@dereekb/dbx-cli 13.11.6 → 13.11.8

package/manifest-extract/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli/manifest-extract",
-  "version": "13.11.6",
+  "version": "13.11.8",
   "sideEffects": false,
   "peerDependencies": {
     "ts-morph": "^21.0.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli",
-  "version": "13.11.6",
+  "version": "13.11.8",
   "sideEffects": false,
   "bin": {
     "dbx-cli-generate-firebase-api-manifest": "firebase-api-manifest/main.js"
@@ -24,10 +24,10 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/date": "13.11.6",
-    "@dereekb/firebase": "13.11.6",
-    "@dereekb/nestjs": "13.11.6",
-    "@dereekb/util": "13.11.6",
+    "@dereekb/date": "13.11.8",
+    "@dereekb/firebase": "13.11.8",
+    "@dereekb/nestjs": "13.11.8",
+    "@dereekb/util": "13.11.8",
     "arktype": "^2.2.0",
     "yargs": "^18.0.0"
   },

package/src/lib/api/call-model.client.d.ts

@@ -1,5 +1,6 @@
 import type { OnCallTypedModelParams } from '@dereekb/firebase';
 export declare const CALL_MODEL_API_PATH = "/model/call";
+export declare const MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
 export interface CallModelOverHttpInput<T = unknown> {
     /**
      * The API base URL — typically `<host>/<project>/us-central1/api` or `https://<domain>/api`.
@@ -34,4 +35,78 @@ export interface CallModelOverHttpResponse<R = unknown> {
  * @returns The parsed JSON response body cast to `R`.
  */
 export declare function callModelOverHttp<T = unknown, R = unknown>(input: CallModelOverHttpInput<T>): Promise<R>;
+export interface GetModelOverHttpInput {
+    /**
+     * The API base URL — typically `<host>/<project>/us-central1/api` or `https://<domain>/api`.
+     *
+     * The `/model/<modelType>/get` path is appended automatically.
+     */
+    readonly apiBaseUrl: string;
+    readonly accessToken: string;
+    readonly modelType: string;
+    readonly key: string;
+    /**
+     * Custom fetch implementation for tests.
+     */
+    readonly fetcher?: typeof fetch;
+}
+export interface GetModelOverHttpResult<T = unknown> {
+    readonly key: string;
+    readonly data: T;
+}
+/**
+ * GETs a single Firestore document by key via the typed model-access endpoint.
+ *
+ * Calls `<apiBaseUrl>/model/<modelType>/get?key=<encoded key>` with a Bearer access token and
+ * returns the parsed `{ key, data }` envelope. Non-2xx responses are mapped to a {@link CliError}
+ * with a stable code derived from the status — matching {@link callModelOverHttp}'s error shape.
+ *
+ * The backend route is implemented by `ModelApiController.getOne` (packages/firebase-server) and
+ * enforces `roles: 'read'` via `useModel(...)` so Firestore security rules still apply.
+ *
+ * @param input - The request envelope describing the API target, access token, model + key, and optional fetch override.
+ * @returns The parsed `{ key, data }` envelope.
+ */
+export declare function getModelOverHttp<T = unknown>(input: GetModelOverHttpInput): Promise<GetModelOverHttpResult<T>>;
+export interface GetMultipleModelsOverHttpInput {
+    /**
+     * The API base URL — typically `<host>/<project>/us-central1/api` or `https://<domain>/api`.
+     *
+     * The `/model/<modelType>/get` path is appended automatically.
+     */
+    readonly apiBaseUrl: string;
+    readonly accessToken: string;
+    readonly modelType: string;
+    readonly keys: ReadonlyArray<string>;
+    /**
+     * Custom fetch implementation for tests.
+     */
+    readonly fetcher?: typeof fetch;
+}
+export interface GetMultipleModelsOverHttpResultEntry<T = unknown> {
+    readonly key: string;
+    readonly data: T;
+}
+export interface GetMultipleModelsOverHttpErrorEntry {
+    readonly key: string;
+    readonly error: string;
+    readonly code?: string;
+}
+export interface GetMultipleModelsOverHttpResult<T = unknown> {
+    readonly results: ReadonlyArray<GetMultipleModelsOverHttpResultEntry<T>>;
+    readonly errors: ReadonlyArray<GetMultipleModelsOverHttpErrorEntry>;
+}
+/**
+ * Batch-reads up to {@link MAX_MODEL_ACCESS_MULTI_READ_KEYS} Firestore documents in a single request.
+ *
+ * Calls `POST <apiBaseUrl>/model/<modelType>/get` with body `{ keys }` and returns the
+ * `{ results, errors }` envelope. The 50-key cap is enforced client-side so the error surfaces
+ * with a clear `INVALID_ARGUMENT` code before the request is made.
+ *
+ * Backend route: `ModelApiController.getMany` (packages/firebase-server). Same `'read'` role enforcement.
+ *
+ * @param input - The request envelope describing the API target, access token, model, keys, and optional fetch override.
+ * @returns The parsed `{ results, errors }` envelope.
+ */
+export declare function getMultipleModelsOverHttp<T = unknown>(input: GetMultipleModelsOverHttpInput): Promise<GetMultipleModelsOverHttpResult<T>>;
 export { CALL_MODEL_APP_FUNCTION_KEY } from '@dereekb/firebase';

