         command: 'env',
@@ -7758,14 +8539,9 @@ function indentLines$1(text, indent) {
                 describe: 'Print only the field table for the resolved model.'
             });
         },
-        handler: function handler(argv) {
-            try {
-                runHandler(manifest, argv);
-            } catch (e) {
-                outputError(e);
-                process.exit(1);
-            }
-        }
+        handler: wrapSyncCommandHandler(function(argv) {
+            runHandler(manifest, argv);
+        })
     };
 }
 function runHandler(manifest, argv) {
@@ -7796,7 +8572,7 @@ function runHandler(manifest, argv) {
     process.stdout.write(renderModelManifestEntry(entry));
 }
 
-function asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7810,16 +8586,16 @@ function asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$6(fn) {
+function _async_to_generator$5(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -7872,7 +8648,7 @@ function _object_spread_props$3(target, source) {
     }
     return target;
 }
-function _ts_generator$6(thisArg, body) {
+function _ts_generator$5(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7991,13 +8767,16 @@ function _ts_generator$6(thisArg, body) {
     var tokens = createCliTokenCacheStore({
         tokenCachePath: paths.tokenCachePath
     });
-    var envVarName = "".concat(input.cliName.replaceAll('-', '_').toUpperCase(), "_ENV");
     return function(argv) {
-        return _async_to_generator$6(function() {
-            var _argv__, command, _ref, _ref1, _argv_env, _ref2, _findCliEnvDefault, _config_envs, config, envName, defaultEnv, merged, env, entry, _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _refreshed_expires_in, meta, refreshed, e;
-            return _ts_generator$6(this, function(_state) {
+        return _async_to_generator$5(function() {
+            var _argv__, command, _ref, _ref1, envName, env, entry, _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _refreshed_expires_in, meta, refreshed, e;
+            return _ts_generator$5(this, function(_state) {
                 switch(_state.label){
                     case 0:
+                        // Configure verbose/timeout as early as possible so HTTP calls made from this very
+                        // middleware (OIDC discovery + token refresh) honor the flags.
+                        setCliVerbose(Boolean(argv.verbose));
+                        setCliTimeoutMs(typeof argv.timeout === 'number' && argv.timeout > 0 ? argv.timeout * 1000 : undefined);
                         command = (_argv__ = argv._) === null || _argv__ === void 0 ? void 0 : _argv__[0];
                         if (typeof command === 'string' && input.skipCommands.has(command)) {
                             return [
@@ -8014,43 +8793,22 @@ function _ts_generator$6(thisArg, body) {
                         ]);
                         return [
                             4,
-                            loadCliConfig({
-                                configFilePath: paths.configFilePath
+                            resolveCliEnvOrThrow({
+                                cliName: input.cliName,
+                                paths: paths,
+                                flagEnv: argv.env,
+                                defaultEnvs: input.defaultEnvs,
+                                requireComplete: true
                             })
                         ];
                     case 2:
-                        config = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : undefined;
-                        envName = (_ref1 = (_argv_env = argv.env) !== null && _argv_env !== void 0 ? _argv_env : process.env[envVarName]) !== null && _ref1 !== void 0 ? _ref1 : config === null || config === void 0 ? void 0 : config.activeEnv;
-                        if (!envName) {
-                            throw new CliError({
-                                message: "No env selected. Run `".concat(input.cliName, " env add <name>` and `").concat(input.cliName, " env use <name>`, or pass `--env <name>`."),
-                                code: 'NO_ACTIVE_ENV'
-                            });
-                        }
-                        defaultEnv = (_findCliEnvDefault = findCliEnvDefault({
-                            name: envName,
-                            defaults: input.defaultEnvs
-                        })) === null || _findCliEnvDefault === void 0 ? void 0 : _findCliEnvDefault.env;
-                        merged = mergeCliEnvWithDefault({
-                            env: config === null || config === void 0 ? void 0 : (_config_envs = config.envs) === null || _config_envs === void 0 ? void 0 : _config_envs[envName],
-                            defaultEnv: defaultEnv
-                        });
-                        env = applyEnvVarOverrides({
-                            cliName: input.cliName,
-                            env: merged
-                        });
-                        if (!isCliEnvConfigComplete(env)) {
-                            throw new CliError({
-                                message: 'Env "'.concat(envName, '" is missing fields. Run `').concat(input.cliName, " auth setup --env ").concat(envName, "`."),
-                                code: 'AUTH_ENV_INCOMPLETE'
-                            });
