@dereekb/dbx-cli 13.11.2 → 13.11.4

package/firebase-api-manifest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli-firebase-api-manifest",
-  "version": "13.11.2",
+  "version": "13.11.4",
   "private": true,
   "type": "module",
   "devDependencies": {

package/index.cjs.js

@@ -4,6 +4,7 @@ var node_fs = require('node:fs');
 var node_path = require('node:path');
 var firebase = require('@dereekb/firebase');
 var util = require('@dereekb/util');
+var date = require('@dereekb/date');
 var nestjs = require('@dereekb/nestjs');
 var node_os = require('node:os');
 var node_readline = require('node:readline');
@@ -274,6 +275,7 @@ var _errorMapper;
  * @param extension - File extension to append (`json` for full responses, `ndjson` for streaming dumps).
  * @param suffix - Optional suffix appended to the filename before the extension.
  * @returns The absolute file path, or `undefined` when `dumpDir` is not configured.
+ * @__NO_SIDE_EFFECTS__
  */ function buildDumpFilePath(extension, suffix) {
     var dumpDir = _outputOptions.dumpDir, commandPath = _outputOptions.commandPath;
     if (!dumpDir) {
@@ -410,6 +412,7 @@ function pickFromObject(obj, fields) {
  *
  * @param error - The thrown value to convert.
  * @returns The structured {@link CliErrorOutput}.
+ * @__NO_SIDE_EFFECTS__
  */ function buildErrorOutput(error) {
     if (_errorMapper) {
         var mapped = _errorMapper(error);
@@ -671,6 +674,7 @@ function trimSlash$1(url) {
  * @param input - Optional slot configuration.
  * @param input.notInitializedMessage - Custom error message thrown by `require()` when the slot is unset.
  * @returns A new {@link ContextSlot} for type `T`.
+ * @__NO_SIDE_EFFECTS__
  */ function createContextSlot(input) {
     var _ref;
     var _value;
@@ -715,6 +719,7 @@ var getCliContext = _cliContextSlot.get;
  * @param input.env - The resolved {@link CliEnvConfig} for the active env.
  * @param input.accessToken - The Bearer access token to include on outgoing API calls.
  * @returns The constructed {@link CliContext}.
+ * @__NO_SIDE_EFFECTS__
  */ function createCliContext(input) {
     return {
         cliName: input.cliName,
@@ -914,6 +919,7 @@ function _ts_generator$e(thisArg, body) {
  *
  * @param spec - The command spec describing the yargs command surface plus how to map argv into the typed call params and the result.
  * @returns A yargs `CommandModule` whose handler runs the spec against the active CLI context.
+ * @__NO_SIDE_EFFECTS__
  */ function createCallModelCommand(spec) {
     return {
         command: spec.command,
@@ -1788,6 +1794,7 @@ function nonEmpty(value) {
  * @param config.cliName - The CLI's binary name; the default config dir is `~/.<cliName>`.
  * @param config.configDirOverride - Optional override that replaces the default config directory verbatim (used by tests).
  * @returns The {@link CliPaths} pointing at `configDir`, the config file, and the token cache file.
+ * @__NO_SIDE_EFFECTS__
  */ function buildCliPaths(config) {
     var _config_configDirOverride;
     var configDir = (_config_configDirOverride = config.configDirOverride) !== null && _config_configDirOverride !== void 0 ? _config_configDirOverride : node_path.join(node_os.homedir(), ".".concat(config.cliName));
@@ -1807,6 +1814,7 @@ function nonEmpty(value) {
  * @param input - The cache store inputs.
  * @param input.tokenCachePath - Absolute path to the JSON file backing the cache.
  * @returns A {@link CliTokenCacheStore} keyed by env name.
+ * @__NO_SIDE_EFFECTS__
  */ function createCliTokenCacheStore(input) {
     return nestjs.createMemoizedJsonFileAsyncKeyedValueCache({
         filePath: input.tokenCachePath
@@ -2534,6 +2542,7 @@ function _ts_generator$a(thisArg, body) {
  * @param input.state - The opaque OAuth state token used for CSRF protection.
