@dereekb/dbx-cli 13.14.0 → 13.16.0

package/index.cjs.js

@@ -351,11 +351,17 @@ function _ts_generator$1f(thisArg, body) {
     /client_secret[=:]\s*\S+/gi,
     /id_token[=:]\s*\S+/gi
 ];
+/**
+ * Default per-request HTTP timeout in milliseconds, applied when no explicit `--timeout` is set.
+ *
+ * Without a default, the HTTP layer's `fetch` waits indefinitely on an unresponsive server, which
+ * surfaces as a CLI (or CI test) that hangs forever rather than failing with a clear error.
+ */ var DEFAULT_CLI_HTTP_TIMEOUT_MS = 60000;
 var _outputOptions = {};
 var _secretPatterns = _to_consumable_array$Z(DEFAULT_CLI_SECRET_PATTERNS);
 var _errorMapper;
 var _verbose = false;
-var _timeoutMs;
+var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
 /**
  * Configures output options from parsed CLI arguments.
  *
@@ -410,7 +416,8 @@ var _timeoutMs;
  * @returns The fetch Response.
  */ function tracedFetch(fetcher, input, init) {
     return _async_to_generator$1f(function() {
-        var _ref, fetchImpl, timeoutMs, method, url, controller, timeoutHandle, finalInit, localController, e;
+        var _ref, fetchImpl, timeoutMs, method, url, controller, timeoutHandle, finalInit, // Don't let the abort timer itself keep the Node event loop (or a test worker) alive.
+        _timeoutHandle_unref, localController, e;
         return _ts_generator$1f(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -426,12 +433,13 @@ var _timeoutMs;
                     }
                     verboseLog("".concat(method, " ").concat(url));
                     finalInit = init;
-                    if (timeoutMs != null && (init === null || init === void 0 ? void 0 : init.signal) == null) {
+                    if (timeoutMs != null && timeoutMs > 0 && (init === null || init === void 0 ? void 0 : init.signal) == null) {
                         localController = new AbortController();
                         controller = localController;
                         timeoutHandle = setTimeout(function() {
                             return localController.abort();
                         }, timeoutMs);
+                        (_timeoutHandle_unref = timeoutHandle.unref) === null || _timeoutHandle_unref === void 0 ? void 0 : _timeoutHandle_unref.call(timeoutHandle);
                         finalInit = _object_spread_props$t(_object_spread$L({}, init), {
                             signal: localController.signal
                         });
@@ -478,12 +486,13 @@ var _timeoutMs;
 /**
  * Sets the process-wide HTTP timeout (in milliseconds) honored by the HTTP layer.
  *
- * Pass `undefined` to clear. The HTTP helpers thread this into an `AbortController`
- * so individual `fetch` calls cancel after the configured duration.
+ * The HTTP helpers thread a positive value into an `AbortController` so individual `fetch` calls
+ * cancel after the configured duration. `undefined` falls back to {@link DEFAULT_CLI_HTTP_TIMEOUT_MS};
+ * `0` (or a negative value) disables the timeout entirely (the request waits indefinitely).
  *
- * @param ms - Timeout in ms, or `undefined` to clear.
+ * @param ms - Timeout in ms, `0`/negative to disable, or `undefined` to fall back to the default.
  */ function setCliTimeoutMs(ms) {
-    _timeoutMs = ms;
+    _timeoutMs = ms === undefined ? DEFAULT_CLI_HTTP_TIMEOUT_MS : ms;
 }
 /**
  * @returns The current process-wide HTTP timeout in ms, or `undefined` when unset.
@@ -7055,11 +7064,11 @@ function resolveAuthSetupPrompt(input) {
                                 tokenType: tokenResponse.token_type,
                                 scope: tokenResponse.scope,
                                 expiresAt: expiresAt
-                            }, sessionExpiresAt != null ? {
+                            }, sessionExpiresAt == null ? {} : {
                                 sessionExpiresAt: sessionExpiresAt
-                            } : {}, rotationDisabled != null ? {
+                            }, rotationDisabled == null ? {} : {
                                 rotationDisabled: rotationDisabled
-                            } : {});
+                            });
                             return [
                                 4,
                                 tokens.set(envName, entry)
@@ -9279,14 +9288,15 @@ function _ts_generator$_(thisArg, body) {
     });
     return function(argv) {
         return _async_to_generator$_(function() {
-            var _argv__, command, _ref, _ref1, envName, env, entry, _readEnvTokenEntry, _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _refreshed_expires_in, meta, suppliedRefreshToken, refreshed, e;
+            var _argv__, command, _ref, envName, env, entry, e;
             return _ts_generator$_(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         // Configure verbose/timeout as early as possible so HTTP calls made from this very
                         // middleware (OIDC discovery + token refresh) honor the flags.
                         setCliVerbose(Boolean(argv.verbose));
-                        setCliTimeoutMs(typeof argv.timeout === 'number' && argv.timeout > 0 ? argv.timeout * 1000 : undefined);
+                        // No `--timeout` flag → undefined → the default timeout applies. `--timeout 0` disables it.