package/src/lib/api/get-args.helper.d.ts

@@ -0,0 +1,61 @@
+import { type CliModelManifest } from '../manifest/types';
+/**
+ * Parsed `get` command arguments — the resolved `modelType` + the original key string.
+ */
+export interface ParsedGetArgs {
+    readonly modelType: string;
+    readonly key: string;
+}
+/**
+ * Parsed `get-many` command arguments — the resolved `modelType` + the list of keys.
+ */
+export interface ParsedGetManyArgs {
+    readonly modelType: string;
+    readonly keys: ReadonlyArray<string>;
+}
+/**
+ * Parses the positionals for the top-level `get <modelOrKey> [key]` command into a
+ * `{ modelType, key }` pair, using the supplied {@link CliModelManifest} to resolve
+ * collection-name prefixes when the explicit-model form is not used.
+ *
+ * Rules:
+ * 1. Two positionals (`modelOrKey` + `key`) — `modelOrKey` is treated as the explicit
+ *    `modelType` and `key` is passed through verbatim. No manifest lookup performed.
+ * 2. One positional (`modelOrKey` only) — treated as a full Firestore key (`prefix/id`).
+ *    {@link decodeFirestoreModelKey} resolves the prefix against the manifest. Throws
+ *    {@link CliError} if the manifest is missing, the prefix is unresolved, or the leaf
+ *    has no `modelType`.
+ *
+ * @param input.modelOrKey - The first positional from yargs.
+ * @param input.key - The optional second positional from yargs.
+ * @param input.manifest - The generated model manifest (for prefix lookup).
+ * @returns The parsed `{ modelType, key }` pair.
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function parseGetArgs(input: {
+    readonly modelOrKey: string | undefined;
+    readonly key: string | undefined;
+    readonly manifest?: CliModelManifest;
+}): ParsedGetArgs;
+/**
+ * Parses the positionals for the top-level `get-many <firstArg> [rest..]` command.
+ *
+ * Rules:
+ * 1. If `firstArg` contains `/` it is treated as a key — all positionals (`firstArg` + `rest`)
+ *    are decoded via {@link decodeFirestoreModelKey}. All keys must resolve to the same
+ *    `modelType` or a {@link CliError} is thrown (the backend route is single-modelType per call).
+ * 2. Otherwise `firstArg` is treated as the explicit `modelType` and `rest` are the keys.
+ *
+ * Always rejects empty key lists and lists exceeding 50 keys.
+ *
+ * @param input.firstArg - The first positional from yargs.
+ * @param input.rest - The remaining positionals from yargs.
+ * @param input.manifest - The generated model manifest (used only in the inferred-key branch).
+ * @returns The parsed `{ modelType, keys }` pair.
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function parseGetManyArgs(input: {
+    readonly firstArg: string | undefined;
+    readonly rest: ReadonlyArray<string>;
+    readonly manifest?: CliModelManifest;
+}): ParsedGetManyArgs;

