@dereekb/dbx-cli 13.12.9 → 13.13.0

package/index.cjs.js

@@ -17,13 +17,13 @@ var tsMorph = require('ts-morph');
 var node_url = require('node:url');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
-function _array_like_to_array$11(arr, len) {
+function _array_like_to_array$12(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$Y(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$11(arr);
+function _array_without_holes$Z(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$12(arr);
 }
 function _assert_this_initialized(self) {
     if (self === void 0) {
@@ -86,7 +86,7 @@ function _construct(Parent, args, Class) {
     }
     return _construct.apply(null, arguments);
 }
-function _define_property$K(obj, key, value) {
+function _define_property$L(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -129,13 +129,13 @@ function _instanceof$o(left, right) {
 function _is_native_function(fn) {
     return Function.toString.call(fn).indexOf("[native code]") !== -1;
 }
-function _iterable_to_array$Y(iter) {
+function _iterable_to_array$Z(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$Y() {
+function _non_iterable_spread$Z() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$K(target) {
+function _object_spread$L(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -145,12 +145,12 @@ function _object_spread$K(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$K(target, key, source[key]);
+            _define_property$L(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$s(object, enumerableOnly) {
+function ownKeys$t(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -158,12 +158,12 @@ function ownKeys$s(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$s(target, source) {
+function _object_spread_props$t(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$s(Object(source)).forEach(function(key) {
+        ownKeys$t(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -182,20 +182,20 @@ function _set_prototype_of(o, p) {
     };
     return _set_prototype_of(o, p);
 }
-function _to_consumable_array$Y(arr) {
-    return _array_without_holes$Y(arr) || _iterable_to_array$Y(arr) || _unsupported_iterable_to_array$11(arr) || _non_iterable_spread$Y();
+function _to_consumable_array$Z(arr) {
+    return _array_without_holes$Z(arr) || _iterable_to_array$Z(arr) || _unsupported_iterable_to_array$12(arr) || _non_iterable_spread$Z();
 }
 function _type_of$2(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$11(o, minLen) {
+function _unsupported_iterable_to_array$12(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$11(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$12(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$11(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$12(o, minLen);
 }
 function _wrap_native_super(Class) {
     var _cache = typeof Map === "function" ? new Map() : undefined;
@@ -352,7 +352,7 @@ function _ts_generator$1f(thisArg, body) {
     /id_token[=:]\s*\S+/gi
 ];
 var _outputOptions = {};
-var _secretPatterns = _to_consumable_array$Y(DEFAULT_CLI_SECRET_PATTERNS);
+var _secretPatterns = _to_consumable_array$Z(DEFAULT_CLI_SECRET_PATTERNS);
 var _errorMapper;
 var _verbose = false;
 var _timeoutMs;
@@ -432,7 +432,7 @@ var _timeoutMs;
                         timeoutHandle = setTimeout(function() {
                             return localController.abort();
                         }, timeoutMs);
-                        finalInit = _object_spread_props$s(_object_spread$K({}, init), {
+                        finalInit = _object_spread_props$t(_object_spread$L({}, init), {
                             signal: localController.signal
                         });
                     }
@@ -580,7 +580,7 @@ function dumpResponse(data, meta) {
     if (!filePath) {
         return;
     }
-    var content = _object_spread$K({
+    var content = _object_spread$L({
         ok: true,
         data: data
     }, meta ? {
@@ -657,7 +657,7 @@ function stringifyEnvelope(value) {
  */ function outputResult(data, meta) {
     dumpResponse(data, meta);
     var outputData = _outputOptions.pick ? pickFields(data, _outputOptions.pick) : data;
-    var output = _object_spread$K({
+    var output = _object_spread$L({
         ok: true,
         data: outputData
     }, meta ? {
@@ -686,7 +686,7 @@ function stringifyEnvelope(value) {
         var _this;
         _this = _call_super(this, CliError, [
             input.message
-        ]), _define_property$K(_this, "code", void 0), _define_property$K(_this, "suggestion", void 0);
+        ]), _define_property$L(_this, "code", void 0), _define_property$L(_this, "suggestion", void 0);
         _this.name = 'CliError';
         _this.code = input.code;
         _this.suggestion = input.suggestion;
@@ -714,7 +714,7 @@ function stringifyEnvelope(value) {
     if (mapped) {
         result = mapped;
     } else if (_instanceof$o(error, CliError)) {
-        result = _object_spread$K({
+        result = _object_spread$L({
             ok: false,
             error: sanitizeString(error.message),
             code: error.code
@@ -737,13 +737,13 @@ function stringifyEnvelope(value) {
     return result;
 }
 
-function _array_like_to_array$10(arr, len) {
+function _array_like_to_array$11(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$X(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$10(arr);
+function _array_without_holes$Y(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$11(arr);
 }
 function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -774,7 +774,7 @@ function _async_to_generator$1e(fn) {
         });
     };
 }
-function _define_property$J(obj, key, value) {
+function _define_property$K(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -787,13 +787,13 @@ function _define_property$J(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$X(iter) {
+function _iterable_to_array$Y(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$X() {
+function _non_iterable_spread$Y() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$J(target) {
+function _object_spread$K(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -803,12 +803,12 @@ function _object_spread$J(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$J(target, key, source[key]);
+            _define_property$K(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$r(object, enumerableOnly) {
+function ownKeys$s(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -816,31 +816,31 @@ function ownKeys$r(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$r(target, source) {
+function _object_spread_props$s(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$r(Object(source)).forEach(function(key) {
+        ownKeys$s(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _to_consumable_array$X(arr) {
-    return _array_without_holes$X(arr) || _iterable_to_array$X(arr) || _unsupported_iterable_to_array$10(arr) || _non_iterable_spread$X();
+function _to_consumable_array$Y(arr) {
+    return _array_without_holes$Y(arr) || _iterable_to_array$Y(arr) || _unsupported_iterable_to_array$11(arr) || _non_iterable_spread$Y();
 }
 function _type_of$1(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$10(o, minLen) {
+function _unsupported_iterable_to_array$11(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$10(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$11(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$10(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$11(o, minLen);
 }
 function _ts_generator$1e(thisArg, body) {
     var f, y, t, _ = {
@@ -1088,14 +1088,14 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                     chunk = _step.value;
                     return [
                         4,