+                        setCliTimeoutMs(typeof argv.timeout === 'number' ? argv.timeout * 1000 : undefined);
                         command = (_argv__ = argv._) === null || _argv__ === void 0 ? void 0 : _argv__[0];
                         if (typeof command === 'string' && input.skipCommands.has(command)) {
                             return [
@@ -9297,9 +9307,9 @@ function _ts_generator$_(thisArg, body) {
                     case 1:
                         _state.trys.push([
                             1,
-                            9,
+                            4,
                             ,
-                            10
+                            5
                         ]);
                         return [
                             4,
@@ -9312,86 +9322,18 @@ function _ts_generator$_(thisArg, body) {
                             })
                         ];
                     case 2:
-                        _ref1 = _state.sent(), envName = _ref1.envName, env = _ref1.env;
+                        _ref = _state.sent(), envName = _ref.envName, env = _ref.env;
                         return [
                             4,
-                            tokens.get(envName)
-                        ];
-                    case 3:
-                        entry = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : undefined;
-                        if (!entry) {
-                            entry = (_readEnvTokenEntry = readEnvTokenEntry({
-                                cliName: input.cliName
-                            })) !== null && _readEnvTokenEntry !== void 0 ? _readEnvTokenEntry : undefined;
-                        }
-                        if (!(entry === null || entry === void 0 ? void 0 : entry.accessToken) && !(entry === null || entry === void 0 ? void 0 : entry.refreshToken)) {
-                            throw new CliError({
-                                message: 'No tokens for env "'.concat(envName, '". Run `').concat(input.cliName, " auth login --env ").concat(envName, "`."),
-                                code: 'NOT_LOGGED_IN'
-                            });
-                        }
-                        if (!(!entry.accessToken || isTokenExpired(entry))) return [
-                            3,
-                            8
-                        ];
-                        if (!entry.refreshToken) {
-                            throw new CliError({
-                                message: 'Token for env "'.concat(envName, '" is expired and no refresh token is cached. Re-login.'),
-                                code: 'TOKEN_EXPIRED',
-                                suggestion: "Run `".concat(input.cliName, " auth login --env ").concat(envName, "`.")
-                            });
-                        }
-                        return [
-                            4,
-                            discoverOidcMetadata({
-                                issuer: env.oidcIssuer,
-                                fallbackBaseUrl: env.apiBaseUrl
-                            })
-                        ];
-                    case 4:
-                        meta = _state.sent();
-                        suppliedRefreshToken = entry.refreshToken;
-                        return [
-                            4,
-                            refreshAccessToken({
-                                tokenEndpoint: meta.token_endpoint,
-                                clientId: env.clientId,
-                                clientSecret: env.clientSecret,
-                                refreshToken: suppliedRefreshToken
+                            resolveAccessTokenEntry({
+                                cliName: input.cliName,
+                                envName: envName,
+                                env: env,
+                                tokens: tokens
                             })
                         ];
-                    case 5:
-                        refreshed = _state.sent();
-                        entry = _object_spread_props$l(_object_spread$A({}, entry), {
-                            accessToken: refreshed.access_token,
-                            refreshToken: (_refreshed_refresh_token = refreshed.refresh_token) !== null && _refreshed_refresh_token !== void 0 ? _refreshed_refresh_token : entry.refreshToken,
-                            tokenType: (_refreshed_token_type = refreshed.token_type) !== null && _refreshed_token_type !== void 0 ? _refreshed_token_type : entry.tokenType,
-                            scope: (_refreshed_scope = refreshed.scope) !== null && _refreshed_scope !== void 0 ? _refreshed_scope : entry.scope,
-                            expiresAt: Date.now() + ((_refreshed_expires_in = refreshed.expires_in) !== null && _refreshed_expires_in !== void 0 ? _refreshed_expires_in : 0) * 1000
-                        });
-                        if (!entry.fromEnv) return [
-                            3,
-                            6
-                        ];
-                        // Service tokens do not rotate, so a one-shot env-sourced invocation is durable without
-                        // persisting. If a *rotating* refresh token was supplied, the rotation is lost on exit —
-                        // warn that env credentials should be non-rotating service tokens.