  * @param input.codeChallenge - The PKCE code challenge derived from the verifier.
  * @returns The full authorization URL with all OAuth params merged in.
+ * @__NO_SIDE_EFFECTS__
  */ function buildAuthorizationUrl(input) {
     var _input_scopes;
     var authParams = {
@@ -2545,6 +2554,15 @@ function _ts_generator$a(thisArg, body) {
         code_challenge_method: 'S256',
         state: input.state
     };
+    if (input.requestedSessionTtlSeconds != null) {
+        if (!Number.isInteger(input.requestedSessionTtlSeconds) || input.requestedSessionTtlSeconds <= 0) {
+            throw new CliError({
+                message: "requestedSessionTtlSeconds must be a positive integer (got ".concat(input.requestedSessionTtlSeconds, ")."),
+                code: 'AUTH_LOGIN_FOR_INVALID'
+            });
+        }
+        authParams.dbx_session_ttl = String(input.requestedSessionTtlSeconds);
+    }
     var endpoint;
     if (input.appClientUrl) {
         endpoint = rebaseUrlOrigin({
@@ -3066,6 +3084,7 @@ function maskEnv$1(env) {
  * @param input.envVarName - Override for the env-name env var. Defaults to `<CLINAME>_ENV` (e.g. `DEMO_CLI_ENV`).
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs `CommandModule` exposing the full `auth` subcommand surface.
+ * @__NO_SIDE_EFFECTS__
  */ function createAuthCommand(input) {
     var _input_envVarName;
     var cliName = input.cliName;
@@ -3323,11 +3342,14 @@ function maskEnv$1(env) {
                 type: 'boolean',
                 default: false,
                 describe: 'Drop model.create/model.update/model.delete from the requested scopes (keeps model.read and model.query)'
+            }).option('login-for', {
+                type: 'string',
+                describe: 'Requested login duration with a unit (e.g. 30d, 12h, 3600s). Mixed units are allowed (e.g. "1h30m", "2d 12h"). Subject to server/client caps. Applied to Session, Grant, and RefreshToken.'
             });
         },
         handler: function handler(argv) {
             return _async_to_generator$9(function() {
-                var _argv_code, _tokenResponse_expires_in, _ref, envName, env, meta, _ref1, codeVerifier, codeChallenge, state, requestedScopes, url, pasted, _tmp, code, tokenResponse, expiresAt, entry, e;
+                var _argv_code, _tokenResponse_expires_in, _ref, envName, env, meta, _ref1, codeVerifier, codeChallenge, state, requestedScopes, requestedSessionTtlSeconds, ms, url, pasted, _tmp, code, tokenResponse, expiresAt, entry, e;
                 return _ts_generator$9(this, function(_state) {
                     switch(_state.label){
                         case 0:
@@ -3372,6 +3394,16 @@ function maskEnv$1(env) {
                             _ref1 = _state.sent(), codeVerifier = _ref1.codeVerifier, codeChallenge = _ref1.codeChallenge;
                             state = generateOAuthState();
                             requestedScopes = argv.readOnlyScopes ? filterReadOnlyModelScopes(env.scopes) : env.scopes;
+                            if (argv.loginFor) {
+                                ms = date.durationDataToMilliseconds(date.parseDurationString(argv.loginFor));
+                                if (ms <= 0) {
+                                    throw new CliError({
+                                        message: '--login-for: invalid duration "'.concat(argv.loginFor, '". Use formats like "30d", "12h", "3600s", or mixed units like "1h30m" or "2d 12h".'),
+                                        code: 'AUTH_LOGIN_FOR_INVALID'
+                                    });
+                                }
+                                requestedSessionTtlSeconds = Math.floor(ms / util.MS_IN_SECOND);
+                            }
                             url = buildAuthorizationUrl({
                                 authorizationEndpoint: meta.authorization_endpoint,