-                        getMultipleModelsOverHttp(_object_spread_props$r(_object_spread$J({}, input), {
+                        getMultipleModelsOverHttp(_object_spread_props$s(_object_spread$K({}, input), {
                             keys: chunk
                         }))
                     ];
                 case 3:
                     batch = _state.sent();
-                    (_mergedResults = mergedResults).push.apply(_mergedResults, _to_consumable_array$X(batch.results));
-                    (_mergedErrors = mergedErrors).push.apply(_mergedErrors, _to_consumable_array$X(batch.errors));
+                    (_mergedResults = mergedResults).push.apply(_mergedResults, _to_consumable_array$Y(batch.results));
+                    (_mergedErrors = mergedErrors).push.apply(_mergedErrors, _to_consumable_array$Y(batch.errors));
                     _state.label = 4;
                 case 4:
                     _iteratorNormalCompletion = true;
@@ -1148,9 +1148,9 @@ function requestJson(input) {
             switch(_state.label){
                 case 0:
                     hasJsonBody = input.jsonBody !== undefined;
-                    init = _object_spread$J({
+                    init = _object_spread$K({
                         method: input.method,
-                        headers: _object_spread$J({
+                        headers: _object_spread$K({
                             Accept: 'application/json',
                             Authorization: "Bearer ".concat(input.accessToken)
                         }, hasJsonBody ? {
@@ -1725,7 +1725,7 @@ function _ts_generator$1c(thisArg, body) {
     };
 }
 
-function _array_like_to_array$$(arr, len) {
+function _array_like_to_array$10(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
@@ -1733,10 +1733,10 @@ function _array_like_to_array$$(arr, len) {
 function _array_with_holes$g(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$W(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$$(arr);
+function _array_without_holes$X(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$10(arr);
 }
-function _iterable_to_array$W(iter) {
+function _iterable_to_array$X(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
 function _iterable_to_array_limit$g(arr, i) {
@@ -1766,22 +1766,22 @@ function _iterable_to_array_limit$g(arr, i) {
 function _non_iterable_rest$g() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$W() {
+function _non_iterable_spread$X() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _sliced_to_array$g(arr, i) {
-    return _array_with_holes$g(arr) || _iterable_to_array_limit$g(arr, i) || _unsupported_iterable_to_array$$(arr, i) || _non_iterable_rest$g();
+    return _array_with_holes$g(arr) || _iterable_to_array_limit$g(arr, i) || _unsupported_iterable_to_array$10(arr, i) || _non_iterable_rest$g();
 }
-function _to_consumable_array$W(arr) {
-    return _array_without_holes$W(arr) || _iterable_to_array$W(arr) || _unsupported_iterable_to_array$$(arr) || _non_iterable_spread$W();
+function _to_consumable_array$X(arr) {
+    return _array_without_holes$X(arr) || _iterable_to_array$X(arr) || _unsupported_iterable_to_array$10(arr) || _non_iterable_spread$X();
 }
-function _unsupported_iterable_to_array$$(o, minLen) {
+function _unsupported_iterable_to_array$10(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$$(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$10(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$$(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$10(o, minLen);
 }
 /**
  * Default name of the parent command that groups all registered action specs.
@@ -1836,7 +1836,7 @@ function _unsupported_iterable_to_array$$(o, minLen) {
                 }
             }
         }
-        var sortedModels = _to_consumable_array$W(byModel.entries()).sort(function(param, param1) {
+        var sortedModels = _to_consumable_array$X(byModel.entries()).sort(function(param, param1) {
             var _param = _sliced_to_array$g(param, 1), a = _param[0], _param1 = _sliced_to_array$g(param1, 1), b = _param1[0];
             return a.localeCompare(b);
         });
@@ -1926,7 +1926,7 @@ function _unsupported_iterable_to_array$$(o, minLen) {
     return result;
 }
 
-function _array_like_to_array$_(arr, len) {
+function _array_like_to_array$$(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
@@ -1934,8 +1934,8 @@ function _array_like_to_array$_(arr, len) {
 function _array_with_holes$f(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$V(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$_(arr);
+function _array_without_holes$W(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$$(arr);
 }
 function asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -1966,7 +1966,7 @@ function _async_to_generator$1b(fn) {
         });
     };
 }
-function _define_property$I(obj, key, value) {
+function _define_property$J(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -1979,7 +1979,7 @@ function _define_property$I(obj, key, value) {
     }
     return obj;
 }
-function _iterable_to_array$V(iter) {
+function _iterable_to_array$W(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
 function _iterable_to_array_limit$f(arr, i) {
@@ -2009,10 +2009,10 @@ function _iterable_to_array_limit$f(arr, i) {
 function _non_iterable_rest$f() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$V() {
+function _non_iterable_spread$W() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$I(target) {
+function _object_spread$J(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2022,12 +2022,12 @@ function _object_spread$I(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$I(target, key, source[key]);
+            _define_property$J(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$q(object, enumerableOnly) {
+function ownKeys$r(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -2035,30 +2035,30 @@ function ownKeys$q(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$q(target, source) {
+function _object_spread_props$r(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$q(Object(source)).forEach(function(key) {
+        ownKeys$r(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
 function _sliced_to_array$f(arr, i) {
-    return _array_with_holes$f(arr) || _iterable_to_array_limit$f(arr, i) || _unsupported_iterable_to_array$_(arr, i) || _non_iterable_rest$f();
+    return _array_with_holes$f(arr) || _iterable_to_array_limit$f(arr, i) || _unsupported_iterable_to_array$$(arr, i) || _non_iterable_rest$f();
 }
-function _to_consumable_array$V(arr) {
-    return _array_without_holes$V(arr) || _iterable_to_array$V(arr) || _unsupported_iterable_to_array$_(arr) || _non_iterable_spread$V();
+function _to_consumable_array$W(arr) {
+    return _array_without_holes$W(arr) || _iterable_to_array$W(arr) || _unsupported_iterable_to_array$$(arr) || _non_iterable_spread$W();
 }
-function _unsupported_iterable_to_array$_(o, minLen) {
+function _unsupported_iterable_to_array$$(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$_(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$$(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$_(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$$(o, minLen);
 }
 function _ts_generator$1b(thisArg, body) {
     var f, y, t, _ = {
@@ -2174,7 +2174,7 @@ var _defaultResponseAdapter = {
     }
 };
 function _defaultBuildRequestData(params, state, limit) {
-    var base = _object_spread$I({}, params);
+    var base = _object_spread$J({}, params);
     if (state.cursorDocumentKey != null) {
         base.cursorDocumentKey = state.cursorDocumentKey;
     }
@@ -2198,7 +2198,7 @@ function _runItemTasks(input) {
                             itemIndex: itemIndex