-                        if (refreshed.refresh_token != null && refreshed.refresh_token !== suppliedRefreshToken) {
-                            process.stderr.write('Warning: the refresh token supplied via environment rotated on use; the rotated token cannot be persisted for a one-shot invocation. Use a non-rotating service token (auth login --service-token).\n');
-                        }
-                        return [
-                            3,
-                            8
-                        ];
-                    case 6:
-                        return [
-                            4,
-                            tokens.set(envName, entry)
-                        ];
-                    case 7:
-                        _state.sent();
-                        _state.label = 8;
-                    case 8:
+                    case 3:
+                        entry = _state.sent();
                         setCliContext(createCliContext({
                             cliName: input.cliName,
                             envName: envName,
@@ -9401,17 +9343,17 @@ function _ts_generator$_(thisArg, body) {
                         }));
                         return [
                             3,
-                            10
+                            5
                         ];
-                    case 9:
+                    case 4:
                         e = _state.sent();
                         outputError(e);
                         process.exit(CLI_EXIT_CODE_AUTH);
                         return [
                             3,
-                            10
+                            5
                         ];
-                    case 10:
+                    case 5:
                         return [
                             2
                         ];
@@ -9420,6 +9362,146 @@ function _ts_generator$_(thisArg, body) {
         })();
     };
 }
+/**
+ * Resolves the access-token entry for an env: prefers the cached token, falls
+ * back to an env-supplied token, requires at least one token to be present,
+ * and refreshes when the access token is missing or expired.
+ *
+ * @param input - The CLI name, resolved env, env name, and token cache store.
+ * @returns The resolved (and refreshed when necessary) token entry.
+ * @throws {CliError} When no tokens are available for the env.
+ */ function resolveAccessTokenEntry(input) {
+    return _async_to_generator$_(function() {
+        var _ref, cliName, envName, env, tokens, entry, _readEnvTokenEntry;
+        return _ts_generator$_(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    cliName = input.cliName, envName = input.envName, env = input.env, tokens = input.tokens;
+                    return [
+                        4,
+                        tokens.get(envName)
+                    ];
+                case 1:
+                    entry = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : undefined;
+                    if (!entry) {
+                        entry = (_readEnvTokenEntry = readEnvTokenEntry({
+                            cliName: cliName
+                        })) !== null && _readEnvTokenEntry !== void 0 ? _readEnvTokenEntry : undefined;
+                    }
+                    if (!(entry === null || entry === void 0 ? void 0 : entry.accessToken) && !(entry === null || entry === void 0 ? void 0 : entry.refreshToken)) {
+                        throw new CliError({
+                            message: 'No tokens for env "'.concat(envName, '". Run `').concat(cliName, " auth login --env ").concat(envName, "`."),
+                            code: 'NOT_LOGGED_IN'
+                        });
+                    }
+                    if (!(!entry.accessToken || isTokenExpired(entry))) return [
+                        3,
+                        3
+                    ];
+                    return [
+                        4,
+                        refreshTokenEntry({
+                            cliName: cliName,
+                            envName: envName,
+                            env: env,
+                            tokens: tokens,
+                            entry: entry
+                        })
+                    ];
+                case 2:
+                    entry = _state.sent();
+                    _state.label = 3;
+                case 3:
+                    return [
+                        2,
+                        entry
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Refreshes an absent/expired access token via OIDC. Cache-sourced entries are
+ * persisted; env-sourced service tokens are durable for the one-shot
+ * invocation and not written back (and a rotated env refresh token is warned
+ * about, since it cannot be persisted).
+ *
+ * @param input - The CLI name, env, env name, token store, and the entry to refresh.
+ * @returns The refreshed token entry.
+ * @throws {CliError} When the entry is expired and has no refresh token.
+ */ function refreshTokenEntry(input) {
+    return _async_to_generator$_(function() {
+        var _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _refreshed_expires_in, cliName, envName, env, tokens, entry, meta, suppliedRefreshToken, refreshed, updated;
+        return _ts_generator$_(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    cliName = input.cliName, envName = input.envName, env = input.env, tokens = input.tokens, entry = input.entry;
+                    if (!entry.refreshToken) {
+                        throw new CliError({
+                            message: 'Token for env "'.concat(envName, '" is expired and no refresh token is cached. Re-login.'),
+                            code: 'TOKEN_EXPIRED',
+                            suggestion: "Run `".concat(cliName, " auth login --env ").concat(envName, "`.")
+                        });
+                    }
+                    return [
+                        4,
+                        discoverOidcMetadata({
+                            issuer: env.oidcIssuer,
+                            fallbackBaseUrl: env.apiBaseUrl
+                        })
+                    ];
+                case 1:
+                    meta = _state.sent();
+                    suppliedRefreshToken = entry.refreshToken;
+                    return [
+                        4,
+                        refreshAccessToken({
+                            tokenEndpoint: meta.token_endpoint,
+                            clientId: env.clientId,
+                            clientSecret: env.clientSecret,
+                            refreshToken: suppliedRefreshToken
+                        })
+                    ];
+                case 2:
+                    refreshed = _state.sent();
+                    updated = _object_spread_props$l(_object_spread$A({}, entry), {
+                        accessToken: refreshed.access_token,
+                        refreshToken: (_refreshed_refresh_token = refreshed.refresh_token) !== null && _refreshed_refresh_token !== void 0 ? _refreshed_refresh_token : entry.refreshToken,
+                        tokenType: (_refreshed_token_type = refreshed.token_type) !== null && _refreshed_token_type !== void 0 ? _refreshed_token_type : entry.tokenType,
+                        scope: (_refreshed_scope = refreshed.scope) !== null && _refreshed_scope !== void 0 ? _refreshed_scope : entry.scope,
+                        expiresAt: Date.now() + ((_refreshed_expires_in = refreshed.expires_in) !== null && _refreshed_expires_in !== void 0 ? _refreshed_expires_in : 0) * 1000
+                    });
+                    if (!updated.fromEnv) return [
+                        3,
+                        3
+                    ];
+                    // Service tokens do not rotate, so a one-shot env-sourced invocation is durable without
+                    // persisting. If a *rotating* refresh token was supplied, the rotation is lost on exit —
+                    // warn that env credentials should be non-rotating service tokens.