                                 apiBaseUrl: env.apiBaseUrl,
@@ -3380,7 +3412,8 @@ function maskEnv$1(env) {
                                 redirectUri: env.redirectUri,
                                 scopes: requestedScopes,
                                 state: state,
-                                codeChallenge: codeChallenge
+                                codeChallenge: codeChallenge,
+                                requestedSessionTtlSeconds: requestedSessionTtlSeconds
                             });
                             // The CLI never opens a browser itself — it prints the URL and reads the redirect back.
                             // Emit the URL through a clearly-prefixed stderr line so JSON stdout stays parseable.
@@ -4413,6 +4446,7 @@ function _ts_generator$8(thisArg, body) {
  * @param input.checks - Additional checks to append after the default check list.
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs `CommandModule` exposing the `doctor` command.
+ * @__NO_SIDE_EFFECTS__
  */ function createDoctorCommand(input) {
     var _input_checks;
     var cliName = input.cliName;
@@ -4851,6 +4885,7 @@ function resolveEnvWithDefault(input) {
  * @param input.cliName - The CLI's binary name.
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs `CommandModule` exposing the full `env` subcommand surface.
+ * @__NO_SIDE_EFFECTS__
  */ function createEnvCommand(input) {
     var paths = buildCliPaths({
         cliName: input.cliName
@@ -5466,6 +5501,7 @@ function _ts_generator$6(thisArg, body) {
  * @param input.skipCommands - Top-level command names that bypass authentication entirely.
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs middleware function suitable for `.middleware([..., true])`.
+ * @__NO_SIDE_EFFECTS__
  */ function createAuthMiddleware(input) {
     var paths = buildCliPaths({
         cliName: input.cliName
@@ -5784,6 +5820,7 @@ function _ts_generator$5(thisArg, body) {
  * @param input.loadOutputConfig - Optional override for how the output config is read.
  * @param input.saveCommandOutputConfig - Optional override for how a per-command output config is persisted.
  * @returns A yargs middleware function suitable for `.middleware([..., true])`.
+ * @__NO_SIDE_EFFECTS__
  */ function createOutputMiddleware(input) {
     var _input_loadOutputConfig, _input_saveCommandOutputConfig;
     var paths = buildCliPaths({
@@ -6343,6 +6380,7 @@ function resolveCallbacks(input) {
  * @param input.mergeOutputConfig - Optional override for persisting partial output-config updates.
  * @param input.clearOutputConfig - Optional override for clearing the persisted output config entirely.
  * @returns A yargs `CommandModule` exposing the full `output` subcommand surface.
+ * @__NO_SIDE_EFFECTS__
  */ function createOutputCommand(input) {
     var callbacks = resolveCallbacks(input);
     var setCommand = {
@@ -6704,6 +6742,7 @@ function _ts_generator$2(thisArg, body) {
  * @param input.argv - Argv to parse. Defaults to `hideBin(process.argv)`.
  * @param input.disableCallPassthrough - When `true`, omits the built-in `call` passthrough.
  * @returns The configured yargs `Argv` ready to be `.parse()`-d.
+ * @__NO_SIDE_EFFECTS__
  */ function createCli(input) {
     var _input_configCommands, _input_apiCommands, _input_argv;
     var cliName = input.cliName;
@@ -7133,6 +7172,7 @@ var DATA_HELP_FLAG = '--data-help';
  * @param options - Optional overrides; see {@link BuildManifestCommandsOptions}.
  * @returns The yargs `CommandModule[]` ready to be passed to `runCli({ apiCommands })`. Empty
  *   when the manifest has no callable entries.
+ * @__NO_SIDE_EFFECTS__
  */ function buildManifestCommands(manifest, options) {
     var _ref, _ref1, _ref2, _ref3, _ref4, _ref5;
     var callable = manifest.filter(function(e) {