                         };
                     });
-                    taskConfig = _object_spread_props$q(_object_spread$I({
+                    taskConfig = _object_spread_props$r(_object_spread$J({
                         sequential: true,
                         throwError: true
                     }, itemPerformTasksConfig), {
@@ -2429,10 +2429,10 @@ function _evaluateLoopExit(input) {
                 case 3:
                     pageOutcome = _state.sent();
                     if (collectItemsForPage) {
-                        (_allItems = allItems).push.apply(_allItems, _to_consumable_array$V(pageOutcome.items));
+                        (_allItems = allItems).push.apply(_allItems, _to_consumable_array$W(pageOutcome.items));
                     }
                     if (collectItemResultsForPage && pageOutcome.itemResults) {
-                        (_allItemResults = allItemResults).push.apply(_allItemResults, _to_consumable_array$V(pageOutcome.itemResults));
+                        (_allItemResults = allItemResults).push.apply(_allItemResults, _to_consumable_array$W(pageOutcome.itemResults));
                     }
                     if (collectPageResultsForPage && pageOutcome.pageResult !== undefined) {
                         allPageResults.push(pageOutcome.pageResult);
@@ -2455,7 +2455,7 @@ function _evaluateLoopExit(input) {
                         1
                     ];
                 case 4:
-                    result = _object_spread$I({
+                    result = _object_spread$J({
                         totalPages: pageIndex,
                         totalItems: totalItems,
                         hitLimit: hitLimit,
@@ -2505,7 +2505,7 @@ function _async_to_generator$1a(fn) {
         });
     };
 }
-function _define_property$H(obj, key, value) {
+function _define_property$I(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2518,7 +2518,7 @@ function _define_property$H(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$H(target) {
+function _object_spread$I(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2528,12 +2528,12 @@ function _object_spread$H(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$H(target, key, source[key]);
+            _define_property$I(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$p(object, enumerableOnly) {
+function ownKeys$q(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -2541,12 +2541,12 @@ function ownKeys$p(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$p(target, source) {
+function _object_spread_props$q(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$p(Object(source)).forEach(function(key) {
+        ownKeys$q(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -2675,7 +2675,7 @@ function _ts_generator$1a(thisArg, body) {
                         case 0:
                             context = requireCliContext();
                             data = spec.buildParams(argv);
-                            params = _object_spread_props$p(_object_spread$H({
+                            params = _object_spread_props$q(_object_spread$I({
                                 modelType: spec.model,
                                 call: spec.verb
                             }, spec.specifier == null ? {} : {
@@ -3152,7 +3152,7 @@ function _async_to_generator$18(fn) {
         });
     };
 }
-function _define_property$G(obj, key, value) {
+function _define_property$H(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3173,7 +3173,7 @@ function _instanceof$n(left, right) {
         return left instanceof right;
     }
 }
-function _object_spread$G(target) {
+function _object_spread$H(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3183,12 +3183,12 @@ function _object_spread$G(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$G(target, key, source[key]);
+            _define_property$H(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$o(object, enumerableOnly) {
+function ownKeys$p(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -3196,12 +3196,12 @@ function ownKeys$o(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$o(target, source) {
+function _object_spread_props$p(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$o(Object(source)).forEach(function(key) {
+        ownKeys$p(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -3360,7 +3360,7 @@ function _ts_generator$18(thisArg, body) {
                                 });
                             }
                         }
-                        params = _object_spread_props$o(_object_spread$G({
+                        params = _object_spread_props$p(_object_spread$H({
                             modelType: argv.model,
                             call: argv.verb
                         }, argv.specifier == null ? {} : {
@@ -3384,7 +3384,7 @@ function _ts_generator$18(thisArg, body) {
     })
 };
 
-function _array_like_to_array$Z(arr, len) {
+function _array_like_to_array$_(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
@@ -3428,19 +3428,19 @@ function _non_iterable_rest$e() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _sliced_to_array$e(arr, i) {
-    return _array_with_holes$e(arr) || _iterable_to_array_limit$e(arr, i) || _unsupported_iterable_to_array$Z(arr, i) || _non_iterable_rest$e();
+    return _array_with_holes$e(arr) || _iterable_to_array_limit$e(arr, i) || _unsupported_iterable_to_array$_(arr, i) || _non_iterable_rest$e();
 }
 function _type_of(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$Z(o, minLen) {
+function _unsupported_iterable_to_array$_(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$Z(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$_(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$Z(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$_(o, minLen);
 }
 /**
  * Resolves the manifest entry for `modelType`. Lookup tries
@@ -3593,30 +3593,30 @@ function isPlainObject(value) {
     return result;
 }
 
-function _array_like_to_array$Y(arr, len) {
+function _array_like_to_array$Z(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$U(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$Y(arr);
+function _array_without_holes$V(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$Z(arr);
 }
-function _iterable_to_array$U(iter) {
+function _iterable_to_array$V(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$U() {
+function _non_iterable_spread$V() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$U(arr) {
-    return _array_without_holes$U(arr) || _iterable_to_array$U(arr) || _unsupported_iterable_to_array$Y(arr) || _non_iterable_spread$U();
+function _to_consumable_array$V(arr) {
+    return _array_without_holes$V(arr) || _iterable_to_array$V(arr) || _unsupported_iterable_to_array$Z(arr) || _non_iterable_spread$V();
 }
-function _unsupported_iterable_to_array$Y(o, minLen) {
+function _unsupported_iterable_to_array$Z(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$Y(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$Z(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$Y(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$Z(o, minLen);
 }
 /**
  * Default command name for the model-decode command. Top-level so it stays
@@ -3743,13 +3743,13 @@ function toSegment(prefix, id, entry) {
  *
  * @__NO_SIDE_EFFECTS__
  */ function renderDecodedKey(decoded) {
-    var lines = _to_consumable_array$U(renderLeafLines(decoded.leaf));
+    var lines = _to_consumable_array$V(renderLeafLines(decoded.leaf));
     if (decoded.ancestors.length > 0) {
         var _lines;
         (_lines = lines).push.apply(_lines, [
             '',
             'Parent chain:'
-        ].concat(_to_consumable_array$U(decoded.ancestors.map(renderAncestorLine))));