+                    if (refreshed.refresh_token != null && refreshed.refresh_token !== suppliedRefreshToken) {
+                        process.stderr.write('Warning: the refresh token supplied via environment rotated on use; the rotated token cannot be persisted for a one-shot invocation. Use a non-rotating service token (auth login --service-token).\n');
+                    }
+                    return [
+                        3,
+                        5
+                    ];
+                case 3:
+                    return [
+                        4,
+                        tokens.set(envName, updated)
+                    ];
+                case 4:
+                    _state.sent();
+                    _state.label = 5;
+                case 5:
+                    return [
+                        2,
+                        updated
+                    ];
+            }
+        });
+    })();
+}
 /**
  * Test-only middleware that skips OIDC discovery, disk token loading, and token refresh, attaching
  * a pre-built {@link CliContext} directly via {@link setCliContext}.
@@ -9672,7 +9754,8 @@ function _ts_generator$Z(thisArg, body) {
                         // (auth, env, doctor, output) — which bypass the auth middleware via skipCommands —
                         // still respect `--verbose` and `--timeout`.
                         setCliVerbose(Boolean(argv.verbose));
-                        setCliTimeoutMs(typeof argv.timeout === 'number' && argv.timeout > 0 ? argv.timeout * 1000 : undefined);
+                        // No `--timeout` flag → undefined → the default timeout applies. `--timeout 0` disables it.
+                        setCliTimeoutMs(typeof argv.timeout === 'number' ? argv.timeout * 1000 : undefined);
                         commandPath = argv._ ? argv._.map(String) : [];
                         topCommand = commandPath[0];
                         setDumpDir = argv.setDumpDir;
@@ -10450,7 +10533,7 @@ function _ts_generator$X(thisArg, body) {
     }).option('timeout', {
         type: 'number',
         global: true,
-        describe: 'Per-HTTP-request timeout in seconds (aborts via AbortController)'
+        describe: 'Per-HTTP-request timeout in seconds (default 60; 0 disables; aborts via AbortController)'
     }).option('data-help', {
         type: 'string',
         choices: [
@@ -11271,6 +11354,7 @@ function hideGlobalOptions(yargs, names) {
  * @returns Multi-section epilogue string, or `undefined` when the entry has no
  *   metadata worth surfacing.
  */ function buildEntryEpilogue(entry, context) {
+    var _sections, _sections1;
     var dataHelpFormat = context.dataHelpFormat, helpMode = context.helpMode;
     var showAction = helpMode === 'action' || helpMode === 'both';
     var showParams = helpMode === 'params' || helpMode === 'both';
@@ -11279,31 +11363,67 @@ function hideGlobalOptions(yargs, names) {
         var actionSection = buildActionSection(entry);
         if (actionSection) sections.push(actionSection);
     }
-    var schemaSections = [];
-    if (showParams) {
-        var _sections;
-        var paramsSection = buildParamsSection(entry);
-        if (paramsSection) sections.push(paramsSection);
-        schemaSections = renderParamsSchemaSections(entry, dataHelpFormat);
-        (_sections = sections).push.apply(_sections, _to_consumable_array$P(schemaSections));
-        var resultSection = buildResultSection(entry);
-        if (resultSection) {
-            sections.push(resultSection);
-        } else if (entry.resultTypeName) {
-            sections.push("Result: ".concat(entry.resultTypeName));
-        }
-    }
+    var params = showParams ? collectParamsSections(entry, dataHelpFormat) : {
+        sections: [],
+        schemaCount: 0
+    };
+    (_sections = sections).push.apply(_sections, _to_consumable_array$P(params.sections));
     if (entry.sourceFile) {
         sections.push("Source: ".concat(entry.sourceFile));
     }
-    if (showParams && schemaSections.length > 0 && dataHelpFormat !== 'both') {
+    (_sections1 = sections).push.apply(_sections1, _to_consumable_array$P(collectHelpHints({
+        entry: entry,
+        helpMode: helpMode,
+        dataHelpFormat: dataHelpFormat,
+        showParams: showParams,
+        schemaCount: params.schemaCount
+    })));
+    return sections.length > 0 ? sections.join('\n\n') : undefined;
+}
+/**
+ * Collects the params-side help sections (params interface, schema renders,
+ * result) for an entry, reporting how many schema sections were produced so
+ * the caller can decide whether to surface the schema-format hint.
