@dereekb/dbx-cli 13.11.6 → 13.11.8

package/index.cjs.js

@@ -11,13 +11,13 @@ var node_readline = require('node:readline');
 var yargs = require('yargs');
 var helpers = require('yargs/helpers');
 
-function _array_like_to_array$7(arr, len) {
+function _array_like_to_array$8(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$4(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$8(arr);
 }
 function _assert_this_initialized(self) {
     if (self === void 0) {
@@ -94,10 +94,10 @@ function _instanceof$6(left, right) {
 function _is_native_function(fn) {
     return Function.toString.call(fn).indexOf("[native code]") !== -1;
 }
-function _iterable_to_array$4(iter) {
+function _iterable_to_array$5(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$4() {
+function _non_iterable_spread$5() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _object_spread$c(target) {
@@ -128,20 +128,20 @@ function _set_prototype_of(o, p) {
     };
     return _set_prototype_of(o, p);
 }
-function _to_consumable_array$4(arr) {
-    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$4();
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$8(arr) || _non_iterable_spread$5();
 }
 function _type_of$3(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$7(o, minLen) {
+function _unsupported_iterable_to_array$8(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$8(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$8(o, minLen);
 }
 function _wrap_native_super(Class) {
     var _cache = typeof Map === "function" ? new Map() : undefined;
@@ -190,7 +190,7 @@ function _is_native_reflect_construct() {
     /id_token[=:]\s*\S+/gi
 ];
 var _outputOptions = {};
-var _secretPatterns = _to_consumable_array$4(DEFAULT_CLI_SECRET_PATTERNS);
+var _secretPatterns = _to_consumable_array$5(DEFAULT_CLI_SECRET_PATTERNS);
 var _errorMapper;
 /**
  * Configures output options from parsed CLI arguments.
@@ -443,7 +443,7 @@ function pickFromObject(obj, fields) {
     };
 }
 
-function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -457,16 +457,16 @@ function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$f(fn) {
+function _async_to_generator$h(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$h(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -476,7 +476,7 @@ function _type_of$2(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _ts_generator$f(thisArg, body) {
+function _ts_generator$h(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -576,6 +576,7 @@ function _ts_generator$f(thisArg, body) {
     }
 }
 var CALL_MODEL_API_PATH = "/model/call";
+var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
 /**
  * Posts a typed model call to `<apiBaseUrl>/model/call` with a Bearer access token and parses the JSON response.
  *
@@ -591,9 +592,9 @@ var CALL_MODEL_API_PATH = "/model/call";
  * @param input.fetcher - Optional fetch implementation override (used by tests).
  * @returns The parsed JSON response body cast to `R`.
  */ function callModelOverHttp(input) {
-    return _async_to_generator$f(function() {
+    return _async_to_generator$h(function() {
         var _input_fetcher, fetcher, url, res, text, body, _input_params_call, bodyMessage, messageString, message;
-        return _ts_generator$f(this, function(_state) {
+        return _ts_generator$h(this, function(_state) {
             switch(_state.label){
                 case 0:
                     fetcher = (_input_fetcher = input.fetcher) !== null && _input_fetcher !== void 0 ? _input_fetcher : fetch;
@@ -643,6 +644,163 @@ var CALL_MODEL_API_PATH = "/model/call";
         });
     })();
 }
+/**
+ * GETs a single Firestore document by key via the typed model-access endpoint.
+ *
+ * Calls `<apiBaseUrl>/model/<modelType>/get?key=<encoded key>` with a Bearer access token and
+ * returns the parsed `{ key, data }` envelope. Non-2xx responses are mapped to a {@link CliError}
+ * with a stable code derived from the status — matching {@link callModelOverHttp}'s error shape.
+ *
+ * The backend route is implemented by `ModelApiController.getOne` (packages/firebase-server) and
+ * enforces `roles: 'read'` via `useModel(...)` so Firestore security rules still apply.
+ *
+ * @param input - The request envelope describing the API target, access token, model + key, and optional fetch override.
+ * @returns The parsed `{ key, data }` envelope.
+ */ function getModelOverHttp(input) {
+    return _async_to_generator$h(function() {
+        var _input_fetcher, fetcher, url, res, _ref, ok, body, fallbackMessage;
+        return _ts_generator$h(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    fetcher = (_input_fetcher = input.fetcher) !== null && _input_fetcher !== void 0 ? _input_fetcher : fetch;
+                    url = "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get?key=").concat(encodeURIComponent(input.key));
+                    return [
+                        4,
+                        fetcher(url, {
+                            method: 'GET',
+                            headers: {
+                                Accept: 'application/json',
+                                Authorization: "Bearer ".concat(input.accessToken)
+                            }
+                        })
+                    ];
+                case 1:
+                    res = _state.sent();
+                    return [
+                        4,
+                        readJsonResponse(res)
+                    ];
+                case 2:
+                    _ref = _state.sent(), ok = _ref.ok, body = _ref.body, fallbackMessage = _ref.fallbackMessage;
+                    if (!ok) {
+                        throw new CliError({
+                            message: "get ".concat(input.modelType, "/").concat(input.key, " failed: ").concat(extractMessage(body, fallbackMessage, res)),
+                            code: codeForStatus(res.status),
+                            suggestion: res.status === 401 || res.status === 403 ? 'Run `<cli> auth login` to refresh credentials.' : undefined
+                        });
+                    }
+                    return [
+                        2,
+                        body
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Batch-reads up to {@link MAX_MODEL_ACCESS_MULTI_READ_KEYS} Firestore documents in a single request.
+ *
+ * Calls `POST <apiBaseUrl>/model/<modelType>/get` with body `{ keys }` and returns the
+ * `{ results, errors }` envelope. The 50-key cap is enforced client-side so the error surfaces
+ * with a clear `INVALID_ARGUMENT` code before the request is made.
+ *
+ * Backend route: `ModelApiController.getMany` (packages/firebase-server). Same `'read'` role enforcement.
+ *
+ * @param input - The request envelope describing the API target, access token, model, keys, and optional fetch override.
+ * @returns The parsed `{ results, errors }` envelope.
+ */ function getMultipleModelsOverHttp(input) {
+    return _async_to_generator$h(function() {
+        var _input_fetcher, fetcher, url, res, _ref, ok, body, fallbackMessage;
+        return _ts_generator$h(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    if (input.keys.length === 0) {
+                        throw new CliError({
+                            message: 'get-many requires at least one key.',
+                            code: 'INVALID_ARGUMENT'
+                        });
+                    }
+                    if (input.keys.length > MAX_MODEL_ACCESS_MULTI_READ_KEYS) {
+                        throw new CliError({
+                            message: "get-many supports at most ".concat(MAX_MODEL_ACCESS_MULTI_READ_KEYS, " keys (got ").concat(input.keys.length, ")."),
+                            code: 'INVALID_ARGUMENT'
+                        });
+                    }
+                    fetcher = (_input_fetcher = input.fetcher) !== null && _input_fetcher !== void 0 ? _input_fetcher : fetch;
+                    url = "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get");
+                    return [
+                        4,
+                        fetcher(url, {
+                            method: 'POST',
+                            headers: {
+                                'Content-Type': 'application/json',
+                                Accept: 'application/json',
+                                Authorization: "Bearer ".concat(input.accessToken)
+                            },
+                            body: JSON.stringify({
+                                keys: input.keys
+                            })
+                        })
+                    ];
+                case 1:
+                    res = _state.sent();
+                    return [
+                        4,
+                        readJsonResponse(res)
+                    ];
+                case 2:
+                    _ref = _state.sent(), ok = _ref.ok, body = _ref.body, fallbackMessage = _ref.fallbackMessage;
+                    if (!ok) {
+                        throw new CliError({
+                            message: "get-many ".concat(input.modelType, " failed: ").concat(extractMessage(body, fallbackMessage, res)),
+                            code: codeForStatus(res.status),
+                            suggestion: res.status === 401 || res.status === 403 ? 'Run `<cli> auth login` to refresh credentials.' : undefined
+                        });
+                    }
+                    return [
+                        2,
+                        body
+                    ];
+            }
+        });
+    })();
+}
+function readJsonResponse(res) {
+    return _async_to_generator$h(function() {
+        var text, body;
+        return _ts_generator$h(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        res.text()
+                    ];
+                case 1:
+                    text = _state.sent();
+                    if (text.length > 0) {
+                        try {
+                            body = JSON.parse(text);
+                        } catch (unused) {
+                            body = text;
+                        }
+                    }
+                    return [
+                        2,
+                        {
+                            ok: res.ok,
+                            body: body,
+                            fallbackMessage: text
+                        }
+                    ];
+            }
+        });
+    })();
+}
+function extractMessage(body, fallback, res) {
+    var bodyMessage = (typeof body === "undefined" ? "undefined" : _type_of$2(body)) === 'object' && body && 'message' in body ? body.message : undefined;
+    var messageString = typeof bodyMessage === 'string' ? bodyMessage : undefined;
+    return messageString !== null && messageString !== void 0 ? messageString : fallback || "".concat(res.status, " ").concat(res.statusText);
+}
 function codeForStatus(status) {
     if (status === 401) return 'AUTH_UNAUTHORIZED';
     if (status === 403) return 'AUTH_FORBIDDEN';
@@ -710,33 +868,53 @@ var getCliContext = _cliContextSlot.get;
 /**
  * Builds a {@link CliContext} for the current invocation.