package/index.esm.js

@@ -1,7 +1,8 @@
 import { existsSync, mkdirSync, writeFileSync, appendFileSync } from 'node:fs';
 import { join } from 'node:path';
 export { CALL_MODEL_APP_FUNCTION_KEY } from '@dereekb/firebase';
-import { expirationDetails, generatePkceCodeVerifier, generatePkceCodeChallenge, noop } from '@dereekb/util';
+import { expirationDetails, generatePkceCodeVerifier, generatePkceCodeChallenge, noop, MS_IN_SECOND } from '@dereekb/util';
+import { durationDataToMilliseconds, parseDurationString } from '@dereekb/date';
 import { readJsonFile, writeJsonFile, createMemoizedJsonFileAsyncKeyedValueCache } from '@dereekb/nestjs';
 import { homedir } from 'node:os';
 import { createInterface } from 'node:readline';
@@ -272,6 +273,7 @@ var _errorMapper;
  * @param extension - File extension to append (`json` for full responses, `ndjson` for streaming dumps).
  * @param suffix - Optional suffix appended to the filename before the extension.
  * @returns The absolute file path, or `undefined` when `dumpDir` is not configured.
+ * @__NO_SIDE_EFFECTS__
  */ function buildDumpFilePath(extension, suffix) {
     var dumpDir = _outputOptions.dumpDir, commandPath = _outputOptions.commandPath;
     if (!dumpDir) {
@@ -408,6 +410,7 @@ function pickFromObject(obj, fields) {
  *
  * @param error - The thrown value to convert.
  * @returns The structured {@link CliErrorOutput}.
+ * @__NO_SIDE_EFFECTS__
  */ function buildErrorOutput(error) {
     if (_errorMapper) {
         var mapped = _errorMapper(error);
@@ -669,6 +672,7 @@ function trimSlash$1(url) {
  * @param input - Optional slot configuration.
  * @param input.notInitializedMessage - Custom error message thrown by `require()` when the slot is unset.
  * @returns A new {@link ContextSlot} for type `T`.
+ * @__NO_SIDE_EFFECTS__
  */ function createContextSlot(input) {
     var _ref;
     var _value;
@@ -713,6 +717,7 @@ var getCliContext = _cliContextSlot.get;
  * @param input.env - The resolved {@link CliEnvConfig} for the active env.
  * @param input.accessToken - The Bearer access token to include on outgoing API calls.
  * @returns The constructed {@link CliContext}.
+ * @__NO_SIDE_EFFECTS__
  */ function createCliContext(input) {
     return {
         cliName: input.cliName,
@@ -912,6 +917,7 @@ function _ts_generator$e(thisArg, body) {
  *
  * @param spec - The command spec describing the yargs command surface plus how to map argv into the typed call params and the result.
  * @returns A yargs `CommandModule` whose handler runs the spec against the active CLI context.
+ * @__NO_SIDE_EFFECTS__
  */ function createCallModelCommand(spec) {
     return {
         command: spec.command,
@@ -1786,6 +1792,7 @@ function nonEmpty(value) {
  * @param config.cliName - The CLI's binary name; the default config dir is `~/.<cliName>`.
  * @param config.configDirOverride - Optional override that replaces the default config directory verbatim (used by tests).
  * @returns The {@link CliPaths} pointing at `configDir`, the config file, and the token cache file.
+ * @__NO_SIDE_EFFECTS__
  */ function buildCliPaths(config) {
     var _config_configDirOverride;
     var configDir = (_config_configDirOverride = config.configDirOverride) !== null && _config_configDirOverride !== void 0 ? _config_configDirOverride : join(homedir(), ".".concat(config.cliName));
@@ -1805,6 +1812,7 @@ function nonEmpty(value) {
  * @param input - The cache store inputs.
  * @param input.tokenCachePath - Absolute path to the JSON file backing the cache.
  * @returns A {@link CliTokenCacheStore} keyed by env name.
+ * @__NO_SIDE_EFFECTS__
  */ function createCliTokenCacheStore(input) {
     return createMemoizedJsonFileAsyncKeyedValueCache({
         filePath: input.tokenCachePath
@@ -2532,6 +2540,7 @@ function _ts_generator$a(thisArg, body) {
  * @param input.state - The opaque OAuth state token used for CSRF protection.