+ *
+ * @param entry - The manifest entry being documented.
+ * @param dataHelpFormat - The requested schema render format.
+ * @returns The ordered sections and the number of schema sections produced.
+ */ function collectParamsSections(entry, dataHelpFormat) {
+    var _sections;
+    var sections = [];
+    var paramsSection = buildParamsSection(entry);
+    if (paramsSection) sections.push(paramsSection);
+    var schemaSections = renderParamsSchemaSections(entry, dataHelpFormat);
+    (_sections = sections).push.apply(_sections, _to_consumable_array$P(schemaSections));
+    var resultSection = buildResultSection(entry);
+    if (resultSection) {
+        sections.push(resultSection);
+    } else if (entry.resultTypeName) {
+        sections.push("Result: ".concat(entry.resultTypeName));
+    }
+    return {
+        sections: sections,
+        schemaCount: schemaSections.length
+    };
+}
+/**
+ * Builds the trailing `--help` hint lines: how to switch the schema format,
+ * and (in `both` mode, when there is something to focus on) how to narrow the
+ * help to a single section.
+ *
+ * @param input - The entry, help mode, schema format, params visibility, and schema-section count.
+ * @returns The hint lines (possibly empty).
+ */ function collectHelpHints(input) {
+    var entry = input.entry, helpMode = input.helpMode, dataHelpFormat = input.dataHelpFormat, showParams = input.showParams, schemaCount = input.schemaCount;
+    var hints = [];
+    if (showParams && schemaCount > 0 && dataHelpFormat !== 'both') {
         var other = dataHelpFormat === 'jsonschema' ? 'arktype' : 'jsonschema';
-        sections.push("(Pass --data-help=".concat(other, " or --data-help=both to switch the schema format above.)"));
+        hints.push("(Pass --data-help=".concat(other, " or --data-help=both to switch the schema format above.)"));
     }
     if (helpMode === 'both' && (entry.description || entry.paramsTypeDescription || entry.paramsFields && entry.paramsFields.length > 0)) {
-        sections.push("(Pass --help-mode=action or --help-mode=params to focus this help on a single section.)");
+        hints.push("(Pass --help-mode=action or --help-mode=params to focus this help on a single section.)");
     }
-    return sections.length > 0 ? sections.join('\n\n') : undefined;
+    return hints;
 }
 function buildActionSection(entry) {
     return entry.description ? "About:\n".concat(indentLines(entry.description, '  ')) : undefined;
@@ -11319,31 +11439,8 @@ function buildParamsSection(entry) {
             lines.push(indentLines(entry.paramsTypeDescription, '  '));
         }
         if (entry.paramsFields && entry.paramsFields.length > 0) {
-            lines.push('', 'Fields:');
-            var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-            try {
-                for(var _iterator = entry.paramsFields[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                    var field = _step.value;
-                    var header = "  - ".concat(field.name, ": ").concat(field.typeText);
-                    lines.push(header);
-                    if (field.description) {
-                        lines.push(indentLines(field.description, '      '));
-                    }
-                }
-            } catch (err) {
-                _didIteratorError = true;
-                _iteratorError = err;
-            } finally{
-                try {
-                    if (!_iteratorNormalCompletion && _iterator.return != null) {
-                        _iterator.return();
-                    }
-                } finally{
-                    if (_didIteratorError) {
-                        throw _iteratorError;
-                    }
-                }
-            }
+            var _lines;
+            (_lines = lines).push.apply(_lines, _to_consumable_array$P(buildFieldLines(entry.paramsFields)));
         }
         result = lines.join('\n');
     }
@@ -11360,36 +11457,49 @@ function buildResultSection(entry) {
             lines.push(indentLines(entry.resultTypeDescription, '  '));
         }
         if (entry.resultFields && entry.resultFields.length > 0) {
-            lines.push('', 'Fields:');
-            var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-            try {
-                for(var _iterator = entry.resultFields[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                    var field = _step.value;
-                    var header = "  - ".concat(field.name, ": ").concat(field.typeText);
-                    lines.push(header);
-                    if (field.description) {
-                        lines.push(indentLines(field.description, '      '));
-                    }
-                }
-            } catch (err) {
-                _didIteratorError = true;
-                _iteratorError = err;
-            } finally{
-                try {
-                    if (!_iteratorNormalCompletion && _iterator.return != null) {
-                        _iterator.return();
-                    }
-                } finally{
-                    if (_didIteratorError) {
-                        throw _iteratorError;
-                    }
-                }
-            }
+            var _lines;
+            (_lines = lines).push.apply(_lines, _to_consumable_array$P(buildFieldLines(entry.resultFields)));
         }
         result = lines.join('\n');
     }
     return result;
 }
+/**
+ * Renders the `Fields:` block shared by the params and result help sections —
+ * one `- name: type` header per field, with its indented description below.