  *
- * Bundles the env config and access token alongside a `callModel` helper that POSTs to
- * `<env.apiBaseUrl>/model/call` with the cached Bearer token.
+ * Bundles the env config and access token alongside helpers that POST/GET against
+ * `<env.apiBaseUrl>/model/*` with the cached Bearer token.
  *
  * @param input - The context inputs.
  * @param input.cliName - The CLI's binary name.
  * @param input.envName - The active env name.
  * @param input.env - The resolved {@link CliEnvConfig} for the active env.
  * @param input.accessToken - The Bearer access token to include on outgoing API calls.
+ * @param input.modelManifest - Optional generated {@link CliModelManifest} for key→modelType resolution.
  * @returns The constructed {@link CliContext}.
  * @__NO_SIDE_EFFECTS__
  */ function createCliContext(input) {
+    var apiBaseUrl = input.env.apiBaseUrl;
+    var accessToken = input.accessToken;
     return {
         cliName: input.cliName,
         envName: input.envName,
         env: input.env,
-        accessToken: input.accessToken,
+        accessToken: accessToken,
+        modelManifest: input.modelManifest,
         callModel: function callModel(params) {
             return callModelOverHttp({
-                apiBaseUrl: input.env.apiBaseUrl,
-                accessToken: input.accessToken,
+                apiBaseUrl: apiBaseUrl,
+                accessToken: accessToken,
                 params: params
             });
+        },
+        getModel: function getModel(modelType, key) {
+            return getModelOverHttp({
+                apiBaseUrl: apiBaseUrl,
+                accessToken: accessToken,
+                modelType: modelType,
+                key: key
+            });
+        },
+        getMultipleModels: function getMultipleModels(modelType, keys) {
+            return getMultipleModelsOverHttp({
+                apiBaseUrl: apiBaseUrl,
+                accessToken: accessToken,
+                modelType: modelType,
+                keys: keys
+            });
         }
     };
 }
 
-function asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -750,16 +928,16 @@ function asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$e(fn) {
+function _async_to_generator$g(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$g(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -812,7 +990,7 @@ function _object_spread_props$7(target, source) {
     }
     return target;
 }
-function _ts_generator$e(thisArg, body) {
+function _ts_generator$g(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -928,9 +1106,9 @@ function _ts_generator$e(thisArg, body) {
             return spec.builder ? spec.builder(yargs) : yargs;
         },
         handler: function handler(argv) {
-            return _async_to_generator$e(function() {
+            return _async_to_generator$g(function() {
                 var context, data, params, result, e;
-                return _ts_generator$e(this, function(_state) {
+                return _ts_generator$g(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             _state.trys.push([
@@ -1091,7 +1269,7 @@ function _ts_generator$e(thisArg, body) {
     });
 }
 
-function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1105,16 +1283,16 @@ function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$d(fn) {
+function _async_to_generator$f(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$f(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -1175,7 +1353,7 @@ function _object_spread_props$6(target, source) {
     }
     return target;
 }
-function _ts_generator$d(thisArg, body) {
+function _ts_generator$f(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1286,9 +1464,9 @@ function _ts_generator$d(thisArg, body) {
         return withCallModelArgs(yargs);
     },
     handler: function handler(argv) {
-        return _async_to_generator$d(function() {
+        return _async_to_generator$f(function() {
             var context, data, params, result, e;
-            return _ts_generator$d(this, function(_state) {
+            return _ts_generator$f(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         _state.trys.push([
@@ -1346,12 +1524,12 @@ function _ts_generator$d(thisArg, body) {
     }
 };
 
-function _array_like_to_array$6(arr, len) {
+function _array_like_to_array$7(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$3(arr) {
+function _array_with_holes$4(arr) {
     if (Array.isArray(arr)) return arr;
 }
 function _instanceof$4(left, right) {
@@ -1362,7 +1540,7 @@ function _instanceof$4(left, right) {
         return left instanceof right;
     }
 }
-function _iterable_to_array_limit$3(arr, i) {
+function _iterable_to_array_limit$4(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -1386,23 +1564,23 @@ function _iterable_to_array_limit$3(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$3() {
+function _non_iterable_rest$4() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$3(arr, i) {
-    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$6(arr, i) || _non_iterable_rest$3();
+function _sliced_to_array$4(arr, i) {
+    return _array_with_holes$4(arr) || _iterable_to_array_limit$4(arr, i) || _unsupported_iterable_to_array$7(arr, i) || _non_iterable_rest$4();
 }
 function _type_of$1(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$6(o, minLen) {
+function _unsupported_iterable_to_array$7(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
 }
 /**
  * Resolves the manifest entry for `modelType`. Lookup tries
@@ -1433,113 +1611,914 @@ function _unsupported_iterable_to_array$6(o, minLen) {
                 _iterator.return();
             }
         } finally{
-            if (_didIteratorError) {
-                throw _iteratorError;
-            }
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Rewrites the persisted (short) keys in `data` to the long-name form
+ * declared in the model's manifest entry. Recurses into nested object-array
+ * and sub-object fields when the manifest captured a nested field map.
+ *
+ * Returns the input untouched when `modelType` is not in the manifest, when
+ * the model has no fields, or when the input is not a plain object/array.
+ * Unknown keys, primitives, `Date`, `null`, and `undefined` pass through
+ * unchanged.
+ *
+ * @param modelType - the model identifier (`modelType`, `identityConst`,
+ *   or `collectionPrefix`) used to look up the rewrite map.
+ * @param data - the value to rewrite (typically a `read`/`query` response
+ *   payload).
+ * @param manifest - generated model manifest.
+ * @returns the rewritten value, or `data` unchanged when no rewrite applies.
+ * @__NO_SIDE_EFFECTS__
+ */ function expandModelKeys(modelType, data, manifest) {
+    var entry = findCliModelManifestEntry(modelType, manifest);
+    if (!entry) return data;
+    return rewriteWithFields(data, entry.fields);
+}
+function rewriteWithFields(value, fields) {
+    if (Array.isArray(value)) {
+        return value.map(function(item) {
+            return rewriteWithFields(item, fields);
+        });
+    }
+    if (!isPlainObject(value)) return value;
+    var fieldByName = new Map();
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = fields[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var field = _step.value;
+            fieldByName.set(field.name, field);
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    var out = {};
+    var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+    try {
+        for(var _iterator1 = Object.entries(value)[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+            var _step_value = _sliced_to_array$4(_step1.value, 2), key = _step_value[0], raw = _step_value[1];
+            var field1 = fieldByName.get(key);
+            if (!field1) {
+                out[key] = raw;
+                continue;
+            }
+            var longKey = field1.longName.length > 0 ? field1.longName : key;
+            out[longKey] = rewriteFieldValue(raw, field1);
+        }
+    } catch (err) {
+        _didIteratorError1 = true;
+        _iteratorError1 = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                _iterator1.return();
+            }
+        } finally{
+            if (_didIteratorError1) {
+                throw _iteratorError1;
+            }
+        }
+    }
+    return out;
+}
+function rewriteFieldValue(value, field) {
+    var nested = field.nestedFields;
+    if (!nested || nested.length === 0) return value;
+    if (field.nestedIsArray) {
+        if (!Array.isArray(value)) return value;
+        return value.map(function(item) {
+            return rewriteWithFields(item, nested);
+        });
+    }
+    if (!isPlainObject(value)) return value;
+    return rewriteWithFields(value, nested);
+}
+function isPlainObject(value) {
+    if (value === null || (typeof value === "undefined" ? "undefined" : _type_of$1(value)) !== 'object') return false;
+    if (Array.isArray(value)) return false;
+    if (_instanceof$4(value, Date)) return false;
+    // Objects from JSON.parse have Object.prototype as their proto. Anything
+    // exotic (Map, Set, Buffer, class instances) we leave untouched.