package/src/lib/api/get-many.command.d.ts

@@ -0,0 +1,11 @@
+import type { CommandModule } from 'yargs';
+/**
+ * Top-level `get-many <firstArg> [rest..]` command.
+ *
+ * Batch-reads up to 50 Firestore documents in a single request. The first positional can either
+ * be an explicit modelType (followed by ≥1 keys) or a full key (followed by additional keys whose
+ * prefixes must resolve to the same modelType).
+ *
+ * Backend: `POST <apiBaseUrl>/model/<modelType>/get` with body `{ keys }` (ModelApiController.getMany).
+ */
+export declare const getManyCommand: CommandModule;

package/src/lib/api/get.command.d.ts

@@ -0,0 +1,12 @@
+import type { CommandModule } from 'yargs';
+/**
+ * Top-level `get <modelOrKey> [key]` command.
+ *
+ * Reads a single Firestore document via the typed model-access endpoint. The `model` arg is optional:
+ * when only one positional is supplied, the CLI resolves the modelType from the key's leading
+ * collection-name prefix via {@link decodeFirestoreModelKey}. The two-positional form passes the
+ * explicit `modelType` straight through.
+ *
+ * Backend: `GET <apiBaseUrl>/model/<modelType>/get?key=<key>` (ModelApiController.getOne).
+ */
+export declare const getCommand: CommandModule;

package/src/lib/api/index.d.ts

@@ -2,3 +2,6 @@ export * from './call-model.client';
 export * from './call-model.command.factory';
 export * from './call.passthrough.command';
 export * from './expand-keys';
+export * from './get-args.helper';
+export * from './get.command';
+export * from './get-many.command';

package/src/lib/auth/oidc.client.d.ts

@@ -37,7 +37,8 @@ export interface DiscoverOidcMetadataInput {
     readonly fallbackBaseUrl?: string;
 }
 /**
- * Fetches the OIDC discovery document for the given issuer, trying these candidates in order:
+ * Builds the ordered list of `.well-known/openid-configuration` URLs the CLI probes when
+ * discovering OIDC metadata.
  *
  *   1. `<issuer>/.well-known/openid-configuration` (OpenID Connect Discovery 1.0).
  *   2. `<issuer-origin>/.well-known/openid-configuration` (host-rooted; matches projects that
@@ -45,6 +46,19 @@ export interface DiscoverOidcMetadataInput {
  *      sub-path — e.g. demo's `OidcWellKnownController`).
  *   3. `<fallbackBaseUrl>/.well-known/openid-configuration` when supplied and not already covered.
  *
+ * Exported so diagnostic surfaces (e.g. `doctor`) can show the exact URLs the discovery step
+ * tried — without re-implementing the candidate ordering.
+ *
+ * @param input - The discovery request.
+ * @param input.issuer - The OIDC issuer URL whose `.well-known/openid-configuration` is fetched first.
+ * @param input.fallbackBaseUrl - Optional sibling base URL appended after the issuer-prefixed and origin-rooted candidates.
+ * @returns The candidate URL list in probe order, de-duplicated.
+ */
+export declare function buildOidcDiscoveryCandidates(input: DiscoverOidcMetadataInput): string[];
+/**
+ * Fetches the OIDC discovery document for the given issuer, trying the candidates returned by
+ * {@link buildOidcDiscoveryCandidates} in order.
+ *
  * @param input - The discovery request.
  * @param input.issuer - The OIDC issuer URL whose `.well-known/openid-configuration` is fetched first.
  * @param input.fallbackBaseUrl - Optional sibling base URL tried after the issuer-prefixed and origin-rooted candidates.