  * @param input.codeChallenge - The PKCE code challenge derived from the verifier.
  * @returns The full authorization URL with all OAuth params merged in.
+ * @__NO_SIDE_EFFECTS__
  */ function buildAuthorizationUrl(input) {
     var _input_scopes;
     var authParams = {
@@ -2543,6 +2552,15 @@ function _ts_generator$a(thisArg, body) {
         code_challenge_method: 'S256',
         state: input.state
     };
+    if (input.requestedSessionTtlSeconds != null) {
+        if (!Number.isInteger(input.requestedSessionTtlSeconds) || input.requestedSessionTtlSeconds <= 0) {
+            throw new CliError({
+                message: "requestedSessionTtlSeconds must be a positive integer (got ".concat(input.requestedSessionTtlSeconds, ")."),
+                code: 'AUTH_LOGIN_FOR_INVALID'
+            });
+        }
+        authParams.dbx_session_ttl = String(input.requestedSessionTtlSeconds);
+    }
     var endpoint;
     if (input.appClientUrl) {
         endpoint = rebaseUrlOrigin({
@@ -3064,6 +3082,7 @@ function maskEnv$1(env) {
  * @param input.envVarName - Override for the env-name env var. Defaults to `<CLINAME>_ENV` (e.g. `DEMO_CLI_ENV`).
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs `CommandModule` exposing the full `auth` subcommand surface.
+ * @__NO_SIDE_EFFECTS__
  */ function createAuthCommand(input) {
     var _input_envVarName;
     var cliName = input.cliName;
@@ -3321,11 +3340,14 @@ function maskEnv$1(env) {
                 type: 'boolean',
                 default: false,
                 describe: 'Drop model.create/model.update/model.delete from the requested scopes (keeps model.read and model.query)'
+            }).option('login-for', {
+                type: 'string',
+                describe: 'Requested login duration with a unit (e.g. 30d, 12h, 3600s). Mixed units are allowed (e.g. "1h30m", "2d 12h"). Subject to server/client caps. Applied to Session, Grant, and RefreshToken.'
             });
         },
         handler: function handler(argv) {
             return _async_to_generator$9(function() {
-                var _argv_code, _tokenResponse_expires_in, _ref, envName, env, meta, _ref1, codeVerifier, codeChallenge, state, requestedScopes, url, pasted, _tmp, code, tokenResponse, expiresAt, entry, e;
+                var _argv_code, _tokenResponse_expires_in, _ref, envName, env, meta, _ref1, codeVerifier, codeChallenge, state, requestedScopes, requestedSessionTtlSeconds, ms, url, pasted, _tmp, code, tokenResponse, expiresAt, entry, e;
                 return _ts_generator$9(this, function(_state) {
                     switch(_state.label){
                         case 0:
@@ -3370,6 +3392,16 @@ function maskEnv$1(env) {
                             _ref1 = _state.sent(), codeVerifier = _ref1.codeVerifier, codeChallenge = _ref1.codeChallenge;
                             state = generateOAuthState();
                             requestedScopes = argv.readOnlyScopes ? filterReadOnlyModelScopes(env.scopes) : env.scopes;
+                            if (argv.loginFor) {
+                                ms = durationDataToMilliseconds(parseDurationString(argv.loginFor));
+                                if (ms <= 0) {
+                                    throw new CliError({
+                                        message: '--login-for: invalid duration "'.concat(argv.loginFor, '". Use formats like "30d", "12h", "3600s", or mixed units like "1h30m" or "2d 12h".'),
+                                        code: 'AUTH_LOGIN_FOR_INVALID'
+                                    });
+                                }
+                                requestedSessionTtlSeconds = Math.floor(ms / MS_IN_SECOND);
+                            }
                             url = buildAuthorizationUrl({