+    var proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+
+/**
+ * Default command name for the model-decode command. Top-level so it stays
+ * out of the API-call namespace owned by `model <model> <action>`.
+ */ var DEFAULT_MODEL_DECODE_COMMAND_NAME = 'model-decode';
+/**
+ * Builds the top-level `model-decode <key>` command.
+ *
+ * Splits the supplied Firestore key on `/`, walks `[prefix, id]` pairs, and
+ * resolves each prefix against the manifest. Supports subcollection paths
+ * (`nb/abc/nbn/def` → leaf `Notification` + parent `NotificationBox`).
+ *
+ * Flags:
+ *   - `--json` emits a structured `{ ok, data }` envelope instead of the
+ *     human-readable block (useful for scripting or LLM agents).
+ *
+ * @param manifest - The generated model manifest (e.g. `DEMO_CLI_MODEL_MANIFEST`).
+ * @param options - Optional overrides; see {@link BuildModelDecodeCommandOptions}.
+ * @returns A yargs `CommandModule` ready to be passed to `runCli({ configCommands })`.
+ * @__NO_SIDE_EFFECTS__
+ */ function buildModelDecodeCommand(manifest, options) {
+    var _ref;
+    var commandName = (_ref = options === null || options === void 0 ? void 0 : options.commandName) !== null && _ref !== void 0 ? _ref : DEFAULT_MODEL_DECODE_COMMAND_NAME;
+    return {
+        command: "".concat(commandName, " <key>"),
+        describe: 'Decode a Firestore model key (e.g. "jwr/abc123") into model + id info using the registered manifest ('.concat(manifest.length, " model").concat(manifest.length === 1 ? '' : 's', ")."),
+        builder: function builder(yargs) {
+            return yargs.positional('key', {
+                type: 'string',
+                describe: 'Firestore model key — prefix/id, supports subcollection paths like `parentPrefix/parentId/childPrefix/childId`.'
+            }).option('json', {
+                type: 'boolean',
+                default: false,
+                describe: 'Emit a structured JSON envelope instead of the human-readable block.'
+            });
+        },
+        handler: function handler(argv) {
+            try {
+                runHandler$1(manifest, argv);
+            } catch (e) {
+                outputError(e);
+                process.exit(1);
+            }
+        }
+    };
+}
+function runHandler$1(manifest, argv) {
+    var rawKey = typeof argv.key === 'string' ? argv.key : '';
+    var decoded = decodeFirestoreModelKey(rawKey, manifest);
+    if (argv.json) {
+        outputResult(decoded);
+        return;
+    }
+    process.stdout.write(renderDecodedKey(decoded));
+}
+/**
+ * Splits `rawKey` on `/`, resolves each `[prefix, id]` pair against the
+ * manifest, and returns the leaf segment + ancestor chain. Throws
+ * {@link CliError} for malformed inputs.
+ *
+ * @param rawKey - The Firestore key string.
+ * @param manifest - The generated model manifest.
+ * @returns The decoded key with leaf, ancestors, and any unresolved prefixes.
+ * @__NO_SIDE_EFFECTS__
+ */ function decodeFirestoreModelKey(rawKey, manifest) {
+    var trimmed = rawKey.trim();
+    if (trimmed.length === 0) {
+        throw new CliError({
+            message: 'Key is empty. Provide a Firestore key like `sf/abc123`.',
+            code: 'MODEL_DECODE_INVALID_KEY'
+        });
+    }
+    var segments = trimmed.split('/').filter(function(s) {
+        return s.length > 0;
+    });
+    if (segments.length < 2 || segments.length % 2 !== 0) {
+        throw new CliError({
+            message: "Invalid Firestore key '".concat(trimmed, "'. Expected an even number of segments (`prefix/id` pairs). Got ").concat(segments.length, " segment(s)."),
+            code: 'MODEL_DECODE_INVALID_KEY',
+            suggestion: 'Use the format `prefix/id` (or `parentPrefix/parentId/childPrefix/childId` for subcollections).'
+        });
+    }
+    var decoded = [];
+    var unresolved = [];
+    for(var i = 0; i < segments.length; i += 2){
+        var prefix = segments[i];
+        var id = segments[i + 1];
+        var entry = findCliModelManifestEntry(prefix, manifest);
+        if (!entry) {
+            unresolved.push(prefix);
+        }
+        decoded.push(toSegment(prefix, id, entry));
+    }
+    var leaf = decoded[decoded.length - 1];
+    var ancestors = decoded.slice(0, -1);
+    return {
+        key: trimmed,
+        leaf: leaf,
+        ancestors: ancestors,
+        unresolvedPrefixes: unresolved
+    };
+}
+function toSegment(prefix, id, entry) {
+    if (!entry) {
+        return {
+            prefix: prefix,
+            id: id
+        };
+    }
+    return {
+        prefix: prefix,
+        id: id,
+        modelName: entry.modelName,
+        modelType: entry.modelType,
+        modelGroup: entry.modelGroup,
+        identityConst: entry.identityConst,
+        parentIdentityConst: entry.parentIdentityConst,
+        sourcePackage: entry.sourcePackage,
+        sourceFile: entry.sourceFile
+    };
+}
+/**
+ * Renders a {@link DecodedKey} as a human-readable text block. Mirrors the
+ * MCP `dbx_model_decode` key-mode output for consistency between agent and
+ * shell consumers.
+ *
+ * @param decoded - the decoded key returned by {@link decodeFirestoreModelKey}.
+ * @returns the formatted block with a trailing newline.
+ * @__NO_SIDE_EFFECTS__
+ */ function renderDecodedKey(decoded) {
+    var lines = [];
+    var leaf = decoded.leaf;
+    if (leaf.modelName) {
+        lines.push("Model: ".concat(leaf.modelName));
+        if (leaf.identityConst) lines.push("identityConst: ".concat(leaf.identityConst));
+        if (leaf.modelType) lines.push("modelType: ".concat(leaf.modelType));
+        lines.push("prefix: ".concat(leaf.prefix));
+        lines.push("id: ".concat(leaf.id));
+        if (leaf.modelGroup) lines.push("modelGroup: ".concat(leaf.modelGroup));
+        if (leaf.parentIdentityConst) lines.push("parentIdentityConst: ".concat(leaf.parentIdentityConst));
+        if (leaf.sourcePackage) {
+            var sourceSuffix = leaf.sourceFile ? " (".concat(leaf.sourceFile, ")") : '';
+            lines.push("source: ".concat(leaf.sourcePackage).concat(sourceSuffix));
+        }
+    } else {
+        lines.push("Model: <unknown — prefix '".concat(leaf.prefix, "' not in manifest>"));
+        lines.push("prefix: ".concat(leaf.prefix));
+        lines.push("id: ".concat(leaf.id));
+    }
+    if (decoded.ancestors.length > 0) {
+        lines.push('');
+        lines.push('Parent chain:');
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = decoded.ancestors[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var ancestor = _step.value;
+                if (ancestor.modelName) {
+                    lines.push("- ".concat(ancestor.modelName, " — prefix ").concat(ancestor.prefix, ", id ").concat(ancestor.id));
+                } else {
+                    lines.push("- <unknown> — prefix ".concat(ancestor.prefix, ", id ").concat(ancestor.id));
+                }
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
+                }
+            } finally{
+                if (_didIteratorError) {
+                    throw _iteratorError;
+                }
+            }
+        }
+    }
+    if (decoded.unresolvedPrefixes.length > 0) {
+        lines.push('');
+        lines.push("Unresolved prefix".concat(decoded.unresolvedPrefixes.length === 1 ? '' : 'es', ": ").concat(decoded.unresolvedPrefixes.join(', '), ". Run `model-info` to list known models."));
+    }
+    return lines.join('\n') + '\n';
+}
+
+function _array_like_to_array$6(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes$3(arr) {
+    if (Array.isArray(arr)) return arr;
+}
+function _array_without_holes$4(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
+}
+function _iterable_to_array$4(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _iterable_to_array_limit$3(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest$3() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _non_iterable_spread$4() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _sliced_to_array$3(arr, i) {
+    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$6(arr, i) || _non_iterable_rest$3();
+}
+function _to_consumable_array$4(arr) {
+    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$4();
+}
+function _unsupported_iterable_to_array$6(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
+}
+/**
+ * Parses the positionals for the top-level `get <modelOrKey> [key]` command into a
+ * `{ modelType, key }` pair, using the supplied {@link CliModelManifest} to resolve
+ * collection-name prefixes when the explicit-model form is not used.