+        ].concat(_to_consumable_array$V(decoded.ancestors.map(renderAncestorLine))));
     }
     if (decoded.unresolvedPrefixes.length > 0) {
         var suffix = decoded.unresolvedPrefixes.length === 1 ? '' : 'es';
@@ -3785,7 +3785,7 @@ function renderAncestorLine(ancestor) {
     return ancestor.modelName ? "- ".concat(ancestor.modelName, " — prefix ").concat(ancestor.prefix, ", id ").concat(ancestor.id) : "- <unknown> — prefix ".concat(ancestor.prefix, ", id ").concat(ancestor.id);
 }
 
-function _array_like_to_array$X(arr, len) {
+function _array_like_to_array$Y(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
@@ -3793,10 +3793,10 @@ function _array_like_to_array$X(arr, len) {
 function _array_with_holes$d(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$T(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$X(arr);
+function _array_without_holes$U(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$Y(arr);
 }
-function _iterable_to_array$T(iter) {
+function _iterable_to_array$U(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
 function _iterable_to_array_limit$d(arr, i) {
@@ -3826,22 +3826,22 @@ function _iterable_to_array_limit$d(arr, i) {
 function _non_iterable_rest$d() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$T() {
+function _non_iterable_spread$U() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _sliced_to_array$d(arr, i) {
-    return _array_with_holes$d(arr) || _iterable_to_array_limit$d(arr, i) || _unsupported_iterable_to_array$X(arr, i) || _non_iterable_rest$d();
+    return _array_with_holes$d(arr) || _iterable_to_array_limit$d(arr, i) || _unsupported_iterable_to_array$Y(arr, i) || _non_iterable_rest$d();
 }
-function _to_consumable_array$T(arr) {
-    return _array_without_holes$T(arr) || _iterable_to_array$T(arr) || _unsupported_iterable_to_array$X(arr) || _non_iterable_spread$T();
+function _to_consumable_array$U(arr) {
+    return _array_without_holes$U(arr) || _iterable_to_array$U(arr) || _unsupported_iterable_to_array$Y(arr) || _non_iterable_spread$U();
 }
-function _unsupported_iterable_to_array$X(o, minLen) {
+function _unsupported_iterable_to_array$Y(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$X(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$Y(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$X(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$Y(o, minLen);
 }
 /**
  * Parses the positionals for the top-level `get <modelOrKey> [key]` command into a
@@ -3947,7 +3947,7 @@ function _unsupported_iterable_to_array$X(o, minLen) {
     if (firstArg.includes('/')) {
         var keys = [
             firstArg
-        ].concat(_to_consumable_array$T(rest));
+        ].concat(_to_consumable_array$U(rest));
         result = inferModelTypeFromKeys(keys, input.manifest);
     } else {
         if (rest.length === 0) {
@@ -4005,7 +4005,7 @@ function inferModelTypeFromKeys(keys, manifest) {
     }
     if (decodedTypes.size > 1) {
         throw new CliError({
-            message: "get-many: all keys must belong to the same modelType. Got: ".concat(_to_consumable_array$T(decodedTypes).join(', '), ". Split into separate calls."),
+            message: "get-many: all keys must belong to the same modelType. Got: ".concat(_to_consumable_array$U(decodedTypes).join(', '), ". Split into separate calls."),
             code: 'INVALID_ARGUMENT'
         });
     }
@@ -4428,7 +4428,7 @@ function _async_to_generator$15(fn) {
         });
     };
 }
-function _define_property$F(obj, key, value) {
+function _define_property$G(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4441,7 +4441,7 @@ function _define_property$F(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$F(target) {
+function _object_spread$G(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4451,7 +4451,7 @@ function _object_spread$F(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$F(target, key, source[key]);
+            _define_property$G(target, key, source[key]);
         });
     }
     return target;
@@ -4627,7 +4627,7 @@ function _ts_generator$15(thisArg, body) {
                     existing = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : {};
                     merged = {
                         activeEnv: (_input_updates_activeEnv = input.updates.activeEnv) !== null && _input_updates_activeEnv !== void 0 ? _input_updates_activeEnv : existing.activeEnv,
-                        envs: input.updates.envs ? _object_spread$F({}, existing.envs, input.updates.envs) : existing.envs,
+                        envs: input.updates.envs ? _object_spread$G({}, existing.envs, input.updates.envs) : existing.envs,
                         output: input.updates.output === undefined ? existing.output : mergeOutputConfig(existing.output, input.updates.output)
                     };
                     return [
@@ -4669,12 +4669,12 @@ function mergeOutputCommandsConfig(existing, updates) {
     var result;
     if ('commands' in updates) {
         if (updates.commands) {
-            var merged = _object_spread$F({}, existing);
+            var merged = _object_spread$G({}, existing);
             var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
             try {
                 for(var _iterator = Object.keys(updates.commands)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                     var key = _step.value;
-                    merged[key] = _object_spread$F({}, existing === null || existing === void 0 ? void 0 : existing[key], updates.commands[key]);
+                    merged[key] = _object_spread$G({}, existing === null || existing === void 0 ? void 0 : existing[key], updates.commands[key]);
                 }
             } catch (err) {
                 _didIteratorError = true;
@@ -4739,6 +4739,78 @@ function mergeOutputCommandsConfig(existing, updates) {
     return result;
 }
 
+function _array_like_to_array$X(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$T(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$X(arr);
+}
+function _define_property$F(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _iterable_to_array$T(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$T() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread$F(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$F(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$o(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$o(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$o(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _to_consumable_array$T(arr) {
+    return _array_without_holes$T(arr) || _iterable_to_array$T(arr) || _unsupported_iterable_to_array$X(arr) || _non_iterable_spread$T();
+}
+function _unsupported_iterable_to_array$X(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$X(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$X(o, minLen);
+}
 /**
  * The default OAuth/OIDC scopes requested by the CLI when none are configured.
  */ var DEFAULT_CLI_OIDC_SCOPES = 'openid profile email';
@@ -4758,6 +4830,17 @@ function mergeOutputCommandsConfig(existing, updates) {
  *
  * Opens up to nothing in the browser so the user can copy/paste the resulting token url back into the CLI.
  */ var DEFAULT_CLI_REDIRECT_URI = 'http://127.0.0.1:0/callback';
+/**
+ * The generic OIDC scopes a `--service-token` login adds to the requested set.
+ *
+ * `token.service` triggers the admin-only, long-lived, non-rotating behavior server-side;
+ * `offline_access` is required so a refresh token is issued (the durable credential the server env
+ * consumes). The app's own resource scope (e.g. `demo`) is intentionally NOT included here — it
+ * already lives in the configured `env.scopes`, keeping this generic CLI app-agnostic.