package/src/lib/auth/oidc.flow.d.ts

@@ -2,19 +2,30 @@ import { type Maybe } from '@dereekb/util';
 export interface BuildAuthorizationUrlInput {
     readonly authorizationEndpoint: string;
     /**
-     * Optional API base URL. When set and `appClientUrl` is not provided, the CLI sends the user
-     * to `<apiBaseUrl>/oidc/login/client?<params>` instead of the raw authorization endpoint. The
-     * API redirects to the configured app login URL with the OAuth query string preserved, so the
-     * CLI does not need to know the client origin directly.
+     * Optional OIDC issuer URL (e.g. `https://api.example.com/oidc`). Used as a fallback rebase
+     * origin when `appClientUrl` is not provided — the origin of `oidcIssuer` is applied to the
+     * discovered `authorizationEndpoint`. In typical OIDC deployments the issuer and authorization
+     * endpoint share an origin, so this fallback is a no-op rebase that ends up at the discovered
+     * `/oidc/auth` URL. Use `appClientUrl` to send the user to a different origin (e.g. a frontend
+     * dev server that proxies `/oidc/**` back to the API).
+     */
+    readonly oidcIssuer?: Maybe<string>;
+    /**
+     * Optional API base URL. Used as a fallback rebase origin when neither `appClientUrl` nor
+     * `oidcIssuer` is provided — only the origin is read, so prefix paths like `/api` are ignored.
+     * Prefer `oidcIssuer` for new deployments; `apiBaseUrl` is kept for backwards compatibility
+     * with envs that only declare an API base URL.
      */
     readonly apiBaseUrl?: Maybe<string>;
     /**
-     * Optional client (frontend) origin to rebase the authorization endpoint onto.
+     * Optional client origin to rebase the authorization endpoint onto.
      *
      * When set, the path + search of `authorizationEndpoint` are kept and the origin is replaced
-     * with this URL. Useful when the frontend dev server proxies `/oidc/**` to the API and the
-     * user-facing URL should target the app, not the API directly. Takes precedence over
-     * `apiBaseUrl` when both are provided.
+     * with this URL. Takes precedence over both `oidcIssuer` and `apiBaseUrl`. Recommended for any
+     * env where the user-facing URL should differ from the discovered authorization endpoint —
+     * e.g. a frontend dev server that proxies `/oidc/**` to the API on another port. When omitted,
+     * the URL is derived from `oidcIssuer`/`apiBaseUrl` origin (or used verbatim if neither is set),
+     * so the CLI always opens the actual authorization endpoint (typically `/oidc/auth`).
      */
     readonly appClientUrl?: Maybe<string>;
     readonly clientId: string;
@@ -33,14 +44,24 @@ export interface BuildAuthorizationUrlInput {
 /**
  * Builds the authorization URL the user opens in a browser to start the PKCE flow.
  *
- * Resolves the user-facing endpoint by preferring `appClientUrl` (rebases the discovered
- * authorization endpoint onto that origin) over `apiBaseUrl` (`/oidc/login/client` shortcut),
- * and finally falls back to the discovered `authorizationEndpoint` itself.
+ * The user-facing endpoint is the discovered `authorizationEndpoint` (typically `/oidc/auth`)
+ * with its origin optionally rebased. The rebase origin is the first non-empty value among
+ * `appClientUrl` → `oidcIssuer` origin → `apiBaseUrl` origin. In a typical single-host
+ * deployment all three resolve to the same origin and the rebase is a no-op; in a split-host
+ * setup (frontend dev server proxying `/oidc/**` to the API) `appClientUrl` redirects the user
+ * through the frontend. When none of the three is provided, the discovered endpoint is used
+ * unchanged.
+ *
+ * Always lands at the actual authorization endpoint so oidc-provider can create an interaction
+ * and redirect to the app login page with a `uid`. (Earlier versions targeted a convenience
+ * `/oidc/login/client` redirect that forwarded query params to the app without creating an
+ * interaction — that branch is gone.)
  *
  * @param input - The authorization URL inputs.
  * @param input.authorizationEndpoint - The authorization endpoint discovered from OIDC metadata.
- * @param input.apiBaseUrl - Optional API base URL; when set without `appClientUrl`, the URL is built against `<apiBaseUrl>/oidc/login/client`.
- * @param input.appClientUrl - Optional frontend origin to rebase the authorization endpoint onto. Takes precedence over `apiBaseUrl`.
+ * @param input.appClientUrl - Optional client origin to rebase the authorization endpoint onto. Takes precedence over `oidcIssuer` and `apiBaseUrl`.
+ * @param input.oidcIssuer - Optional OIDC issuer URL; falls back to its origin as the rebase target when `appClientUrl` is missing.
+ * @param input.apiBaseUrl - Optional API base URL; falls back to its origin as the rebase target when neither `appClientUrl` nor `oidcIssuer` is set.
  * @param input.clientId - The OAuth client ID.
  * @param input.redirectUri - The redirect URI registered with the OAuth client.
  * @param input.scopes - Space-separated scope list. Defaults to {@link DEFAULT_CLI_OIDC_SCOPES}.