+ *
+ * Rules:
+ * 1. Two positionals (`modelOrKey` + `key`) — `modelOrKey` is treated as the explicit
+ *    `modelType` and `key` is passed through verbatim. No manifest lookup performed.
+ * 2. One positional (`modelOrKey` only) — treated as a full Firestore key (`prefix/id`).
+ *    {@link decodeFirestoreModelKey} resolves the prefix against the manifest. Throws
+ *    {@link CliError} if the manifest is missing, the prefix is unresolved, or the leaf
+ *    has no `modelType`.
+ *
+ * @param input.modelOrKey - The first positional from yargs.
+ * @param input.key - The optional second positional from yargs.
+ * @param input.manifest - The generated model manifest (for prefix lookup).
+ * @returns The parsed `{ modelType, key }` pair.
+ * @__NO_SIDE_EFFECTS__
+ */ function parseGetArgs(input) {
+    var _input_modelOrKey;
+    var _input_key;
+    var modelOrKey = ((_input_modelOrKey = input.modelOrKey) !== null && _input_modelOrKey !== void 0 ? _input_modelOrKey : '').trim();
+    if (modelOrKey.length === 0) {
+        throw new CliError({
+            message: 'get: missing required positional. Usage: `get <key>` or `get <model> <key>`.',
+            code: 'INVALID_ARGUMENT'
+        });
+    }
+    var explicitKey = (_input_key = input.key) === null || _input_key === void 0 ? void 0 : _input_key.trim();
+    if (explicitKey != null && explicitKey.length > 0) {
+        return {
+            modelType: modelOrKey,
+            key: explicitKey
+        };
+    }
+    if (!modelOrKey.includes('/')) {
+        throw new CliError({
+            message: "get: '".concat(modelOrKey, "' looks like a bare doc id. Provide a full key (e.g. 'jws/abc123') or use 'get <model> <key>'."),
+            code: 'INVALID_ARGUMENT'
+        });
+    }
+    var manifest = input.manifest;
+    if (!manifest || manifest.length === 0) {
+        throw new CliError({
+            message: 'get: cannot infer modelType — no model manifest is wired into the CLI. Pass `modelManifest` to `runCli`, or use `get <model> <key>` explicitly.',
+            code: 'INVALID_ARGUMENT'
+        });
+    }
+    var decoded = decodeFirestoreModelKey(modelOrKey, manifest);
+    if (decoded.unresolvedPrefixes.length > 0 || !decoded.leaf.modelType) {
+        throw new CliError({
+            message: "get: unable to resolve modelType for key '".concat(modelOrKey, "'. Unknown prefix: ").concat(decoded.unresolvedPrefixes.join(', ') || decoded.leaf.prefix, ". Known prefixes: ").concat(manifestPrefixList(manifest), "."),
+            code: 'INVALID_ARGUMENT',
+            suggestion: "Run `<cli> model-decode '<key>'` to inspect a key, or use `get <model> <key>` explicitly."
+        });
+    }
+    return {
+        modelType: decoded.leaf.modelType,
+        key: modelOrKey
+    };
+}
+/**
+ * Parses the positionals for the top-level `get-many <firstArg> [rest..]` command.
+ *
+ * Rules:
+ * 1. If `firstArg` contains `/` it is treated as a key — all positionals (`firstArg` + `rest`)
+ *    are decoded via {@link decodeFirestoreModelKey}. All keys must resolve to the same
+ *    `modelType` or a {@link CliError} is thrown (the backend route is single-modelType per call).
+ * 2. Otherwise `firstArg` is treated as the explicit `modelType` and `rest` are the keys.
+ *
+ * Always rejects empty key lists and lists exceeding 50 keys.
+ *
+ * @param input.firstArg - The first positional from yargs.
+ * @param input.rest - The remaining positionals from yargs.
+ * @param input.manifest - The generated model manifest (used only in the inferred-key branch).
+ * @returns The parsed `{ modelType, keys }` pair.
+ * @__NO_SIDE_EFFECTS__
+ */ function parseGetManyArgs(input) {
+    var _input_firstArg, _input_rest;
+    var firstArg = ((_input_firstArg = input.firstArg) !== null && _input_firstArg !== void 0 ? _input_firstArg : '').trim();
+    var rest = ((_input_rest = input.rest) !== null && _input_rest !== void 0 ? _input_rest : []).map(function(s) {
+        return s.trim();
+    }).filter(function(s) {
+        return s.length > 0;
+    });
+    if (firstArg.length === 0) {
+        throw new CliError({
+            message: 'get-many: missing required positionals. Usage: `get-many <key...>` or `get-many <model> <key...>`.',
+            code: 'INVALID_ARGUMENT'
+        });
+    }
+    if (firstArg.includes('/')) {
+        var keys = [
+            firstArg
+        ].concat(_to_consumable_array$4(rest));
+        return inferModelTypeFromKeys(keys, input.manifest);
+    }
+    if (rest.length === 0) {
+        throw new CliError({
+            message: "get-many: '".concat(firstArg, "' has no '/' so it was treated as a model name, but no keys were supplied. Usage: 'get-many <model> <key...>'."),
+            code: 'INVALID_ARGUMENT'
+        });
+    }
+    return {
+        modelType: firstArg,
+        keys: rest
+    };
+}
+function inferModelTypeFromKeys(keys, manifest) {
+    if (!manifest || manifest.length === 0) {
+        throw new CliError({
+            message: 'get-many: cannot infer modelType — no model manifest is wired into the CLI. Pass `modelManifest` to `runCli`, or use `get-many <model> <key...>` explicitly.',
+            code: 'INVALID_ARGUMENT'
+        });
+    }
+    var decodedTypes = new Set();
+    var unresolved = [];
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = keys[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var key = _step.value;
+            var decoded = decodeFirestoreModelKey(key, manifest);
+            if (decoded.unresolvedPrefixes.length > 0 || !decoded.leaf.modelType) {
+                unresolved.push(key);
+            } else {
+                decodedTypes.add(decoded.leaf.modelType);
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    if (unresolved.length > 0) {
+        throw new CliError({
+            message: "get-many: unable to resolve modelType for key(s): ".concat(unresolved.join(', '), ". Known prefixes: ").concat(manifestPrefixList(manifest), "."),
+            code: 'INVALID_ARGUMENT'
+        });
+    }
+    if (decodedTypes.size > 1) {
+        throw new CliError({
+            message: "get-many: all keys must belong to the same modelType. Got: ".concat(_to_consumable_array$4(decodedTypes).join(', '), ". Split into separate calls."),
+            code: 'INVALID_ARGUMENT'
+        });
+    }
+    var _decodedTypes = _sliced_to_array$3(decodedTypes, 1), modelType = _decodedTypes[0];
+    return {
+        modelType: modelType,
+        keys: keys
+    };
+}
+function manifestPrefixList(manifest) {
+    var prefixes = manifest.map(function(e) {
+        return e.collectionPrefix;
+    }).sort();
+    return prefixes.join(', ');
+}
+
+function asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$e(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$e(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _ts_generator$e(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Top-level `get <modelOrKey> [key]` command.
+ *
+ * Reads a single Firestore document via the typed model-access endpoint. The `model` arg is optional:
+ * when only one positional is supplied, the CLI resolves the modelType from the key's leading
+ * collection-name prefix via {@link decodeFirestoreModelKey}. The two-positional form passes the
+ * explicit `modelType` straight through.
+ *
+ * Backend: `GET <apiBaseUrl>/model/<modelType>/get?key=<key>` (ModelApiController.getOne).