+ */ var SERVICE_TOKEN_REQUIRED_OIDC_SCOPES = [
+    'token.service',
+    'offline_access'
+];
 /**
  * Returns the input scope string with the `model.create`, `model.update`, and `model.delete`
  * scopes removed, preserving every other scope (including `model.read` and `model.query`).
@@ -4773,6 +4856,41 @@ function mergeOutputCommandsConfig(existing, updates) {
         return s.length > 0 && !writeScopes.has(s);
     }).join(' ');
 }
+/**
+ * Returns the input scope string with the {@link SERVICE_TOKEN_REQUIRED_OIDC_SCOPES} unioned in
+ * (de-duplicated), preserving every other already-requested scope.
+ *
+ * Drives the `auth login --service-token` flag. Combinable with `filterReadOnlyModelScopes` — apply
+ * the read-only filter first, then this, so a service token can still be read-only.
+ *
+ * @param scopes - Space-separated scope list, or `undefined` to augment the default scopes.
+ * @returns The augmented space-separated scope list.
+ */ function withServiceTokenScopes(scopes) {
+    var result = new Set((scopes !== null && scopes !== void 0 ? scopes : DEFAULT_CLI_OIDC_SCOPES).split(/\s+/).filter(function(s) {
+        return s.length > 0;
+    }));
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = SERVICE_TOKEN_REQUIRED_OIDC_SCOPES[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var scope = _step.value;
+            result.add(scope);
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return _to_consumable_array$T(result).join(' ');
+}
 /**
  * Returns the {@link CliEnvDefault} whose `names` includes the given env name, or `undefined`.
  *
@@ -4869,6 +4987,42 @@ function nonEmpty(value) {
  */ function isCliEnvConfigComplete(env) {
     return Boolean((env === null || env === void 0 ? void 0 : env.apiBaseUrl) && (env === null || env === void 0 ? void 0 : env.oidcIssuer) && (env === null || env === void 0 ? void 0 : env.clientId) && (env === null || env === void 0 ? void 0 : env.clientSecret) && (env === null || env === void 0 ? void 0 : env.redirectUri));
 }
+/**
+ * Reads an OAuth token entry from environment variables, for non-interactive server consumption.
+ *
+ * Reads `<PREFIX>_REFRESH_TOKEN` (required) plus the optional `<PREFIX>_ACCESS_TOKEN` and
+ * `<PREFIX>_TOKEN_SCOPE`, where `PREFIX = cliName.replaceAll('-', '_').toUpperCase()` (the existing
+ * env-var prefix convention). The intended credential is a long-lived, non-rotating service token
+ * (see `auth login --service-token`).
+ *
+ * Returns `undefined` when no refresh token is present. When only a refresh token is supplied, the
+ * returned entry has `accessToken: ''` and `expiresAt: 0` so the first use is forced to mint an
+ * access token via a refresh. The entry is flagged `fromEnv: true` so the middleware does not write
+ * it back to the on-disk cache.
+ *
+ * @param input - The lookup inputs.
+ * @param input.cliName - The CLI name used to derive the env-var prefix (e.g. `demo-cli` → `DEMO_CLI`).
+ * @returns The env-sourced {@link CliTokenEntry}, or `undefined` when no refresh token is set.
+ */ function readEnvTokenEntry(input) {
+    var prefix = input.cliName.replaceAll('-', '_').toUpperCase();
+    var refreshToken = nonEmpty(process.env["".concat(prefix, "_REFRESH_TOKEN")]);
+    var result;
+    if (refreshToken) {
+        var accessToken = nonEmpty(process.env["".concat(prefix, "_ACCESS_TOKEN")]);
+        var scope = nonEmpty(process.env["".concat(prefix, "_TOKEN_SCOPE")]);
+        result = _object_spread_props$o(_object_spread$F({
+            accessToken: accessToken !== null && accessToken !== void 0 ? accessToken : '',
+            refreshToken: refreshToken,
+            // No reliable expiry is supplied via env, so force a refresh on first use (expiresAt 0 = expired).
+            expiresAt: 0
+        }, scope ? {
+            scope: scope
+        } : {}), {
+            fromEnv: true
+        });
+    }
+    return result;
+}
 
 function asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -5640,6 +5794,52 @@ function _ts_generator$13(thisArg, body) {
         });
     })();
 }
+/**
+ * Fetches the dbx-components `GET /oidc/session` route and returns the parsed session lifetime metadata.
+ *
+ * Mirrors {@link fetchUserInfo}, but reads the access token's baked-in session-lifetime claims
+ * (`dbx_session_expires_at` / `dbx_rotation_disabled`) which userinfo does not echo.
+ *
+ * @param input - The session request.
+ * @param input.sessionEndpoint - The `GET /oidc/session` endpoint URL.
+ * @param input.accessToken - The Bearer access token sent in the `Authorization` header.
+ * @returns The parsed {@link OidcSessionInfo}. Throws a {@link CliError} (`SESSION_INFO_FAILED`) on a non-OK response.
+ */ function fetchSessionInfo(input) {
+    return _async_to_generator$13(function() {
+        var res;
+        return _ts_generator$13(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        tracedFetch(undefined, input.sessionEndpoint, {
+                            headers: {
+                                Authorization: "Bearer ".concat(input.accessToken),
+                                Accept: 'application/json'
+                            }
+                        })
+                    ];
+                case 1:
+                    res = _state.sent();
+                    if (!res.ok) {
+                        throw new CliError({
+                            message: "Session info request failed: ".concat(res.status, " ").concat(res.statusText),
+                            code: 'SESSION_INFO_FAILED'
+                        });
+                    }
+                    return [
+                        4,
+                        res.json()
+                    ];
+                case 2:
+                    return [
+                        2,
+                        _state.sent()
+                    ];
+            }
+        });
+    })();
+}
 function postTokenEndpoint(input) {
     return _async_to_generator$13(function() {
         var res, body, _ref, _body_error_description, message;
@@ -6445,6 +6645,83 @@ function resolveAuthSetupPrompt(input) {
         });
     })();
 }
+/**
+ * Builds the `GET /oidc/session` endpoint URL from the env's OIDC issuer (`<oidcIssuer>/session`).
+ *
+ * @param oidcIssuer - The env's OIDC issuer URL.
+ * @returns The session endpoint URL.