-                        }
+                        _ref1 = _state.sent(), envName = _ref1.envName, env = _ref1.env;
                         return [
                             4,
                             tokens.get(envName)
                         ];
                     case 3:
-                        entry = (_ref2 = _state.sent()) !== null && _ref2 !== void 0 ? _ref2 : undefined;
+                        entry = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : undefined;
                         if (!(entry === null || entry === void 0 ? void 0 : entry.accessToken)) {
                             throw new CliError({
                                 message: 'No tokens for env "'.concat(envName, '". Run `').concat(input.cliName, " auth login --env ").concat(envName, "`."),
@@ -8117,7 +8875,7 @@ function _ts_generator$6(thisArg, body) {
                     case 8:
                         e = _state.sent();
                         outputError(e);
-                        process.exit(4);
+                        process.exit(CLI_EXIT_CODE_AUTH);
                         return [
                             3,
                             9
@@ -8147,7 +8905,7 @@ function _ts_generator$6(thisArg, body) {
     };
 }
 
-function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -8161,16 +8919,16 @@ function asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$5(fn) {
+function _async_to_generator$4(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$5(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -8204,7 +8962,7 @@ function _object_spread$3(target) {
     }
     return target;
 }
-function _ts_generator$5(thisArg, body) {
+function _ts_generator$4(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -8325,9 +9083,9 @@ function _ts_generator$5(thisArg, body) {
         cliName: input.cliName
     });
     var loadOutputConfig = (_input_loadOutputConfig = input.loadOutputConfig) !== null && _input_loadOutputConfig !== void 0 ? _input_loadOutputConfig : function() {
-        return _async_to_generator$5(function() {
+        return _async_to_generator$4(function() {
             var config;
-            return _ts_generator$5(this, function(_state) {
+            return _ts_generator$4(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         return [
@@ -8347,8 +9105,8 @@ function _ts_generator$5(thisArg, body) {
         })();
     };
     var saveCommandOutputConfig = (_input_saveCommandOutputConfig = input.saveCommandOutputConfig) !== null && _input_saveCommandOutputConfig !== void 0 ? _input_saveCommandOutputConfig : function(commandKey, commandConfig) {
-        return _async_to_generator$5(function() {
-            return _ts_generator$5(this, function(_state) {
+        return _async_to_generator$4(function() {
+            return _ts_generator$4(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         return [
@@ -8373,11 +9131,16 @@ function _ts_generator$5(thisArg, body) {
         })();
     };
     return function(argv) {
-        return _async_to_generator$5(function() {
+        return _async_to_generator$4(function() {
             var _argv_dumpDir, _argv_pick, commandPath, topCommand, setDumpDir, setPick, hasSetFlags, commandKey, commandConfig, isApiCommand, outputConfig, _tmp, resolved;
-            return _ts_generator$5(this, function(_state) {
+            return _ts_generator$4(this, function(_state) {
                 switch(_state.label){
                     case 0:
+                        // Mirror the verbose/timeout setup from the auth middleware so config commands
+                        // (auth, env, doctor, output) — which bypass the auth middleware via skipCommands —
+                        // still respect `--verbose` and `--timeout`.
+                        setCliVerbose(Boolean(argv.verbose));
+                        setCliTimeoutMs(typeof argv.timeout === 'number' && argv.timeout > 0 ? argv.timeout * 1000 : undefined);
                         commandPath = argv._ ? argv._.map(String) : [];
                         topCommand = commandPath[0];
                         setDumpDir = argv.setDumpDir;
@@ -8435,7 +9198,8 @@ function _ts_generator$5(thisArg, body) {
                         configureOutputOptions({
                             dumpDir: resolved.dumpDir,
                             pick: argv.pickAll ? undefined : resolved.pick,
-                            commandPath: commandPath
+                            commandPath: commandPath,
+                            pretty: Boolean(argv.pretty)
                         });
                         return [
                             2
@@ -8446,185 +9210,6 @@ function _ts_generator$5(thisArg, body) {
     };
 }
 
-function asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, key, arg) {
-    try {
-        var info = gen[key](arg);
-        var value = info.value;
-    } catch (error) {
-        reject(error);
-        return;
-    }
-    if (info.done) {
-        resolve(value);
-    } else {
-        Promise.resolve(value).then(_next, _throw);
-    }
-}
-function _async_to_generator$4(fn) {
-    return function() {
-        var self = this, args = arguments;
-        return new Promise(function(resolve, reject) {
-            var gen = fn.apply(self, args);
-            function _next(value) {