+ */ var getCommand = {
+    command: 'get <modelOrKey> [key]',
+    describe: 'Read a document by key. ModelType is inferred from the key prefix when only one positional is supplied.',
+    builder: function builder(yargs) {
+        return yargs.positional('modelOrKey', {
+            type: 'string',
+            describe: 'Full key (e.g. "jws/abc123") or model name when a second positional is supplied.'
+        }).positional('key', {
+            type: 'string',
+            describe: 'Document key when the first positional is a model name.'
+        });
+    },
+    handler: function handler(argv) {
+        return _async_to_generator$e(function() {
+            var context, _parseGetArgs, modelType, key, result, e;
+            return _ts_generator$e(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            2,
+                            ,
+                            3
+                        ]);
+                        context = requireCliContext();
+                        _parseGetArgs = parseGetArgs({
+                            modelOrKey: typeof argv.modelOrKey === 'string' ? argv.modelOrKey : undefined,
+                            key: typeof argv.key === 'string' ? argv.key : undefined,
+                            manifest: context.modelManifest
+                        }), modelType = _parseGetArgs.modelType, key = _parseGetArgs.key;
+                        return [
+                            4,
+                            context.getModel(modelType, key)
+                        ];
+                    case 1:
+                        result = _state.sent();
+                        outputResult(result);
+                        return [
+                            3,
+                            3
+                        ];
+                    case 2:
+                        e = _state.sent();
+                        outputError(e);
+                        process.exit(1);
+                        return [
+                            3,
+                            3
+                        ];
+                    case 3:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    }
+};
+
+function asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$d(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$d(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _ts_generator$d(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
         }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
     }
-    return result;
 }
 /**
- * Rewrites the persisted (short) keys in `data` to the long-name form
- * declared in the model's manifest entry. Recurses into nested object-array
- * and sub-object fields when the manifest captured a nested field map.
+ * Top-level `get-many <firstArg> [rest..]` command.
  *
- * Returns the input untouched when `modelType` is not in the manifest, when
- * the model has no fields, or when the input is not a plain object/array.
- * Unknown keys, primitives, `Date`, `null`, and `undefined` pass through
- * unchanged.
+ * Batch-reads up to 50 Firestore documents in a single request. The first positional can either
+ * be an explicit modelType (followed by ≥1 keys) or a full key (followed by additional keys whose
+ * prefixes must resolve to the same modelType).
  *
- * @param modelType - the model identifier (`modelType`, `identityConst`,
- *   or `collectionPrefix`) used to look up the rewrite map.
- * @param data - the value to rewrite (typically a `read`/`query` response
- *   payload).
- * @param manifest - generated model manifest.
- * @returns the rewritten value, or `data` unchanged when no rewrite applies.
- * @__NO_SIDE_EFFECTS__
- */ function expandModelKeys(modelType, data, manifest) {
-    var entry = findCliModelManifestEntry(modelType, manifest);
-    if (!entry) return data;
-    return rewriteWithFields(data, entry.fields);
-}
-function rewriteWithFields(value, fields) {
-    if (Array.isArray(value)) {
-        return value.map(function(item) {
-            return rewriteWithFields(item, fields);
-        });
-    }
-    if (!isPlainObject(value)) return value;
-    var fieldByName = new Map();
-    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-    try {
-        for(var _iterator = fields[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var field = _step.value;
-            fieldByName.set(field.name, field);
-        }
-    } catch (err) {
-        _didIteratorError = true;
-        _iteratorError = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion && _iterator.return != null) {
-                _iterator.return();
-            }
-        } finally{
-            if (_didIteratorError) {
-                throw _iteratorError;
-            }
-        }
-    }
-    var out = {};
-    var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
-    try {
-        for(var _iterator1 = Object.entries(value)[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-            var _step_value = _sliced_to_array$3(_step1.value, 2), key = _step_value[0], raw = _step_value[1];
-            var field1 = fieldByName.get(key);
-            if (!field1) {
-                out[key] = raw;
-                continue;
-            }
-            var longKey = field1.longName.length > 0 ? field1.longName : key;
-            out[longKey] = rewriteFieldValue(raw, field1);
-        }
-    } catch (err) {
-        _didIteratorError1 = true;
-        _iteratorError1 = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
-                _iterator1.return();
-            }
-        } finally{
-            if (_didIteratorError1) {
-                throw _iteratorError1;
-            }
-        }
-    }
-    return out;
-}
-function rewriteFieldValue(value, field) {
-    var nested = field.nestedFields;
-    if (!nested || nested.length === 0) return value;
-    if (field.nestedIsArray) {
-        if (!Array.isArray(value)) return value;
-        return value.map(function(item) {
-            return rewriteWithFields(item, nested);
+ * Backend: `POST <apiBaseUrl>/model/<modelType>/get` with body `{ keys }` (ModelApiController.getMany).
+ */ var getManyCommand = {
+    command: 'get-many <firstArg> [rest..]',
+    describe: 'Read up to 50 documents by key. ModelType is inferred from key prefixes when they all agree.',
+    builder: function builder(yargs) {
+        return yargs.positional('firstArg', {
+            type: 'string',
+            describe: 'Full key (e.g. "jws/abc") or model name when the remaining positionals are bare ids.'
+        }).positional('rest', {
+            type: 'string',
+            array: true,
+            default: [],
+            describe: 'Additional keys (or bare ids when the first positional is a model name).'
         });
+    },
+    handler: function handler(argv) {
+        return _async_to_generator$d(function() {
+            var context, _parseGetManyArgs, modelType, keys, result, e;
+            return _ts_generator$d(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            2,
+                            ,
+                            3
+                        ]);
+                        context = requireCliContext();
+                        _parseGetManyArgs = parseGetManyArgs({
+                            firstArg: typeof argv.firstArg === 'string' ? argv.firstArg : undefined,
+                            rest: Array.isArray(argv.rest) ? argv.rest : [],
+                            manifest: context.modelManifest
+                        }), modelType = _parseGetManyArgs.modelType, keys = _parseGetManyArgs.keys;
+                        return [
+                            4,
+                            context.getMultipleModels(modelType, keys)
+                        ];
+                    case 1:
+                        result = _state.sent();
+                        outputResult(result);
+                        return [
+                            3,
+                            3
+                        ];
+                    case 2:
+                        e = _state.sent();
+                        outputError(e);
+                        process.exit(1);
+                        return [
+                            3,
+                            3
+                        ];
+                    case 3:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
     }
-    if (!isPlainObject(value)) return value;
-    return rewriteWithFields(value, nested);
-}
-function isPlainObject(value) {
-    if (value === null || (typeof value === "undefined" ? "undefined" : _type_of$1(value)) !== 'object') return false;
-    if (Array.isArray(value)) return false;
-    if (_instanceof$4(value, Date)) return false;
-    // Objects from JSON.parse have Object.prototype as their proto. Anything
-    // exotic (Map, Set, Buffer, class instances) we leave untouched.
-    var proto = Object.getPrototypeOf(value);
-    return proto === Object.prototype || proto === null;
-}
+};
 
 function asyncGeneratorStep$c(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -1868,6 +2847,11 @@ function mergeOutputCommandsConfig(existing, updates) {
     'model.update',
     'model.delete'
 ];
+/**
+ * The default redirect URI used by the CLI.
+ *
+ * Opens up to nothing in the browser so the user can copy/paste the resulting token url back into the CLI.
+ */ var DEFAULT_CLI_REDIRECT_URI = 'http://127.0.0.1:0/callback';
 /**
  * Returns the input scope string with the `model.create`, `model.update`, and `model.delete`
  * scopes removed, preserving every other scope (including `model.read` and `model.query`).
@@ -2198,7 +3182,8 @@ function _ts_generator$b(thisArg, body) {
     }
 }
 /**
- * Fetches the OIDC discovery document for the given issuer, trying these candidates in order:
+ * Builds the ordered list of `.well-known/openid-configuration` URLs the CLI probes when
+ * discovering OIDC metadata.
  *
  *   1. `<issuer>/.well-known/openid-configuration` (OpenID Connect Discovery 1.0).
  *   2. `<issuer-origin>/.well-known/openid-configuration` (host-rooted; matches projects that
@@ -2206,33 +3191,48 @@ function _ts_generator$b(thisArg, body) {
  *      sub-path — e.g. demo's `OidcWellKnownController`).
  *   3. `<fallbackBaseUrl>/.well-known/openid-configuration` when supplied and not already covered.