                                 authorizationEndpoint: meta.authorization_endpoint,
                                 apiBaseUrl: env.apiBaseUrl,
@@ -3378,7 +3410,8 @@ function maskEnv$1(env) {
                                 redirectUri: env.redirectUri,
                                 scopes: requestedScopes,
                                 state: state,
-                                codeChallenge: codeChallenge
+                                codeChallenge: codeChallenge,
+                                requestedSessionTtlSeconds: requestedSessionTtlSeconds
                             });
                             // The CLI never opens a browser itself — it prints the URL and reads the redirect back.
                             // Emit the URL through a clearly-prefixed stderr line so JSON stdout stays parseable.
@@ -4411,6 +4444,7 @@ function _ts_generator$8(thisArg, body) {
  * @param input.checks - Additional checks to append after the default check list.
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs `CommandModule` exposing the `doctor` command.
+ * @__NO_SIDE_EFFECTS__
  */ function createDoctorCommand(input) {
     var _input_checks;
     var cliName = input.cliName;
@@ -4849,6 +4883,7 @@ function resolveEnvWithDefault(input) {
  * @param input.cliName - The CLI's binary name.
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs `CommandModule` exposing the full `env` subcommand surface.
+ * @__NO_SIDE_EFFECTS__
  */ function createEnvCommand(input) {
     var paths = buildCliPaths({
         cliName: input.cliName
@@ -5464,6 +5499,7 @@ function _ts_generator$6(thisArg, body) {
  * @param input.skipCommands - Top-level command names that bypass authentication entirely.
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs middleware function suitable for `.middleware([..., true])`.
+ * @__NO_SIDE_EFFECTS__
  */ function createAuthMiddleware(input) {
     var paths = buildCliPaths({
         cliName: input.cliName
@@ -5782,6 +5818,7 @@ function _ts_generator$5(thisArg, body) {
  * @param input.loadOutputConfig - Optional override for how the output config is read.
  * @param input.saveCommandOutputConfig - Optional override for how a per-command output config is persisted.
  * @returns A yargs middleware function suitable for `.middleware([..., true])`.
+ * @__NO_SIDE_EFFECTS__
  */ function createOutputMiddleware(input) {
     var _input_loadOutputConfig, _input_saveCommandOutputConfig;
     var paths = buildCliPaths({
@@ -6341,6 +6378,7 @@ function resolveCallbacks(input) {
  * @param input.mergeOutputConfig - Optional override for persisting partial output-config updates.
  * @param input.clearOutputConfig - Optional override for clearing the persisted output config entirely.
  * @returns A yargs `CommandModule` exposing the full `output` subcommand surface.
+ * @__NO_SIDE_EFFECTS__
  */ function createOutputCommand(input) {
     var callbacks = resolveCallbacks(input);
     var setCommand = {
@@ -6702,6 +6740,7 @@ function _ts_generator$2(thisArg, body) {
  * @param input.argv - Argv to parse. Defaults to `hideBin(process.argv)`.
  * @param input.disableCallPassthrough - When `true`, omits the built-in `call` passthrough.
  * @returns The configured yargs `Argv` ready to be `.parse()`-d.
+ * @__NO_SIDE_EFFECTS__
  */ function createCli(input) {
     var _input_configCommands, _input_apiCommands, _input_argv;
     var cliName = input.cliName;
@@ -7131,6 +7170,7 @@ var DATA_HELP_FLAG = '--data-help';
  * @param options - Optional overrides; see {@link BuildManifestCommandsOptions}.
  * @returns The yargs `CommandModule[]` ready to be passed to `runCli({ apiCommands })`. Empty
  *   when the manifest has no callable entries.
+ * @__NO_SIDE_EFFECTS__
  */ function buildManifestCommands(manifest, options) {
     var _ref, _ref1, _ref2, _ref3, _ref4, _ref5;
     var callable = manifest.filter(function(e) {