+ */ function buildSessionEndpoint(oidcIssuer) {
+    return "".concat(oidcIssuer.replace(/\/+$/, ''), "/session");
+}
+/**
+ * Best-effort fetch of the session lifetime metadata for an access token. Returns `undefined` when
+ * the route is unavailable or errors, so callers can treat the session info as supplemental.
+ *
+ * @param input - The lookup inputs.
+ * @param input.oidcIssuer - The env's OIDC issuer URL (used to derive the session endpoint).
+ * @param input.accessToken - The Bearer access token.
+ * @returns The {@link OidcSessionInfo}, or `undefined` on any failure.
+ */ function loadSessionInfoSafely(input) {
+    return _async_to_generator$11(function() {
+        var result;
+        return _ts_generator$11(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    _state.trys.push([
+                        0,
+                        2,
+                        ,
+                        3
+                    ]);
+                    return [
+                        4,
+                        fetchSessionInfo({
+                            sessionEndpoint: buildSessionEndpoint(input.oidcIssuer),
+                            accessToken: input.accessToken
+                        })
+                    ];
+                case 1:
+                    result = _state.sent();
+                    return [
+                        3,
+                        3
+                    ];
+                case 2:
+                    _state.sent();
+                    // Supplemental — older servers without the /oidc/session route, or transient errors, are non-fatal.
+                    result = undefined;
+                    return [
+                        3,
+                        3
+                    ];
+                case 3:
+                    return [
+                        2,
+                        result
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Renders a human-readable session-lifetime summary, e.g. `valid until 2027-06-01T00:00:00.000Z (~365 days), rotation: disabled`.
+ *
+ * @param input - The session lifetime fields.
+ * @param input.sessionExpiresAt - Grant expiry as unix epoch seconds.
+ * @param input.rotationDisabled - Whether refresh-token rotation is disabled.
+ * @param input.nowMs - Current time in unix epoch milliseconds. Defaults to `Date.now()`.
+ * @returns The summary line, or `undefined` when no `sessionExpiresAt` is available.
+ */ function describeSessionLifetime(input) {
+    var result;
+    if (input.sessionExpiresAt != null) {
+        var _input_nowMs;
+        var expiresMs = input.sessionExpiresAt * util.MS_IN_SECOND;
+        var days = Math.max(0, Math.round((expiresMs - ((_input_nowMs = input.nowMs) !== null && _input_nowMs !== void 0 ? _input_nowMs : Date.now())) / util.MS_IN_SECOND / 86400));
+        var rotation = input.rotationDisabled ? 'disabled' : 'enabled';
+        result = "valid until ".concat(new Date(expiresMs).toISOString(), " (~").concat(days, " days), rotation: ").concat(rotation);
+    }
+    return result;
+}
 /**
  * Factory for the built-in `auth` command tree.
  *
@@ -6644,6 +6921,11 @@ function resolveAuthSetupPrompt(input) {
                 type: 'boolean',
                 default: false,
                 describe: 'Drop model.create/model.update/model.delete from the requested scopes (keeps model.read and model.query)'
+            }).option('service-token', {
+                type: 'boolean',
+                default: false,
+                alias: 'long-lived',
+                describe: 'Request a long-lived, non-rotating admin service token (adds token.service + offline_access). Combine with --login-for.'
             }).option('login-for', {
                 type: 'string',
                 describe: 'Requested login duration with a unit (e.g. 30d, 12h, 3600s). Mixed units are allowed (e.g. "1h30m", "2d 12h"). Subject to server/client caps. Applied to Session, Grant, and RefreshToken.'
@@ -6651,7 +6933,7 @@ function resolveAuthSetupPrompt(input) {
         },
         handler: wrapCommandHandler(function(argv) {
             return _async_to_generator$11(function() {
-                var _argv_code, _tokenResponse_expires_in, _ref, envName, env, meta, _ref1, codeVerifier, codeChallenge, state, requestedScopes, requestedSessionTtlSeconds, ms, url, pasted, _tmp, code, tokenResponse, expiresAt, entry;
+                var _argv_code, _tokenResponse_expires_in, _ref, _ref1, envName, env, meta, _ref2, codeVerifier, codeChallenge, state, requestedScopes, requestedSessionTtlSeconds, ms, url, pasted, _tmp, code, tokenResponse, expiresAt, sessionInfo, sessionExpiresAt, rotationDisabled, entry, sessionSummary;
                 return _ts_generator$11(this, function(_state) {
                     switch(_state.label){
                         case 0:
@@ -6667,7 +6949,7 @@ function resolveAuthSetupPrompt(input) {
                                 })
                             ];
                         case 1:
-                            _ref = _state.sent(), envName = _ref.envName, env = _ref.env;
+                            _ref1 = _state.sent(), envName = _ref1.envName, env = _ref1.env;
                             return [
                                 4,
                                 discoverOidcMetadata({
@@ -6682,9 +6964,15 @@ function resolveAuthSetupPrompt(input) {
                                 generatePkceMaterial()
                             ];
                         case 3:
-                            _ref1 = _state.sent(), codeVerifier = _ref1.codeVerifier, codeChallenge = _ref1.codeChallenge;
+                            _ref2 = _state.sent(), codeVerifier = _ref2.codeVerifier, codeChallenge = _ref2.codeChallenge;
                             state = generateOAuthState();
                             requestedScopes = argv.readOnlyScopes ? filterReadOnlyModelScopes(env.scopes) : env.scopes;
+                            if (argv.serviceToken) {
+                                // Adds token.service + offline_access (de-duped); applied after the read-only filter so a
+                                // service token can still be read-only. The provider hard-rejects a non-admin and clamps
+                                // the duration to the service-token tier (up to 1 year).