  *
+ * Exported so diagnostic surfaces (e.g. `doctor`) can show the exact URLs the discovery step
+ * tried — without re-implementing the candidate ordering.
+ *
+ * @param input - The discovery request.
+ * @param input.issuer - The OIDC issuer URL whose `.well-known/openid-configuration` is fetched first.
+ * @param input.fallbackBaseUrl - Optional sibling base URL appended after the issuer-prefixed and origin-rooted candidates.
+ * @returns The candidate URL list in probe order, de-duplicated.
+ */ function buildOidcDiscoveryCandidates(input) {
+    var candidates = [
+        "".concat(trimSlash(input.issuer), "/.well-known/openid-configuration")
+    ];
+    try {
+        var originCandidate = "".concat(new URL(input.issuer).origin, "/.well-known/openid-configuration");
+        if (!candidates.includes(originCandidate)) {
+            candidates.push(originCandidate);
+        }
+    } catch (unused) {
+    // Issuer URL didn't parse — skip the origin-rooted candidate and let the explicit fallback handle it.
+    }
+    if (input.fallbackBaseUrl) {
+        var fallbackCandidate = "".concat(trimSlash(input.fallbackBaseUrl), "/.well-known/openid-configuration");
+        if (!candidates.includes(fallbackCandidate)) {
+            candidates.push(fallbackCandidate);
+        }
+    }
+    return candidates;
+}
+/**
+ * Fetches the OIDC discovery document for the given issuer, trying the candidates returned by
+ * {@link buildOidcDiscoveryCandidates} in order.
+ *
  * @param input - The discovery request.
  * @param input.issuer - The OIDC issuer URL whose `.well-known/openid-configuration` is fetched first.
  * @param input.fallbackBaseUrl - Optional sibling base URL tried after the issuer-prefixed and origin-rooted candidates.
  * @returns The parsed {@link OidcDiscoveryMetadata}. Throws a {@link CliError} (`OIDC_DISCOVERY_FAILED`) when every candidate fails.
  */ function discoverOidcMetadata(input) {
     return _async_to_generator$b(function() {
-        var _ref, candidates, originCandidate, fallbackCandidate, lastError, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, url, res, e, err;
+        var _ref, candidates, lastError, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, url, res, e, err;
         return _ts_generator$b(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    candidates = [
-                        "".concat(trimSlash(input.issuer), "/.well-known/openid-configuration")
-                    ];
-                    try {
-                        originCandidate = "".concat(new URL(input.issuer).origin, "/.well-known/openid-configuration");
-                        if (!candidates.includes(originCandidate)) {
-                            candidates.push(originCandidate);
-                        }
-                    } catch (unused) {
-                    // Issuer URL didn't parse — skip the origin-rooted candidate and let the explicit fallback handle it.
-                    }
-                    if (input.fallbackBaseUrl) {
-                        fallbackCandidate = "".concat(trimSlash(input.fallbackBaseUrl), "/.well-known/openid-configuration");
-                        if (!candidates.includes(fallbackCandidate)) {
-                            candidates.push(fallbackCandidate);
-                        }
-                    }
+                    candidates = buildOidcDiscoveryCandidates(input);
                     _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
                     _state.label = 1;
                 case 1:
@@ -2289,7 +3289,7 @@ function _ts_generator$b(thisArg, body) {
                     ];
                 case 7:
                     e = _state.sent();
-                    lastError = _instanceof$3(e, Error) ? e : new Error(String(e));
+                    lastError = new Error("OIDC discovery failed at ".concat(url, ": ").concat(_instanceof$3(e, Error) ? e.message : String(e)));
                     return [
                         3,
                         8
@@ -2328,7 +3328,7 @@ function _ts_generator$b(thisArg, body) {
                     ];
                 case 12:
                     throw new CliError({
-                        message: (_ref = lastError === null || lastError === void 0 ? void 0 : lastError.message) !== null && _ref !== void 0 ? _ref : 'OIDC discovery failed',
+                        message: (_ref = lastError === null || lastError === void 0 ? void 0 : lastError.message) !== null && _ref !== void 0 ? _ref : "OIDC discovery failed for all candidates: ".concat(candidates.join(', ')),
                         code: 'OIDC_DISCOVERY_FAILED',
                         suggestion: 'Verify the env oidcIssuer URL is reachable and serves /.well-known/openid-configuration.'
                     });
@@ -2723,14 +3723,24 @@ function _ts_generator$a(thisArg, body) {
 /**
  * Builds the authorization URL the user opens in a browser to start the PKCE flow.
  *
- * Resolves the user-facing endpoint by preferring `appClientUrl` (rebases the discovered
- * authorization endpoint onto that origin) over `apiBaseUrl` (`/oidc/login/client` shortcut),
- * and finally falls back to the discovered `authorizationEndpoint` itself.
+ * The user-facing endpoint is the discovered `authorizationEndpoint` (typically `/oidc/auth`)
+ * with its origin optionally rebased. The rebase origin is the first non-empty value among
+ * `appClientUrl` → `oidcIssuer` origin → `apiBaseUrl` origin. In a typical single-host
+ * deployment all three resolve to the same origin and the rebase is a no-op; in a split-host
+ * setup (frontend dev server proxying `/oidc/**` to the API) `appClientUrl` redirects the user
+ * through the frontend. When none of the three is provided, the discovered endpoint is used
+ * unchanged.
+ *
+ * Always lands at the actual authorization endpoint so oidc-provider can create an interaction
+ * and redirect to the app login page with a `uid`. (Earlier versions targeted a convenience
+ * `/oidc/login/client` redirect that forwarded query params to the app without creating an
+ * interaction — that branch is gone.)
  *
  * @param input - The authorization URL inputs.
  * @param input.authorizationEndpoint - The authorization endpoint discovered from OIDC metadata.
- * @param input.apiBaseUrl - Optional API base URL; when set without `appClientUrl`, the URL is built against `<apiBaseUrl>/oidc/login/client`.
- * @param input.appClientUrl - Optional frontend origin to rebase the authorization endpoint onto. Takes precedence over `apiBaseUrl`.
+ * @param input.appClientUrl - Optional client origin to rebase the authorization endpoint onto. Takes precedence over `oidcIssuer` and `apiBaseUrl`.
+ * @param input.oidcIssuer - Optional OIDC issuer URL; falls back to its origin as the rebase target when `appClientUrl` is missing.
+ * @param input.apiBaseUrl - Optional API base URL; falls back to its origin as the rebase target when neither `appClientUrl` nor `oidcIssuer` is set.
  * @param input.clientId - The OAuth client ID.
  * @param input.redirectUri - The redirect URI registered with the OAuth client.
  * @param input.scopes - Space-separated scope list. Defaults to {@link DEFAULT_CLI_OIDC_SCOPES}.
@@ -2740,15 +3750,22 @@ function _ts_generator$a(thisArg, body) {
  * @__NO_SIDE_EFFECTS__
  */ function buildAuthorizationUrl(input) {
     var _input_scopes;
+    var resolvedScope = (_input_scopes = input.scopes) !== null && _input_scopes !== void 0 ? _input_scopes : DEFAULT_CLI_OIDC_SCOPES;
     var authParams = {
         response_type: 'code',
         client_id: input.clientId,
         redirect_uri: input.redirectUri,
-        scope: (_input_scopes = input.scopes) !== null && _input_scopes !== void 0 ? _input_scopes : DEFAULT_CLI_OIDC_SCOPES,
+        scope: resolvedScope,
         code_challenge: input.codeChallenge,
         code_challenge_method: 'S256',
         state: input.state
     };
+    // oidc-provider's check_scope middleware silently strips `offline_access` unless the
+    // auth request also includes `prompt=consent`. Auto-add it so refresh tokens are
+    // actually issued whenever the CLI requests offline access.