+ *
+ * @param fields - The manifest fields to render.
+ * @returns The lines for the fields block, beginning with a blank line and the `Fields:` header.
+ */ function buildFieldLines(fields) {
+    var lines = [
+        '',
+        'Fields:'
+    ];
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = fields[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var field = _step.value;
+            lines.push("  - ".concat(field.name, ": ").concat(field.typeText));
+            if (field.description) {
+                lines.push(indentLines(field.description, '      '));
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return lines;
+}
 function indentLines(text, indent) {
     return text.split('\n').map(function(line) {
         return "".concat(indent).concat(line);
@@ -11398,25 +11508,38 @@ function indentLines(text, indent) {
 function renderParamsSchemaSections(entry, dataHelpFormat) {
     var sections = [];
     if (entry.paramsValidator) {
-        if (dataHelpFormat === 'jsonschema' || dataHelpFormat === 'both') {
-            var jsonSchemaSection = renderJsonSchemaSection(entry);
-            if (jsonSchemaSection) {
-                sections.push(jsonSchemaSection);
-            }
+        sections = collectSchemaSections(entry, dataHelpFormat);
+    }
+    return sections;
+}
+/**
+ * Renders the requested params-schema sections (JSON Schema and/or arktype),
+ * with a last-ditch arktype-expression fallback when the requested format
+ * produced nothing usable. Assumes the entry has a bound params validator.
+ *
+ * @param entry - The manifest entry whose params validator is rendered.
+ * @param dataHelpFormat - The requested schema render format.
+ * @returns The rendered schema sections (possibly empty).
+ */ function collectSchemaSections(entry, dataHelpFormat) {
+    var sections = [];
+    if (dataHelpFormat === 'jsonschema' || dataHelpFormat === 'both') {
+        var jsonSchemaSection = renderJsonSchemaSection(entry);
+        if (jsonSchemaSection) {
+            sections.push(jsonSchemaSection);
         }
-        if (dataHelpFormat === 'arktype' || dataHelpFormat === 'both') {
-            var arktypeSection = renderArktypeExpressionSection(entry);
-            if (arktypeSection) {
-                sections.push(arktypeSection);
-            }
+    }
+    if (dataHelpFormat === 'arktype' || dataHelpFormat === 'both') {
+        var arktypeSection = renderArktypeExpressionSection(entry);
+        if (arktypeSection) {
+            sections.push(arktypeSection);
         }
-        if (sections.length === 0) {
-            // Last-ditch fallback when the requested format produced nothing usable
-            // (e.g. arktype was requested but the bound validator has no expression).
-            var expression = readArktypeExpression(entry);
-            if (expression) {
-                sections.push("Params Schema (arktype): ".concat(expression));
-            }
+    }
+    if (sections.length === 0) {
+        // Last-ditch fallback when the requested format produced nothing usable
+        // (e.g. arktype was requested but the bound validator has no expression).
+        var expression = readArktypeExpression(entry);
+        if (expression) {
+            sections.push("Params Schema (arktype): ".concat(expression));
         }
     }
     return sections;
@@ -19790,28 +19913,50 @@ function buildModelEntry(args) {
         sourceFile: input.sourceFile,
         fields: fields,
         enums: relevantEnums.map(function(e) {
-            return _object_spread$u({
-                name: e.name,
-                values: e.values.map(function(v) {
-                    return v.description ? {
-                        name: v.name,
-                        value: v.value,
-                        description: v.description
-                    } : {
-                        name: v.name,
-                        value: v.value
-                    };
-                })
-            }, e.description ? {
-                description: e.description
-            } : {});
+            return buildModelEnumEntry(e);
         }),
         detectionHints: detectionHints
     }), groupName ? {
         modelGroup: groupName
     } : {}, collectionKind ? {
         collectionKind: collectionKind
-    } : {}, markers.userKeyedById ? {
+    } : {}, buildModelMarkerFlags(markers), buildModelArchetypeFields(archetypeInfo), compositeKey ? {
+        compositeKey: compositeKey
+    } : {}, iface.tags.dbxModelRead ? {
+        read: iface.tags.dbxModelRead
+    } : {});
+}
+/**
+ * Projects one extracted enum into the manifest enum shape, omitting empty
+ * value/enum descriptions.
+ *
+ * @param e - The extracted enum.
+ * @returns The manifest enum entry.
+ */ function buildModelEnumEntry(e) {
+    return _object_spread$u({
+        name: e.name,
+        values: e.values.map(function(v) {
+            return v.description ? {
+                name: v.name,
+                value: v.value,
+                description: v.description
+            } : {
+                name: v.name,
+                value: v.value
+            };
+        })
+    }, e.description ? {
+        description: e.description
+    } : {});
+}
+/**
+ * Builds the optional keyed-by/aggregation marker flags portion of a model
+ * entry, including each flag only when set.
+ *
+ * @param markers - The computed marker flags.