package/src/lib/config/env.d.ts

@@ -11,6 +11,12 @@ export declare const DEFAULT_CLI_OIDC_SCOPES = "openid profile email";
  * CLI doesn't take a server-side dependency just to know the names.
  */
 export declare const MODEL_WRITE_OIDC_SCOPES: readonly ["model.create", "model.update", "model.delete"];
+/**
+ * The default redirect URI used by the CLI.
+ *
+ * Opens up to nothing in the browser so the user can copy/paste the resulting token url back into the CLI.
+ */
+export declare const DEFAULT_CLI_REDIRECT_URI = "http://127.0.0.1:0/callback";
 /**
  * Returns the input scope string with the `model.create`, `model.update`, and `model.delete`
  * scopes removed, preserving every other scope (including `model.read` and `model.query`).
@@ -119,6 +125,8 @@ export interface CliEnvConfig {
      * The redirect URI registered with the OAuth client. The CLI does not bind a server — it parses
      * the URL the user pastes back, so this can be any value the OIDC provider accepts as a
      * registered redirect URI (e.g. `http://127.0.0.1:0/callback` or another loopback/placeholder URL).
+     *
+     * Defaults to {@link DEFAULT_CLI_REDIRECT_URI}.
      */
     readonly redirectUri?: string;
     /**

package/src/lib/context/cli.context.d.ts

@@ -1,10 +1,18 @@
 import type { OnCallTypedModelParams } from '@dereekb/firebase';
 import { type CliEnvConfig } from '../config/env';
+import { type GetModelOverHttpResult, type GetMultipleModelsOverHttpResult } from '../api/call-model.client';
+import { type CliModelManifest } from '../manifest/types';
 /**
  * The CLI context attached to argv by the auth middleware.
  *
- * Holds the active env, the current access token, and a `callModel` helper that performs
- * the HTTP call against `<env.apiBaseUrl>/model/call`.
+ * Holds the active env, the current access token, and helpers that perform HTTP calls against
+ * `<env.apiBaseUrl>/model/*`:
+ *  - {@link CliContext.callModel} → `POST /model/call` (typed model dispatch)
+ *  - {@link CliContext.getModel} → `GET /model/<modelType>/get?key=<key>`
+ *  - {@link CliContext.getMultipleModels} → `POST /model/<modelType>/get` with `{ keys }`
+ *
+ * When provided by the runner, {@link CliContext.modelManifest} carries the generated
+ * `CliModelManifest` so commands can resolve `prefix/id` keys to a `modelType`.
  */
 export interface CliContext {
     readonly cliName: string;
@@ -12,6 +20,9 @@ export interface CliContext {
     readonly env: CliEnvConfig;
     readonly accessToken: string;
     readonly callModel: <TParams = unknown, TResult = unknown>(params: OnCallTypedModelParams<TParams>) => Promise<TResult>;
+    readonly getModel: <TResult = unknown>(modelType: string, key: string) => Promise<GetModelOverHttpResult<TResult>>;
+    readonly getMultipleModels: <TResult = unknown>(modelType: string, keys: ReadonlyArray<string>) => Promise<GetMultipleModelsOverHttpResult<TResult>>;
+    readonly modelManifest?: CliModelManifest;
 }
 export declare const setCliContext: (value: import("@dereekb/util").Maybe<CliContext>) => void;
 export declare const getCliContext: () => import("@dereekb/util").Maybe<CliContext>;
@@ -24,18 +35,24 @@ export interface CreateCliContextInput {
     readonly envName: string;
     readonly env: CliEnvConfig;
     readonly accessToken: string;
+    /**
+     * Optional generated model manifest. When supplied, surfaced on the context so commands
+     * (e.g. `get <key>`) can resolve `prefix/id` keys to a `modelType` via `decodeFirestoreModelKey`.
+     */
+    readonly modelManifest?: CliModelManifest;
 }
 /**
  * Builds a {@link CliContext} for the current invocation.
  *
- * Bundles the env config and access token alongside a `callModel` helper that POSTs to
- * `<env.apiBaseUrl>/model/call` with the cached Bearer token.
+ * Bundles the env config and access token alongside helpers that POST/GET against
+ * `<env.apiBaseUrl>/model/*` with the cached Bearer token.
  *
  * @param input - The context inputs.
  * @param input.cliName - The CLI's binary name.
  * @param input.envName - The active env name.
  * @param input.env - The resolved {@link CliEnvConfig} for the active env.
  * @param input.accessToken - The Bearer access token to include on outgoing API calls.
+ * @param input.modelManifest - Optional generated {@link CliModelManifest} for key→modelType resolution.
  * @returns The constructed {@link CliContext}.
  * @__NO_SIDE_EFFECTS__
  */