package/manifest-extract/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli/manifest-extract",
-  "version": "13.11.2",
+  "version": "13.11.4",
   "sideEffects": false,
   "peerDependencies": {
     "ts-morph": "^21.0.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli",
-  "version": "13.11.2",
+  "version": "13.11.4",
   "sideEffects": false,
   "bin": {
     "dbx-cli-generate-firebase-api-manifest": "firebase-api-manifest/main.js"
@@ -24,9 +24,10 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/firebase": "13.11.2",
-    "@dereekb/nestjs": "13.11.2",
-    "@dereekb/util": "13.11.2",
+    "@dereekb/date": "13.11.4",
+    "@dereekb/firebase": "13.11.4",
+    "@dereekb/nestjs": "13.11.4",
+    "@dereekb/util": "13.11.4",
     "arktype": "^2.2.0",
     "yargs": "^18.0.0"
   },

package/src/lib/api/call-model.command.factory.d.ts

@@ -38,5 +38,6 @@ export interface CallModelCommandSpec<TParams = unknown, TResult = unknown> {
  *
  * @param spec - The command spec describing the yargs command surface plus how to map argv into the typed call params and the result.
  * @returns A yargs `CommandModule` whose handler runs the spec against the active CLI context.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createCallModelCommand<TParams = unknown, TResult = unknown>(spec: CallModelCommandSpec<TParams, TResult>): CommandModule;

package/src/lib/auth/auth.command.factory.d.ts

@@ -25,5 +25,6 @@ export interface CreateAuthCommandInput {
  * @param input.envVarName - Override for the env-name env var. Defaults to `<CLINAME>_ENV` (e.g. `DEMO_CLI_ENV`).
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs `CommandModule` exposing the full `auth` subcommand surface.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createAuthCommand(input: CreateAuthCommandInput): CommandModule;

package/src/lib/auth/oidc.flow.d.ts

@@ -22,6 +22,13 @@ export interface BuildAuthorizationUrlInput {
     readonly scopes?: string;
     readonly state: string;
     readonly codeChallenge: string;
+    /**
+     * Optional requested login duration in seconds. When set, the URL includes the
+     * `dbx_session_ttl=<seconds>` query param so the OIDC server applies the requested
+     * lifetime to the issued Session, Grant, and RefreshToken (subject to per-client and
+     * server caps).
+     */
+    readonly requestedSessionTtlSeconds?: Maybe<number>;
 }
 /**
  * Builds the authorization URL the user opens in a browser to start the PKCE flow.
@@ -40,6 +47,7 @@ export interface BuildAuthorizationUrlInput {
  * @param input.state - The opaque OAuth state token used for CSRF protection.
  * @param input.codeChallenge - The PKCE code challenge derived from the verifier.
  * @returns The full authorization URL with all OAuth params merged in.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function buildAuthorizationUrl(input: BuildAuthorizationUrlInput): string;
 export interface PkceMaterial {

package/src/lib/config/paths.d.ts

@@ -29,5 +29,6 @@ export interface CliPathsConfig {
  * @param config.cliName - The CLI's binary name; the default config dir is `~/.<cliName>`.
  * @param config.configDirOverride - Optional override that replaces the default config directory verbatim (used by tests).
  * @returns The {@link CliPaths} pointing at `configDir`, the config file, and the token cache file.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function buildCliPaths(config: CliPathsConfig): CliPaths;

package/src/lib/config/token.cache.d.ts

@@ -36,6 +36,7 @@ export interface CreateCliTokenCacheStoreInput {
  * @param input - The cache store inputs.
  * @param input.tokenCachePath - Absolute path to the JSON file backing the cache.
  * @returns A {@link CliTokenCacheStore} keyed by env name.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createCliTokenCacheStore(input: CreateCliTokenCacheStoreInput): CliTokenCacheStore;
 /**

package/src/lib/context/cli.context.d.ts

@@ -37,5 +37,6 @@ export interface CreateCliContextInput {
  * @param input.env - The resolved {@link CliEnvConfig} for the active env.
  * @param input.accessToken - The Bearer access token to include on outgoing API calls.
  * @returns The constructed {@link CliContext}.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createCliContext(input: CreateCliContextInput): CliContext;