-                asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, "next", value);
-            }
-            function _throw(err) {
-                asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, "throw", err);
-            }
-            _next(undefined);
-        });
-    };
-}
-function _ts_generator$4(thisArg, body) {
-    var f, y, t, _ = {
-        label: 0,
-        sent: function() {
-            if (t[0] & 1) throw t[1];
-            return t[1];
-        },
-        trys: [],
-        ops: []
-    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
-    return d(g, "next", {
-        value: verb(0)
-    }), d(g, "throw", {
-        value: verb(1)
-    }), d(g, "return", {
-        value: verb(2)
-    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
-        value: function() {
-            return this;
-        }
-    }), g;
-    function verb(n) {
-        return function(v) {
-            return step([
-                n,
-                v
-            ]);
-        };
-    }
-    function step(op) {
-        if (f) throw new TypeError("Generator is already executing.");
-        while(g && (g = 0, op[0] && (_ = 0)), _)try {
-            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-            if (y = 0, t) op = [
-                op[0] & 2,
-                t.value
-            ];
-            switch(op[0]){
-                case 0:
-                case 1:
-                    t = op;
-                    break;
-                case 4:
-                    _.label++;
-                    return {
-                        value: op[1],
-                        done: false
-                    };
-                case 5:
-                    _.label++;
-                    y = op[1];
-                    op = [
-                        0
-                    ];
-                    continue;
-                case 7:
-                    op = _.ops.pop();
-                    _.trys.pop();
-                    continue;
-                default:
-                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
-                        _ = 0;
-                        continue;
-                    }
-                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
-                        _.label = op[1];
-                        break;
-                    }
-                    if (op[0] === 6 && _.label < t[1]) {
-                        _.label = t[1];
-                        t = op;
-                        break;
-                    }
-                    if (t && _.label < t[2]) {
-                        _.label = t[2];
-                        _.ops.push(op);
-                        break;
-                    }
-                    if (t[2]) _.ops.pop();
-                    _.trys.pop();
-                    continue;
-            }
-            op = body.call(thisArg, _);
-        } catch (e) {
-            op = [
-                6,
-                e
-            ];
-            y = 0;
-        } finally{
-            f = t = 0;
-        }
-        if (op[0] & 5) throw op[1];
-        return {
-            value: op[0] ? op[1] : void 0,
-            done: true
-        };
-    }
-}
-/**
- * Wraps a yargs command handler with the standard structured-error boilerplate:
- * any thrown error is converted to a `{ ok: false, ... }` envelope via {@link outputError}
- * and the process exits with code 1.
- *
- * Lets command files drop the per-handler `try { ... } catch (e) { outputError(e); process.exit(1); }`
- * block while keeping the same observable behavior.
- *
- * @param handler - The inner command handler to invoke. May be sync or async.
- * @returns An async handler that delegates to `handler` and converts thrown errors into the standard envelope.
- */ function wrapCommandHandler(handler) {
-    return function(argv) {
-        return _async_to_generator$4(function() {
-            var e;
-            return _ts_generator$4(this, function(_state) {
-                switch(_state.label){
-                    case 0:
-                        _state.trys.push([
-                            0,
-                            2,
-                            ,
-                            3
-                        ]);
-                        return [
-                            4,
-                            handler(argv)
-                        ];
-                    case 1:
-                        _state.sent();
-                        return [
-                            3,
-                            3
-                        ];
-                    case 2:
-                        e = _state.sent();
-                        outputError(e);
-                        process.exit(1);
-                        return [
-                            3,
-                            3
-                        ];
-                    case 3:
-                        return [
-                            2
-                        ];
-                }
-            });
-        })();
-    };
-}
-
 function asyncGeneratorStep$3(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -9220,7 +9805,9 @@ function _ts_generator$2(thisArg, body) {
     'pick',
     'set-dump-dir',
     'set-pick',
-    'pick-all'
+    'pick-all',
+    'pretty',
+    'timeout'
 ];
 /**
  * Top-level CLI builder.