package/src/lib/manifest/build-model-decode-command.d.ts

@@ -0,0 +1,79 @@
+import type { CommandModule } from 'yargs';
+import type { CliModelManifest } from './types';
+/**
+ * Default command name for the model-decode command. Top-level so it stays
+ * out of the API-call namespace owned by `model <model> <action>`.
+ */
+export declare const DEFAULT_MODEL_DECODE_COMMAND_NAME = "model-decode";
+/**
+ * Options accepted by {@link buildModelDecodeCommand}.
+ */
+export interface BuildModelDecodeCommandOptions {
+    /**
+     * Override the parent command name. Defaults to
+     * {@link DEFAULT_MODEL_DECODE_COMMAND_NAME}.
+     */
+    readonly commandName?: string;
+}
+/**
+ * One segment of a decoded Firestore key. `model*` fields are absent when the
+ * segment's `prefix` isn't in the manifest.
+ */
+export interface DecodedKeySegment {
+    readonly prefix: string;
+    readonly id: string;
+    readonly modelName?: string;
+    readonly modelType?: string;
+    readonly modelGroup?: string;
+    readonly identityConst?: string;
+    readonly parentIdentityConst?: string;
+    readonly sourcePackage?: string;
+    readonly sourceFile?: string;
+}
+/**
+ * Result of decoding a Firestore model key into its model + id components.
+ */
+export interface DecodedKey {
+    readonly key: string;
+    readonly leaf: DecodedKeySegment;
+    readonly ancestors: readonly DecodedKeySegment[];
+    readonly unresolvedPrefixes: readonly string[];
+}
+/**
+ * Builds the top-level `model-decode <key>` command.
+ *
+ * Splits the supplied Firestore key on `/`, walks `[prefix, id]` pairs, and
+ * resolves each prefix against the manifest. Supports subcollection paths
+ * (`nb/abc/nbn/def` → leaf `Notification` + parent `NotificationBox`).
+ *
+ * Flags:
+ *   - `--json` emits a structured `{ ok, data }` envelope instead of the
+ *     human-readable block (useful for scripting or LLM agents).
+ *
+ * @param manifest - The generated model manifest (e.g. `DEMO_CLI_MODEL_MANIFEST`).
+ * @param options - Optional overrides; see {@link BuildModelDecodeCommandOptions}.
+ * @returns A yargs `CommandModule` ready to be passed to `runCli({ configCommands })`.
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function buildModelDecodeCommand(manifest: CliModelManifest, options?: BuildModelDecodeCommandOptions): CommandModule;
+/**
+ * Splits `rawKey` on `/`, resolves each `[prefix, id]` pair against the
+ * manifest, and returns the leaf segment + ancestor chain. Throws
+ * {@link CliError} for malformed inputs.
+ *
+ * @param rawKey - The Firestore key string.
+ * @param manifest - The generated model manifest.
+ * @returns The decoded key with leaf, ancestors, and any unresolved prefixes.
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function decodeFirestoreModelKey(rawKey: string, manifest: CliModelManifest): DecodedKey;
+/**
+ * Renders a {@link DecodedKey} as a human-readable text block. Mirrors the
+ * MCP `dbx_model_decode` key-mode output for consistency between agent and
+ * shell consumers.
+ *
+ * @param decoded - the decoded key returned by {@link decodeFirestoreModelKey}.
+ * @returns the formatted block with a trailing newline.
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function renderDecodedKey(decoded: DecodedKey): string;