+ * @returns A partial model entry with only the active marker fields.
+ */ function buildModelMarkerFlags(markers) {
+    return _object_spread$u({}, markers.userKeyedById ? {
         userKeyedById: true
     } : {}, markers.hasUserUidField ? {
         hasUserUidField: true
@@ -19827,14 +19972,19 @@ function buildModelEntry(args) {
         organizationalGroupRoot: true
     } : {}, markers.aggregatesFromNonEmpty ? {
         aggregatesFrom: markers.aggregatesFrom
-    } : {}, archetypeInfo.archetypes.length > 0 ? {
+    } : {});
+}
+/**
+ * Builds the optional archetype portion of a model entry, including the
+ * archetype list and per-slug axes only when present.
+ *
+ * @param archetypeInfo - The computed archetype info.
+ * @returns A partial model entry with only the present archetype fields.
+ */ function buildModelArchetypeFields(archetypeInfo) {
+    return _object_spread$u({}, archetypeInfo.archetypes.length > 0 ? {
         archetypes: archetypeInfo.archetypes
     } : {}, archetypeInfo.archetypeAxesBySlug ? {
         archetypeAxesBySlug: archetypeInfo.archetypeAxesBySlug
-    } : {}, compositeKey ? {
-        compositeKey: compositeKey
-    } : {}, iface.tags.dbxModelRead ? {
-        read: iface.tags.dbxModelRead
     } : {});
 }
 function filterRelevantEnums(fields, enums) {
@@ -20884,25 +21034,8 @@ var COMPOSITE_KEY_MODEL_NAME_RE = /^[A-Za-z][A-Za-z0-9_$]*$/;
             var key = token.slice(0, eq).trim();
             var v = token.slice(eq + 1).trim();
             if (key === 'from') {
-                if (v === '*') {
-                    fromValue = '*';
-                } else if (v.length > 0) {
-                    // Tolerate the wildcard mixed with concrete entries here; the
-                    // validator emits MODEL_COMPOSITE_KEY_WILDCARD_MIXED when it sees both.
-                    var parts = v.split(',').map(function(p) {
-                        return p.trim();
-                    }).filter(function(p) {
-                        return p.length > 0;
-                    });
-                    if (parts.includes('*')) {
-                        // Preserve the literal list so the validator can flag the mix.
-                        fromValue = parts;
-                    } else {
-                        fromValue = parts.filter(function(p) {
-                            return COMPOSITE_KEY_MODEL_NAME_RE.test(p);
-                        });
-                    }
-                }
+                var parsedFrom = parseCompositeKeyFromValue(v);
+                if (parsedFrom !== undefined) fromValue = parsedFrom;
             } else if (key === 'encoding' && (v === 'two-way' || v === 'one-way')) encoding = v;
         }
     } catch (err) {
@@ -20924,6 +21057,32 @@ var COMPOSITE_KEY_MODEL_NAME_RE = /^[A-Za-z][A-Za-z0-9_$]*$/;
         encoding: encoding
     };
 }
+/**
+ * Parses the `from=` value of a `@dbxModelCompositeKey` tag into the wildcard
+ * `'*'` or a concrete model-name list. Returns `undefined` for an empty value
+ * so the caller leaves any previously-parsed `from` untouched.
+ *
+ * @param v - The raw text after `from=`.
+ * @returns `'*'`, the parsed model-name list, or `undefined` when the value is empty.
+ */ function parseCompositeKeyFromValue(v) {
+    var result;
+    if (v === '*') {
+        result = '*';
+    } else if (v.length > 0) {
+        // Tolerate the wildcard mixed with concrete entries here; the validator
+        // emits MODEL_COMPOSITE_KEY_WILDCARD_MIXED when it sees both.
+        var parts = v.split(',').map(function(p) {
+            return p.trim();
+        }).filter(function(p) {
+            return p.length > 0;
+        });
+        // Preserve the literal list (incl. `*`) so the validator can flag the mix.
+        result = parts.includes('*') ? parts : parts.filter(function(p) {
+            return COMPOSITE_KEY_MODEL_NAME_RE.test(p);
+        });
+    }
+    return result;
+}
 function takeFirstTagText(current, tag) {
     var _tag_getCommentText;
     if (current !== undefined) return current;
@@ -30965,14 +31124,7 @@ var EMPTY_ROLE_CONST_RESOLUTION = {
  */ function resolveRoleConstByName(name, ctx) {
     var result;
     var scalar = ctx.knownRoles.get(name);
-    if (scalar !== undefined) {
-        result = {
-            roles: [
-                scalar
-            ],
-            unresolved: []
-        };
-    } else {
+    if (scalar === undefined) {
         var arrayExpr = ctx.localArrayRoles.get(name);
         if (arrayExpr === undefined) {
             result = {
@@ -30990,6 +31142,13 @@ var EMPTY_ROLE_CONST_RESOLUTION = {
                 seen: nextSeen
             }));
         }
+    } else {
+        result = {
+            roles: [
+                scalar
+            ],
+            unresolved: []
+        };
     }
     return result;
 }
@@ -42794,7 +42953,7 @@ var DEFAULT_EXCLUDE = [
  * @returns Map keyed by entry slug → reference count + locations.