+    if (resolvedScope.split(/\s+/).includes('offline_access')) {
+        authParams.prompt = 'consent';
+    }
     if (input.requestedSessionTtlSeconds != null) {
         if (!Number.isInteger(input.requestedSessionTtlSeconds) || input.requestedSessionTtlSeconds <= 0) {
             throw new CliError({
@@ -2758,19 +3775,17 @@ function _ts_generator$a(thisArg, body) {
         }
         authParams.dbx_session_ttl = String(input.requestedSessionTtlSeconds);
     }
-    var endpoint;
-    if (input.appClientUrl) {
-        endpoint = rebaseUrlOrigin({
-            url: input.authorizationEndpoint,
-            originUrl: input.appClientUrl
-        });
-    } else if (input.apiBaseUrl) {
-        endpoint = "".concat(input.apiBaseUrl.replace(/\/+$/, ''), "/oidc/login/client");
-    } else {
-        endpoint = input.authorizationEndpoint;
-    }
+    var rebaseOrigin = resolveAuthorizationRebaseOrigin({
+        appClientUrl: input.appClientUrl,
+        oidcIssuer: input.oidcIssuer,
+        apiBaseUrl: input.apiBaseUrl
+    });
+    var endpoint = rebaseOrigin ? rebaseUrlOrigin({
+        url: input.authorizationEndpoint,
+        originUrl: rebaseOrigin
+    }) : input.authorizationEndpoint;
     // Merge into the existing query string (preserving any params already on the endpoint) so
-    // a pre-baked endpoint like `/login/client?source=cli` survives unchanged.
+    // a pre-baked endpoint like `/oidc/auth?source=cli` survives unchanged.
     var url = new URL(endpoint);
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
@@ -2794,6 +3809,31 @@ function _ts_generator$a(thisArg, body) {
     }
     return url.toString();
 }
+/**
+ * Picks the origin used to rebase the discovered authorization endpoint, in priority order:
+ *   1. `appClientUrl` (verbatim — the explicit override)
+ *   2. `oidcIssuer` (parsed `origin`, e.g. `https://api.example.com/oidc` → `https://api.example.com`)
+ *   3. `apiBaseUrl` (parsed `origin`, e.g. `https://api.example.com/api` → `https://api.example.com`)
+ *
+ * Returns `undefined` when none is set or every candidate fails to parse; the caller should then
+ * use the discovered endpoint unchanged.
+ */ function resolveAuthorizationRebaseOrigin(input) {
+    var result;
+    if (input.appClientUrl) {
+        result = input.appClientUrl;
+    } else {
+        var _input_oidcIssuer;
+        var fallbackSource = (_input_oidcIssuer = input.oidcIssuer) !== null && _input_oidcIssuer !== void 0 ? _input_oidcIssuer : input.apiBaseUrl;
+        if (fallbackSource) {
+            try {
+                result = new URL(fallbackSource).origin;
+            } catch (unused) {
+            // Fall through with result undefined
+            }
+        }
+    }
+    return result;
+}
 /**
  * Returns `url` with its origin replaced by the origin of `originUrl`. The path and search of
  * `url` are preserved. When `originUrl` is empty/missing or either URL fails to parse, returns
@@ -3457,11 +4497,11 @@ function maskEnv$1(env) {
                                 resolve({
                                     argvValue: argv.redirectUri,
                                     existingValue: existing === null || existing === void 0 ? void 0 : existing.redirectUri,
-                                    prompt: "Redirect URI [".concat((_ref4 = existing === null || existing === void 0 ? void 0 : existing.redirectUri) !== null && _ref4 !== void 0 ? _ref4 : 'http://127.0.0.1:0/callback', "]: ")
+                                    prompt: "Redirect URI [".concat((_ref4 = existing === null || existing === void 0 ? void 0 : existing.redirectUri) !== null && _ref4 !== void 0 ? _ref4 : DEFAULT_CLI_REDIRECT_URI, "]: ")
                                 })
                             ];
                         case 9:
-                            redirectUri = (_ref3 = _state.sent()) !== null && _ref3 !== void 0 ? _ref3 : 'http://127.0.0.1:0/callback';
+                            redirectUri = (_ref3 = _state.sent()) !== null && _ref3 !== void 0 ? _ref3 : DEFAULT_CLI_REDIRECT_URI;
                             scopes = (_argv_scopes = argv.scopes) !== null && _argv_scopes !== void 0 ? _argv_scopes : existing === null || existing === void 0 ? void 0 : existing.scopes;
                             if (!apiBaseUrl || !oidcIssuer || !clientId || !clientSecret) {
                                 throw new CliError({
@@ -3601,6 +4641,7 @@ function maskEnv$1(env) {
                             }
                             url = buildAuthorizationUrl({
                                 authorizationEndpoint: meta.authorization_endpoint,
+                                oidcIssuer: env.oidcIssuer,
                                 apiBaseUrl: env.apiBaseUrl,
                                 appClientUrl: env.appClientUrl,
                                 clientId: env.clientId,
@@ -4348,7 +5389,7 @@ function _ts_generator$8(thisArg, body) {
         function(param) {
             var env = param.env;
             return _async_to_generator$8(function() {
-                var meta, e;
+                var candidates, meta, e;
                 return _ts_generator$8(this, function(_state) {
                     switch(_state.label){
                         case 0:
@@ -4362,6 +5403,10 @@ function _ts_generator$8(thisArg, body) {
                                     }
                                 ];
                             }
+                            candidates = buildOidcDiscoveryCandidates({
+                                issuer: env.oidcIssuer,
+                                fallbackBaseUrl: env.apiBaseUrl
+                            });
                             _state.label = 1;
                         case 1:
                             _state.trys.push([
@@ -4385,6 +5430,7 @@ function _ts_generator$8(thisArg, body) {
                                     name: 'oidc-discovery-reachable',
                                     ok: true,
                                     detail: {
+                                        candidates: candidates,
                                         authorization_endpoint: meta.authorization_endpoint,
                                         token_endpoint: meta.token_endpoint
                                     }
@@ -4398,6 +5444,7 @@ function _ts_generator$8(thisArg, body) {
                                     name: 'oidc-discovery-reachable',
                                     ok: false,
                                     detail: {
+                                        candidates: candidates,
                                         error: _instanceof$2(e, Error) ? e.message : String(e)
                                     },
                                     suggestion: 'Verify the env oidcIssuer URL and that the API is running.'
@@ -4503,7 +5550,10 @@ function _ts_generator$8(thisArg, body) {
                                     {
                                         name: 'token-refresh-round-trip',
                                         ok: false,
-                                        suggestion: "Run `".concat(cliName, " auth login --env ").concat(envName, "`.")
+                                        detail: {
+                                            reason: 'no-refresh-token'
+                                        },
+                                        suggestion: 'No refresh token cached for env "'.concat(envName, '". Run `').concat(cliName, " auth login --env ").concat(envName, "` — if the env's scopes omit `offline_access`, the OIDC provider may not issue one.")
                                     }
                                 ];
                             }
@@ -4580,6 +5630,7 @@ function _ts_generator$8(thisArg, body) {
                                     }
                                 ];
                             }
+                            url = "".concat(env.apiBaseUrl.replace(/\/+$/, '')).concat(CALL_MODEL_API_PATH);
                             _state.label = 1;
                         case 1:
                             _state.trys.push([
@@ -4588,7 +5639,6 @@ function _ts_generator$8(thisArg, body) {
                                 ,
                                 4
                             ]);
-                            url = "".concat(env.apiBaseUrl.replace(/\/+$/, '')).concat(CALL_MODEL_API_PATH);
                             return [
                                 4,
                                 fetch(url, {
@@ -4603,6 +5653,7 @@ function _ts_generator$8(thisArg, body) {
                                     name: 'api-base-url-reachable',
                                     ok: res.status < 500,
                                     detail: {
+                                        url: url,
                                         status: res.status
                                     }
                                 }
@@ -4615,6 +5666,7 @@ function _ts_generator$8(thisArg, body) {
                                     name: 'api-base-url-reachable',
                                     ok: false,
                                     detail: {
+                                        url: url,
                                         error: _instanceof$2(e, Error) ? e.message : String(e)
                                     },
                                     suggestion: 'Verify the API is running at apiBaseUrl.'