@@ -9293,12 +9880,12 @@ function _ts_generator$2(thisArg, body) {
         defaultEnvs: defaultEnvs,
         modelManifest: input.modelManifest
     });
-    return yargs((_input_argv = input.argv) !== null && _input_argv !== void 0 ? _input_argv : hideBin(process.argv)).scriptName(cliName).usage('$0 <command> [options]').option('verbose', {
+    var parser = yargs((_input_argv = input.argv) !== null && _input_argv !== void 0 ? _input_argv : hideBin(process.argv)).scriptName(cliName).usage('$0 <command> [options]').option('verbose', {
         alias: 'v',
         type: 'boolean',
         default: false,
         global: true,
-        describe: 'Verbose output'
+        describe: 'Emit stderr trace lines for HTTP calls'
     }).option('env', {
         type: 'string',
         global: true,
@@ -9323,6 +9910,15 @@ function _ts_generator$2(thisArg, body) {
         type: 'boolean',
         global: true,
         describe: 'Ignore configured pick filters'
+    }).option('pretty', {
+        type: 'boolean',
+        default: false,
+        global: true,
+        describe: 'Pretty-print the stdout JSON envelope (2-space indent)'
+    }).option('timeout', {
+        type: 'number',
+        global: true,
+        describe: 'Per-HTTP-request timeout in seconds (aborts via AbortController)'
     }).option('data-help', {
         type: 'string',
         choices: [
@@ -9342,7 +9938,17 @@ function _ts_generator$2(thisArg, body) {
             cliName: cliName,
             skipCommands: skipCommandNames
         })
-    ], true).command(allConfigCommands).command(allApiCommands).demandCommand(1, 'Please specify a command. Use --help for available commands.').strict().fail(false).help().alias('help', 'h').version(false).wrap(Math.min(120, process.stdout.columns || 80));
+    ], true).command(allConfigCommands).command(allApiCommands).demandCommand(1, 'Please specify a command. Use --help for available commands.').strict().fail(false).help().alias('help', 'h').wrap(Math.min(120, process.stdout.columns || 80));
+    if (input.version != null) {
+        parser = parser.version(input.version);
+    } else {
+        parser = parser.version(false);
+    }
+    if (input.completionCommandName !== false) {
+        var _input_completionCommandName;
+        parser = parser.completion((_input_completionCommandName = input.completionCommandName) !== null && _input_completionCommandName !== void 0 ? _input_completionCommandName : 'completion', 'Emit a shell-completion script for this CLI');
+    }
+    return parser;
 }
 /**
  * Convenience helper for app `index.ts` entrypoints — wraps `createCli().parse()` in a try/catch
@@ -9375,7 +9981,7 @@ function _ts_generator$2(thisArg, body) {
                 case 2:
                     e = _state.sent();
                     outputError(e);
-                    process.exit(1);
+                    process.exit(CLI_EXIT_CODE_HANDLER);
                     return [
                         3,
                         3
@@ -9975,18 +10581,12 @@ function buildModelCommand(model, entries, context) {
                 describe: positionalDescribe
             });
         },
-        handler: function handler(argv) {
+        handler: wrapCommandHandler(function(argv) {
             return _async_to_generator$1(function() {
-                var ctx, raw, key, resolvedKey, result, e;
+                var ctx, raw, key, resolvedKey, result;
                 return _ts_generator$1(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                2,
-                                ,
-                                3
-                            ]);
                             ctx = requireCliContext();
                             raw = argv[positionalName];
                             key = typeof raw === 'string' ? raw.trim() : '';
@@ -10004,26 +10604,13 @@ function buildModelCommand(model, entries, context) {
                         case 1:
                             result = _state.sent();
                             outputResult(result);
-                            return [
-                                3,
-                                3
-                            ];
-                        case 2:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
-                            return [
-                                3,
-                                3
-                            ];
-                        case 3:
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
 }
 function buildEntryCommand(entry, context) {
@@ -10052,47 +10639,60 @@ function buildEntryCommand(entry, context) {
             hideGlobalOptions(y, context.hideOnFocus);
             return epilogue ? y.epilogue(epilogue) : y;
         },
-        handler: function handler(argv) {
+        handler: wrapCommandHandler(function(argv) {
             return _async_to_generator$1(function() {
-                var e;
+                var rawData, _tmp, _tmp1;
                 return _ts_generator$1(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            _state.trys.push([
-                                0,
-                                2,
-                                ,
-                                3
-                            ]);
+                            if (!(typeof argv.data === 'string')) return [
+                                3,
+                                4
+                            ];
+                            if (!isStdinSentinel(argv.data)) return [
+                                3,
+                                2
+                            ];
                             return [
                                 4,
-                                callEntry(entry, typeof argv.data === 'string' ? argv.data : undefined, {