package/src/lib/doctor/doctor.command.factory.d.ts

@@ -44,5 +44,6 @@ export interface CreateDoctorCommandInput {
  * @param input.checks - Additional checks to append after the default check list.
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs `CommandModule` exposing the `doctor` command.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createDoctorCommand(input: CreateDoctorCommandInput): CommandModule;

package/src/lib/env/env.command.factory.d.ts

@@ -18,5 +18,6 @@ export interface CreateEnvCommandInput {
  * @param input.cliName - The CLI's binary name.
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs `CommandModule` exposing the full `env` subcommand surface.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createEnvCommand(input: CreateEnvCommandInput): CommandModule;

package/src/lib/manifest/build-manifest-commands.d.ts

@@ -103,6 +103,7 @@ export declare const DEFAULT_MANIFEST_MODEL_COMMAND_NAME = "model";
  * @param options - Optional overrides; see {@link BuildManifestCommandsOptions}.
  * @returns The yargs `CommandModule[]` ready to be passed to `runCli({ apiCommands })`. Empty
  *   when the manifest has no callable entries.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function buildManifestCommands(manifest: CliApiManifest, options?: BuildManifestCommandsOptions): CommandModule[];
 /**

package/src/lib/middleware/auth.middleware.d.ts

@@ -25,5 +25,6 @@ export interface CreateAuthMiddlewareInput {
  * @param input.skipCommands - Top-level command names that bypass authentication entirely.
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
  * @returns A yargs middleware function suitable for `.middleware([..., true])`.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createAuthMiddleware(input: CreateAuthMiddlewareInput): MiddlewareFunction;

package/src/lib/middleware/output.middleware.d.ts

@@ -50,5 +50,6 @@ export interface CreateOutputMiddlewareInput {
  * @param input.loadOutputConfig - Optional override for how the output config is read.
  * @param input.saveCommandOutputConfig - Optional override for how a per-command output config is persisted.
  * @returns A yargs middleware function suitable for `.middleware([..., true])`.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createOutputMiddleware(input: CreateOutputMiddlewareInput): MiddlewareFunction;

package/src/lib/output/output.command.factory.d.ts

@@ -51,5 +51,6 @@ export interface CreateOutputCommandInput {
  * @param input.mergeOutputConfig - Optional override for persisting partial output-config updates.
  * @param input.clearOutputConfig - Optional override for clearing the persisted output config entirely.
  * @returns A yargs `CommandModule` exposing the full `output` subcommand surface.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createOutputCommand(input: CreateOutputCommandInput): CommandModule;

package/src/lib/runner/run.d.ts

@@ -62,6 +62,7 @@ export interface CreateCliInput {
  * @param input.argv - Argv to parse. Defaults to `hideBin(process.argv)`.
  * @param input.disableCallPassthrough - When `true`, omits the built-in `call` passthrough.
  * @returns The configured yargs `Argv` ready to be `.parse()`-d.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createCli(input: CreateCliInput): Argv;
 /**

package/src/lib/util/context.slot.d.ts

@@ -46,5 +46,6 @@ export interface CreateContextSlotInput {
  * @param input - Optional slot configuration.
  * @param input.notInitializedMessage - Custom error message thrown by `require()` when the slot is unset.
  * @returns A new {@link ContextSlot} for type `T`.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function createContextSlot<T>(input?: CreateContextSlotInput): ContextSlot<T>;

package/src/lib/util/output.d.ts

@@ -95,6 +95,7 @@ export declare function dumpTimestamp(): string;
  * @param extension - File extension to append (`json` for full responses, `ndjson` for streaming dumps).
  * @param suffix - Optional suffix appended to the filename before the extension.
  * @returns The absolute file path, or `undefined` when `dumpDir` is not configured.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function buildDumpFilePath(extension: 'json' | 'ndjson', suffix?: string): Maybe<string>;
 /**
@@ -148,5 +149,6 @@ export declare class CliError extends Error {
  *
  * @param error - The thrown value to convert.
  * @returns The structured {@link CliErrorOutput}.
+ * @__NO_SIDE_EFFECTS__
  */
 export declare function buildErrorOutput(error: unknown): CliErrorOutput;