@@ -6126,7 +7178,8 @@ function _ts_generator$6(thisArg, body) {
                             cliName: input.cliName,
                             envName: envName,
                             env: env,
-                            accessToken: entry.accessToken
+                            accessToken: entry.accessToken,
+                            modelManifest: input.modelManifest
                         }));
                         return [
                             3,
@@ -7273,10 +8326,16 @@ function _ts_generator$2(thisArg, body) {
     if (input.modelManifest && input.disableModelInfo !== true) {
         builtInConfigCommands.push(buildModelInfoCommand(input.modelManifest));
     }
+    if (input.modelManifest && input.disableModelDecode !== true) {
+        builtInConfigCommands.push(buildModelDecodeCommand(input.modelManifest));
+    }
     var allConfigCommands = _to_consumable_array$1(builtInConfigCommands).concat(_to_consumable_array$1((_input_configCommands = input.configCommands) !== null && _input_configCommands !== void 0 ? _input_configCommands : []));
     var builtInApiCommands = input.disableCallPassthrough ? [] : [
         callPassthroughCommand
     ];
+    if (input.disableModelGet !== true) {
+        builtInApiCommands.push(getCommand, getManyCommand);
+    }
     var allApiCommands = _to_consumable_array$1(builtInApiCommands).concat(_to_consumable_array$1((_input_apiCommands = input.apiCommands) !== null && _input_apiCommands !== void 0 ? _input_apiCommands : []));
     var skipCommandNames = new Set(allConfigCommands.map(function(c) {
         return commandName(c);
@@ -7328,7 +8387,8 @@ function _ts_generator$2(thisArg, body) {
         createAuthMiddleware({
             cliName: cliName,
             skipCommands: skipCommandNames,
-            defaultEnvs: defaultEnvs
+            defaultEnvs: defaultEnvs,
+            modelManifest: input.modelManifest
         }),
         createOutputMiddleware({
             cliName: cliName,
@@ -7880,6 +8940,7 @@ function buildModelCommand(model, entries, context) {
                     }
                 }
             }
+            yargs.command(buildPerModelGetCommand(model));
             hideGlobalOptions(yargs, context.hideOnFocus);
             return yargs.demandCommand(1, 'Please specify an action.');
         },
@@ -7888,6 +8949,71 @@ function buildModelCommand(model, entries, context) {
         }
     };
 }
+/**
+ * Synthetic per-model `get <key>` sub-command appended to every model's command tree.
+ *
+ * The parent `model <name>` already fixes the `modelType`, so this command just passes the bare
+ * `key` positional through to `context.getModel(modelType, key)`. Supports both the full
+ * `<prefix>/<id>` form and a bare doc id (when the user knows the modelType from the parent).
+ */ function buildPerModelGetCommand(model) {
+    return {
+        command: 'get <key>',
+        describe: "Read a single ".concat(model, " document by key."),
+        builder: function builder(yargs) {
+            return yargs.positional('key', {
+                type: 'string',
+                describe: "Firestore key for the ".concat(model, " document (full `prefix/id` or bare id).")
+            });
+        },
+        handler: function handler(argv) {
+            return _async_to_generator$1(function() {
+                var ctx, key, result, e;
+                return _ts_generator$1(this, function(_state) {
+                    switch(_state.label){
+                        case 0:
+                            _state.trys.push([
+                                0,
+                                2,
+                                ,
+                                3
+                            ]);
+                            ctx = requireCliContext();
+                            key = typeof argv.key === 'string' ? argv.key.trim() : '';
+                            if (key.length === 0) {
+                                throw new CliError({
+                                    message: "get: missing required <key> positional for model '".concat(model, "'."),
+                                    code: 'INVALID_ARGUMENT'
+                                });
+                            }
+                            return [
+                                4,
+                                ctx.getModel(model, key)
+                            ];
+                        case 1:
+                            result = _state.sent();
+                            outputResult(result);
+                            return [
+                                3,
+                                3
+                            ];
+                        case 2:
+                            e = _state.sent();
+                            outputError(e);
+                            process.exit(1);
+                            return [
+                                3,
+                                3
+                            ];
+                        case 3:
+                            return [
+                                2
+                            ];
+                    }
+                });
+            })();
+        }
+    };
+}
 function buildEntryCommand(entry, context) {
     var _oneLineDescription;
     var action = entry.specifier && entry.specifier !== '_' ? "".concat(entry.verb, "-").concat(entry.specifier) : entry.verb;
@@ -8836,13 +9962,16 @@ Object.defineProperty(exports, "CALL_MODEL_APP_FUNCTION_KEY", {
 exports.CALL_MODEL_API_PATH = CALL_MODEL_API_PATH;
 exports.CliError = CliError;
 exports.DEFAULT_CLI_OIDC_SCOPES = DEFAULT_CLI_OIDC_SCOPES;
+exports.DEFAULT_CLI_REDIRECT_URI = DEFAULT_CLI_REDIRECT_URI;
 exports.DEFAULT_CLI_SECRET_PATTERNS = DEFAULT_CLI_SECRET_PATTERNS;
 exports.DEFAULT_MANIFEST_HELP_DATA_FORMAT = DEFAULT_MANIFEST_HELP_DATA_FORMAT;
 exports.DEFAULT_MANIFEST_HELP_MODE = DEFAULT_MANIFEST_HELP_MODE;
 exports.DEFAULT_MANIFEST_MODEL_COMMAND_NAME = DEFAULT_MANIFEST_MODEL_COMMAND_NAME;
+exports.DEFAULT_MODEL_DECODE_COMMAND_NAME = DEFAULT_MODEL_DECODE_COMMAND_NAME;
 exports.DEFAULT_MODEL_INFO_COMMAND_NAME = DEFAULT_MODEL_INFO_COMMAND_NAME;
 exports.DUMP_MERGE_MODES = DUMP_MERGE_MODES;
 exports.DUMP_OUTPUT_MODES = DUMP_OUTPUT_MODES;
+exports.MAX_MODEL_ACCESS_MULTI_READ_KEYS = MAX_MODEL_ACCESS_MULTI_READ_KEYS;
 exports.MODEL_WRITE_OIDC_SCOPES = MODEL_WRITE_OIDC_SCOPES;
 exports.MULTIPLE_PAGES_OUTPUT_MODES = MULTIPLE_PAGES_OUTPUT_MODES;
 exports.PROMPT_CANCELLED_ERROR_CODE = PROMPT_CANCELLED_ERROR_CODE;
@@ -8853,7 +9982,9 @@ exports.buildCliPaths = buildCliPaths;
 exports.buildDumpFilePath = buildDumpFilePath;
 exports.buildErrorOutput = buildErrorOutput;
 exports.buildManifestCommands = buildManifestCommands;
+exports.buildModelDecodeCommand = buildModelDecodeCommand;
 exports.buildModelInfoCommand = buildModelInfoCommand;
+exports.buildOidcDiscoveryCandidates = buildOidcDiscoveryCandidates;
 exports.callModelOverHttp = callModelOverHttp;
 exports.callPassthroughCommand = callPassthroughCommand;
 exports.configureCliErrorMapper = configureCliErrorMapper;
@@ -8870,6 +10001,7 @@ exports.createDoctorCommand = createDoctorCommand;
 exports.createEnvCommand = createEnvCommand;
 exports.createOutputCommand = createOutputCommand;
 exports.createOutputMiddleware = createOutputMiddleware;
+exports.decodeFirestoreModelKey = decodeFirestoreModelKey;
 exports.defaultDoctorChecks = defaultDoctorChecks;
 exports.detectDataHelpFormat = detectDataHelpFormat;
 exports.detectHelpMode = detectHelpMode;
@@ -8884,6 +10016,10 @@ exports.findCliModelManifestEntry = findCliModelManifestEntry;
 exports.generateOAuthState = generateOAuthState;
 exports.generatePkceMaterial = generatePkceMaterial;
 exports.getCliContext = getCliContext;
+exports.getCommand = getCommand;
+exports.getManyCommand = getManyCommand;
+exports.getModelOverHttp = getModelOverHttp;
+exports.getMultipleModelsOverHttp = getMultipleModelsOverHttp;
 exports.getOutputOptions = getOutputOptions;
 exports.isCliEnvConfigComplete = isCliEnvConfigComplete;
 exports.isTokenExpired = isTokenExpired;
@@ -8895,10 +10031,13 @@ exports.mergeOutputConfig = mergeOutputConfig;
 exports.openStreamingDump = openStreamingDump;
 exports.outputError = outputError;
 exports.outputResult = outputResult;
+exports.parseGetArgs = parseGetArgs;
+exports.parseGetManyArgs = parseGetManyArgs;
 exports.parsePastedRedirect = parsePastedRedirect;
 exports.pickFields = pickFields;
 exports.promptLine = promptLine;
 exports.refreshAccessToken = refreshAccessToken;
+exports.renderDecodedKey = renderDecodedKey;
 exports.renderModelManifestEntry = renderModelManifestEntry;
 exports.renderModelManifestFields = renderModelManifestFields;
 exports.renderModelManifestList = renderModelManifestList;