+                                requestedScopes = withServiceTokenScopes(requestedScopes);
+                            }
                             if (argv.loginFor) {
                                 ms = date.durationDataToMilliseconds(date.parseDurationString(argv.loginFor));
                                 if (ms <= 0) {
@@ -6749,20 +7037,43 @@ function resolveAuthSetupPrompt(input) {
                         case 7:
                             tokenResponse = _state.sent();
                             expiresAt = Date.now() + ((_tokenResponse_expires_in = tokenResponse.expires_in) !== null && _tokenResponse_expires_in !== void 0 ? _tokenResponse_expires_in : 0) * 1000;
-                            entry = {
+                            return [
+                                4,
+                                loadSessionInfoSafely({
+                                    oidcIssuer: env.oidcIssuer,
+                                    accessToken: tokenResponse.access_token
+                                })
+                            ];
+                        case 8:
+                            sessionInfo = _state.sent();
+                            sessionExpiresAt = (_ref = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.expiresAt) !== null && _ref !== void 0 ? _ref : undefined;
+                            rotationDisabled = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.rotationDisabled;
+                            entry = _object_spread$D({
                                 accessToken: tokenResponse.access_token,
                                 refreshToken: tokenResponse.refresh_token,
                                 idToken: tokenResponse.id_token,
                                 tokenType: tokenResponse.token_type,
                                 scope: tokenResponse.scope,
                                 expiresAt: expiresAt
-                            };
+                            }, sessionExpiresAt != null ? {
+                                sessionExpiresAt: sessionExpiresAt
+                            } : {}, rotationDisabled != null ? {
+                                rotationDisabled: rotationDisabled
+                            } : {});
                             return [
                                 4,
                                 tokens.set(envName, entry)
                             ];
-                        case 8:
+                        case 9:
                             _state.sent();
+                            sessionSummary = describeSessionLifetime({
+                                sessionExpiresAt: sessionExpiresAt,
+                                rotationDisabled: rotationDisabled
+                            });
+                            if (sessionSummary) {
+                                // Emit through stderr so JSON stdout stays parseable.
+                                process.stderr.write("Session: ".concat(sessionSummary, "\n"));
+                            }
                             outputResult({
                                 loggedIn: true,
                                 env: envName,
@@ -6770,7 +7081,9 @@ function resolveAuthSetupPrompt(input) {
                                 refreshToken: entry.refreshToken ? maskSecret(entry.refreshToken) : undefined,
                                 tokenType: entry.tokenType,
                                 scope: entry.scope,
-                                expiresAt: expiresAt
+                                expiresAt: expiresAt,
+                                sessionExpiresAt: sessionExpiresAt,
+                                rotationDisabled: rotationDisabled
                             });
                             return [
                                 2
@@ -6892,7 +7205,7 @@ function resolveAuthSetupPrompt(input) {
         },
         handler: wrapCommandHandler(function(argv) {
             return _async_to_generator$11(function() {
-                var _ref, envName, env, entry, expired, meta, userinfoEndpoint, claims;
+                var _ref, envName, env, entry, _ref1, _ref2, expired, sessionInfo, sessionExpiresAt, rotationDisabled, session, meta, userinfoEndpoint, claims;
                 return _ts_generator$11(this, function(_state) {
                     switch(_state.label){
                         case 0:
@@ -6916,9 +7229,24 @@ function resolveAuthSetupPrompt(input) {
                             entry = _state.sent();
                             if (!entry) return [
                                 3,
-                                7
+                                8
                             ];
                             expired = isTokenExpired(entry);
+                            return [
+                                4,
+                                loadSessionInfoSafely({
+                                    oidcIssuer: env.oidcIssuer,
+                                    accessToken: entry.accessToken
+                                })
+                            ];
+                        case 3:
+                            sessionInfo = _state.sent();
+                            sessionExpiresAt = (_ref1 = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.expiresAt) !== null && _ref1 !== void 0 ? _ref1 : entry.sessionExpiresAt;
+                            rotationDisabled = (_ref2 = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.rotationDisabled) !== null && _ref2 !== void 0 ? _ref2 : entry.rotationDisabled;
+                            session = describeSessionLifetime({
+                                sessionExpiresAt: sessionExpiresAt !== null && sessionExpiresAt !== void 0 ? sessionExpiresAt : undefined,
+                                rotationDisabled: rotationDisabled
+                            });
                             return [
                                 4,
                                 discoverOidcMetadata({
@@ -6926,12 +7254,12 @@ function resolveAuthSetupPrompt(input) {
                                     fallbackBaseUrl: env.apiBaseUrl
                                 })
                             ];
-                        case 3:
+                        case 4:
                             meta = _state.sent();
                             userinfoEndpoint = meta.userinfo_endpoint;
                             if (!userinfoEndpoint) return [
                                 3,
-                                5
+                                6
                             ];
                             return [
                                 4,
@@ -6940,7 +7268,7 @@ function resolveAuthSetupPrompt(input) {
                                     accessToken: entry.accessToken
                                 })
                             ];
-                        case 4:
+                        case 5:
                             claims = _state.sent();
                             outputResult({
                                 env: envName,
@@ -6948,35 +7276,41 @@ function resolveAuthSetupPrompt(input) {
                                 expiresAt: entry.expiresAt,
                                 expired: expired,
                                 scope: entry.scope,
+                                sessionExpiresAt: sessionExpiresAt,
+                                rotationDisabled: rotationDisabled,
+                                session: session,
                                 sub: claims.sub,
                                 claims: claims
                             });
                             return [
                                 3,
-                                6
+                                7
                             ];
-                        case 5:
+                        case 6:
                             outputResult({
                                 env: envName,
                                 authenticated: !expired,
                                 expiresAt: entry.expiresAt,
                                 expired: expired,
-                                scope: entry.scope
+                                scope: entry.scope,
+                                sessionExpiresAt: sessionExpiresAt,
+                                rotationDisabled: rotationDisabled,
+                                session: session
                             });
-                            _state.label = 6;
-                        case 6:
+                            _state.label = 7;
+                        case 7:
                             return [
                                 3,
-                                8
+                                9
                             ];
-                        case 7:
+                        case 8:
                             outputResult({
                                 env: envName,
                                 authenticated: false,