-                                    expandKeys: expandKeysAvailable && argv.expandKeys === true,
-                                    modelManifest: context.modelManifest
-                                })
+                                readAllStdin()
                             ];
                         case 1:
-                            _state.sent();
+                            _tmp1 = _state.sent().trim();
                             return [
                                 3,
                                 3
                             ];
                         case 2:
-                            e = _state.sent();
-                            outputError(e);
-                            process.exit(1);
+                            _tmp1 = argv.data;
+                            _state.label = 3;
+                        case 3:
+                            _tmp = _tmp1;
                             return [
                                 3,
-                                3
+                                5
                             ];
-                        case 3:
+                        case 4:
+                            _tmp = undefined;
+                            _state.label = 5;
+                        case 5:
+                            rawData = _tmp;
+                            return [
+                                4,
+                                callEntry(entry, rawData, {
+                                    expandKeys: expandKeysAvailable && argv.expandKeys === true,
+                                    modelManifest: context.modelManifest
+                                })
+                            ];
+                        case 6:
+                            _state.sent();
                             return [
                                 2
                             ];
                     }
                 });
             })();
-        }
+        })
     };
 }
 function oneLineDescription(description) {
@@ -10966,4 +11566,4 @@ function printPaginatedOutput(input) {
     })();
 }
 
-export { CALL_MODEL_API_PATH, CliError, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, PROMPT_CANCELLED_ERROR_CODE, STANDARD_GLOBAL_OPTION_NAMES, applyEnvVarOverrides, buildActionCommands, buildAuthorizationUrl, buildCliPaths, buildDumpFilePath, buildErrorOutput, buildManifestCommands, buildModelDecodeCommand, buildModelInfoCommand, buildOidcDiscoveryCandidates, callModelOverHttp, callPassthroughCommand, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createAuthCommand, createAuthMiddleware, createCallModelCommand, createCli, createCliContext, createCliTokenCacheStore, createContextSlot, createDoctorCommand, createEnvCommand, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, decodeFirestoreModelKey, defaultDoctorChecks, detectDataHelpFormat, detectHelpMode, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, fetchUserInfo, filterReadOnlyModelScopes, findCliEnvDefault, findCliModelManifestEntry, generateOAuthState, generatePkceMaterial, getCliContext, getCommand, getManyCommand, getModelOverHttp, getMultipleModelsOverHttp, getOutputOptions, isCliEnvConfigComplete, isTokenExpired, iterateDbxCliCallModel, loadCliConfig, maskSecret, mergeCliConfig, mergeCliEnvWithDefault, mergeOutputConfig, openStreamingDump, outputError, outputResult, parseGetArgs, parseGetManyArgs, parsePastedRedirect, pickFields, promptLine, refreshAccessToken, renderDecodedKey, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, requireCliContext, resolveActiveEnvName, resolveCliModel, resolveOutputConfig, resolvePerModelGetKey, revokeToken, runCli, runPaginatedList, sanitizeString, saveCliConfig, setCliContext, withCallModelArgs, withEnv, withMultiplePages, withOutput, wrapCommandHandler };
+export { CALL_MODEL_API_PATH, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CliError, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, PROMPT_CANCELLED_ERROR_CODE, STANDARD_GLOBAL_OPTION_NAMES, applyEnvVarOverrides, buildActionCommands, buildAuthorizationUrl, buildCliPaths, buildDumpFilePath, buildErrorOutput, buildManifestCommands, buildModelDecodeCommand, buildModelInfoCommand, buildOidcDiscoveryCandidates, callModelOverHttp, callPassthroughCommand, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createAuthCommand, createAuthMiddleware, createCallModelCommand, createCli, createCliContext, createCliTokenCacheStore, createContextSlot, createDoctorCommand, createEnvCommand, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, decodeFirestoreModelKey, defaultDoctorChecks, detectDataHelpFormat, detectHelpMode, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, fetchUserInfo, filterReadOnlyModelScopes, findCliEnvDefault, findCliModelManifestEntry, generateOAuthState, generatePkceMaterial, getCliContext, getCliEnvVarName, getCliTimeoutMs, getCommand, getManyCommand, getModelOverHttp, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, isCliEnvConfigComplete, isCliVerbose, isStdinSentinel, isTokenExpired, iterateDbxCliCallModel, loadCliConfig, maskEnv, maskSecret, mergeCliConfig, mergeCliEnvWithDefault, mergeOutputConfig, openStreamingDump, outputError, outputResult, parseGetArgs, parseGetManyArgs, parsePastedRedirect, pickFields, promptLine, readAllStdin, readStdinTokens, refreshAccessToken, renderDecodedKey, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, requireCliContext, resolveActiveEnvName, resolveCliEnv, resolveCliEnvOrThrow, resolveCliModel, resolveOutputConfig, resolvePerModelGetKey, revokeToken, runCli, runPaginatedList, sanitizeString, saveCliConfig, setCliContext, setCliTimeoutMs, setCliVerbose, tracedFetch, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, wrapCommandHandler, wrapSyncCommandHandler };