package/src/lib/manifest/index.d.ts

@@ -1,4 +1,5 @@
 export * from './build-manifest-commands';
+export * from './build-model-decode-command';
 export * from './build-model-info-command';
 export * from './model-info-utils';
 export * from './types';

package/src/lib/middleware/auth.middleware.d.ts

@@ -1,5 +1,6 @@
 import type { MiddlewareFunction } from 'yargs';
 import { type CliEnvDefault } from '../config/env';
+import { type CliModelManifest } from '../manifest/types';
 export interface CreateAuthMiddlewareInput {
     readonly cliName: string;
     /**
@@ -12,6 +13,11 @@ export interface CreateAuthMiddlewareInput {
      * Built-in env presets. Merged underneath the user's stored env when the env name matches.
      */
     readonly defaultEnvs?: readonly CliEnvDefault[];
+    /**
+     * Optional generated model manifest. When supplied, attached to the `CliContext` so commands
+     * can resolve `prefix/id` keys to a `modelType` via `decodeFirestoreModelKey`.
+     */
+    readonly modelManifest?: CliModelManifest;
 }
 /**
  * Yargs middleware that resolves the active env, loads/refreshes its access token, and attaches

package/src/lib/runner/run.d.ts

@@ -45,18 +45,30 @@ export interface CreateCliInput {
      */
     readonly disableCallPassthrough?: boolean;
     /**
-     * Generated Firestore model manifest used to drive the built-in `model-info` command.
+     * Disable the built-in `get <key>` / `get-many <key...>` commands.
      *
-     * Opt-in: when provided, a top-level `model-info [model]` command is auto-wired into the built-in
-     * config commands so users can browse the model catalog and per-model field documentation. When
-     * omitted, no `model-info` command is registered. Apps that pass the manifest but want to suppress
-     * the command can additionally set {@link disableModelInfo} to `true`.
+     * These hit the generic model-access endpoints (`GET /model/<modelType>/get` and
+     * `POST /model/<modelType>/get`) which already exist on every {@link ModelApiController}.
+     * Inferred-model resolution (`get jws/abc` → `modelType: jobWorkerSchedule`) requires the
+     * generated {@link CreateCliInput.modelManifest} to be supplied; the explicit-model form
+     * (`get <model> <key>`) works without it.
+     */
+    readonly disableModelGet?: boolean;
+    /**
+     * Generated Firestore model manifest used to drive the built-in `model-info` and `model-decode`
+     * commands.
+     *
+     * Opt-in: when provided, top-level `model-info [model]` and `model-decode <key>` commands are
+     * auto-wired into the built-in config commands so users can browse the model catalog and turn
+     * raw Firestore keys (`sf/abc123`, `nb/abc/nbn/def`) into model + id info. When omitted, neither
+     * command is registered. Apps that pass the manifest but want to suppress one or both commands
+     * can set {@link disableModelInfo} and/or {@link disableModelDecode} to `true`.
      *
      * The manifest itself is also opt-in at build time. The `dbx-cli-firebase-api-manifest` generator
      * only emits `<NAMESPACE>_MODEL_MANIFEST` when invoked with `--emit-models`, so apps that never
      * enable this option won't bundle model metadata into their final binary.
      *
-     * Note: this option only controls the `model-info` command. Manifest-driven typed model commands
+     * Note: this option only controls the inspection commands. Manifest-driven typed model commands
      * are still wired explicitly via {@link apiCommands} (see `buildManifestCommands`), and the
      * `--expand-keys` flag still requires passing the manifest to `buildManifestCommands`.
      */
@@ -68,6 +80,13 @@ export interface CreateCliInput {
      * but does not want to surface the `model-info` command itself.
      */
     readonly disableModelInfo?: boolean;
+    /**
+     * Disable the built-in `model-decode` command even when {@link modelManifest} is provided.
+     *
+     * Useful when an app wants the manifest available for `--expand-keys` or `model-info` but does
+     * not want to surface the key-decode command itself.
+     */
+    readonly disableModelDecode?: boolean;
 }
 /**
  * Top-level CLI builder.