                                 suggestion: "Run: ".concat(cliName, " auth login --env ").concat(envName)
                             });
-                            _state.label = 8;
-                        case 8:
+                            _state.label = 9;
+                        case 9:
                             return [
                                 2
                             ];
@@ -7025,7 +7359,13 @@ function resolveAuthSetupPrompt(input) {
                                     tokenType: entry.tokenType,
                                     scope: entry.scope,
                                     expiresAt: entry.expiresAt,
-                                    expired: isTokenExpired(entry)
+                                    expired: isTokenExpired(entry),
+                                    sessionExpiresAt: entry.sessionExpiresAt,
+                                    rotationDisabled: entry.rotationDisabled,
+                                    session: describeSessionLifetime({
+                                        sessionExpiresAt: entry.sessionExpiresAt,
+                                        rotationDisabled: entry.rotationDisabled
+                                    })
                                 } : null
                             });
                             return [
@@ -8939,7 +9279,7 @@ function _ts_generator$_(thisArg, body) {
     });
     return function(argv) {
         return _async_to_generator$_(function() {
-            var _argv__, command, _ref, _ref1, envName, env, entry, _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _refreshed_expires_in, meta, refreshed, e;
+            var _argv__, command, _ref, _ref1, envName, env, entry, _readEnvTokenEntry, _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _refreshed_expires_in, meta, suppliedRefreshToken, refreshed, e;
             return _ts_generator$_(this, function(_state) {
                 switch(_state.label){
                     case 0:
@@ -8957,9 +9297,9 @@ function _ts_generator$_(thisArg, body) {
                     case 1:
                         _state.trys.push([
                             1,
-                            8,
+                            9,
                             ,
-                            9
+                            10
                         ]);
                         return [
                             4,
@@ -8979,15 +9319,20 @@ function _ts_generator$_(thisArg, body) {
                         ];
                     case 3:
                         entry = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : undefined;
-                        if (!(entry === null || entry === void 0 ? void 0 : entry.accessToken)) {
+                        if (!entry) {
+                            entry = (_readEnvTokenEntry = readEnvTokenEntry({
+                                cliName: input.cliName
+                            })) !== null && _readEnvTokenEntry !== void 0 ? _readEnvTokenEntry : undefined;
+                        }
+                        if (!(entry === null || entry === void 0 ? void 0 : entry.accessToken) && !(entry === null || entry === void 0 ? void 0 : entry.refreshToken)) {
                             throw new CliError({
                                 message: 'No tokens for env "'.concat(envName, '". Run `').concat(input.cliName, " auth login --env ").concat(envName, "`."),
                                 code: 'NOT_LOGGED_IN'
                             });
                         }
-                        if (!isTokenExpired(entry)) return [
+                        if (!(!entry.accessToken || isTokenExpired(entry))) return [
                             3,
-                            7
+                            8
                         ];
                         if (!entry.refreshToken) {
                             throw new CliError({
@@ -9005,13 +9350,14 @@ function _ts_generator$_(thisArg, body) {
                         ];
                     case 4:
                         meta = _state.sent();
+                        suppliedRefreshToken = entry.refreshToken;
                         return [
                             4,
                             refreshAccessToken({
                                 tokenEndpoint: meta.token_endpoint,
                                 clientId: env.clientId,
                                 clientSecret: env.clientSecret,
-                                refreshToken: entry.refreshToken
+                                refreshToken: suppliedRefreshToken
                             })
                         ];
                     case 5:
@@ -9023,14 +9369,29 @@ function _ts_generator$_(thisArg, body) {
                             scope: (_refreshed_scope = refreshed.scope) !== null && _refreshed_scope !== void 0 ? _refreshed_scope : entry.scope,
                             expiresAt: Date.now() + ((_refreshed_expires_in = refreshed.expires_in) !== null && _refreshed_expires_in !== void 0 ? _refreshed_expires_in : 0) * 1000
                         });
+                        if (!entry.fromEnv) return [
+                            3,
+                            6
+                        ];
+                        // Service tokens do not rotate, so a one-shot env-sourced invocation is durable without
+                        // persisting. If a *rotating* refresh token was supplied, the rotation is lost on exit —
+                        // warn that env credentials should be non-rotating service tokens.
+                        if (refreshed.refresh_token != null && refreshed.refresh_token !== suppliedRefreshToken) {
+                            process.stderr.write('Warning: the refresh token supplied via environment rotated on use; the rotated token cannot be persisted for a one-shot invocation. Use a non-rotating service token (auth login --service-token).\n');
+                        }
+                        return [
+                            3,
+                            8
+                        ];
+                    case 6:
                         return [
                             4,
                             tokens.set(envName, entry)
                         ];
-                    case 6:
-                        _state.sent();
-                        _state.label = 7;
                     case 7:
+                        _state.sent();
+                        _state.label = 8;
+                    case 8:
                         setCliContext(createCliContext({
                             cliName: input.cliName,
                             envName: envName,
@@ -9040,17 +9401,17 @@ function _ts_generator$_(thisArg, body) {
                         }));
                         return [
                             3,
-                            9
+                            10
                         ];
-                    case 8:
+                    case 9:
                         e = _state.sent();
                         outputError(e);
                         process.exit(CLI_EXIT_CODE_AUTH);
                         return [
                             3,
-                            9
+                            10
                         ];
-                    case 9:
+                    case 10:
                         return [
                             2
                         ];
@@ -56555,6 +56916,7 @@ exports.PipesScanConfig = PipesScanConfig;
 exports.PipesScanSection = PipesScanSection;
 exports.RESERVED_MODEL_FOLDERS = RESERVED_MODEL_FOLDERS;
 exports.SCAN_CONFIG_FILENAME = SCAN_CONFIG_FILENAME$1;
+exports.SERVICE_TOKEN_REQUIRED_OIDC_SCOPES = SERVICE_TOKEN_REQUIRED_OIDC_SCOPES;
 exports.STANDARD_GLOBAL_OPTION_NAMES = STANDARD_GLOBAL_OPTION_NAMES;
 exports.SemanticTypeEntry = SemanticTypeEntry;
 exports.SemanticTypeManifest = SemanticTypeManifest;
@@ -56675,6 +57037,7 @@ exports.extractModels = extractModels;
 exports.extractPipeEntries = extractPipeEntries;
 exports.extractUiEntries = extractUiEntries;
 exports.extractUtilEntries = extractUtilEntries;
+exports.fetchSessionInfo = fetchSessionInfo;
 exports.fetchUserInfo = fetchUserInfo;
 exports.filterReadOnlyModelScopes = filterReadOnlyModelScopes;
 exports.findAndLoadConfig = findAndLoadConfig;
@@ -56777,6 +57140,7 @@ exports.pickFields = pickFields;
 exports.promptLine = promptLine;
 exports.readAllStdin = readAllStdin;
 exports.readDirectiveDecorator = readDirectiveDecorator;
+exports.readEnvTokenEntry = readEnvTokenEntry;
 exports.readPropertyDescription = readPropertyDescription;
 exports.readSelector = readSelector;
 exports.readStdinTokens = readStdinTokens;
@@ -56838,5 +57202,6 @@ exports.withCallModelArgs = withCallModelArgs;
 exports.withEnv = withEnv;
 exports.withMultiplePages = withMultiplePages;
 exports.withOutput = withOutput;
+exports.withServiceTokenScopes = withServiceTokenScopes;
 exports.wrapCommandHandler = wrapCommandHandler;
 exports.wrapSyncCommandHandler = wrapSyncCommandHandler;