  */ function scanFactoryReferences(input) {
     return _async_to_generator$z(function() {
-        var projectRoot, entries, _input_include, include, _input_exclude, exclude, _input_readFile, readFile, _input_globber, globber, result, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, entry, namesBySlug, declFilePathsBySlug, declFilePaths, filePaths, combinedPattern, sitesBySlug, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, entry1, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, relPath, absolutePath, err, _iteratorNormalCompletion3, _didIteratorError3, _iteratorError3, _iterator3, _step3, _step_value, slug, sites, specCount, _iteratorNormalCompletion4, _didIteratorError4, _iteratorError4, _iterator4, _step4, site;
+        var projectRoot, entries, _input_include, include, _input_exclude, exclude, _input_readFile, readFile, _input_globber, globber, result, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, entry, namesBySlug, declFilePathsBySlug, declFilePaths, filePaths, combinedPattern, sitesBySlug, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, slug, sites;
         return _ts_generator$z(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -42827,7 +42986,7 @@ var DEFAULT_EXCLUDE = [
                     }
                     if (!(entries.length > 0)) return [
                         3,
-                        10
+                        3
                     ];
                     namesBySlug = buildNameLookup(entries);
                     declFilePathsBySlug = buildDeclFilePathLookup(entries);
@@ -42845,14 +43004,27 @@ var DEFAULT_EXCLUDE = [
                     combinedPattern = buildCombinedRegex(Array.from(namesBySlug.values()));
                     if (!(combinedPattern !== undefined)) return [
                         3,
-                        10
+                        3
                     ];
-                    sitesBySlug = new Map();
+                    return [
+                        4,
+                        collectReferenceSites({
+                            entries: entries,
+                            filePaths: filePaths,
+                            projectRoot: projectRoot,
+                            declFilePaths: declFilePaths,
+                            readFile: readFile,
+                            combinedPattern: combinedPattern,
+                            namesBySlug: namesBySlug
+                        })
+                    ];
+                case 2:
+                    sitesBySlug = _state.sent();
                     _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                     try {
-                        for(_iterator1 = entries[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                            entry1 = _step1.value;
-                            sitesBySlug.set(entry1.slug, []);
+                        for(_iterator1 = sitesBySlug[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                            _step_value = _sliced_to_array$2(_step1.value, 2), slug = _step_value[0], sites = _step_value[1];
+                            result.set(slug, tallyReferenceSites(sites));
                         }
                     } catch (err) {
                         _didIteratorError1 = true;
@@ -42868,30 +43040,72 @@ var DEFAULT_EXCLUDE = [
                             }
                         }
                     }
-                    _iteratorNormalCompletion2 = true, _didIteratorError2 = false, _iteratorError2 = undefined;
-                    _state.label = 2;
-                case 2:
-                    _state.trys.push([
+                    _state.label = 3;
+                case 3:
+                    return [
                         2,
+                        result
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Seeds an empty site list per entry slug, then scans every non-declaration
+ * file for factory references, accumulating the hits per slug.
+ *
+ * @param input - The entries, globbed file paths, project root, declaration-file guard set, reader, combined pattern, and name lookup.
+ * @returns The reference sites discovered, keyed by entry slug.
+ */ function collectReferenceSites(input) {
+    return _async_to_generator$z(function() {
+        var entries, filePaths, projectRoot, declFilePaths, readFile, combinedPattern, namesBySlug, sitesBySlug, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, entry, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, relPath, absolutePath, err;
+        return _ts_generator$z(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    entries = input.entries, filePaths = input.filePaths, projectRoot = input.projectRoot, declFilePaths = input.declFilePaths, readFile = input.readFile, combinedPattern = input.combinedPattern, namesBySlug = input.namesBySlug;
+                    sitesBySlug = new Map();
+                    _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                    try {
+                        for(_iterator = entries[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                            entry = _step.value;
+                            sitesBySlug.set(entry.slug, []);
+                        }
+                    } catch (err) {
+                        _didIteratorError = true;
+                        _iteratorError = err;
+                    } finally{
+                        try {
+                            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                                _iterator.return();
+                            }
+                        } finally{
+                            if (_didIteratorError) {
+                                throw _iteratorError;
+                            }
+                        }
+                    }
+                    _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        6,
                         7,
-                        8,
-                        9
+                        8
                     ]);
-                    _iterator2 = filePaths[Symbol.iterator]();
-                    _state.label = 3;
-                case 3:
-                    if (!!(_iteratorNormalCompletion2 = (_step2 = _iterator2.next()).done)) return [
+                    _iterator1 = filePaths[Symbol.iterator]();
+                    _state.label = 2;
+                case 2:
+                    if (!!(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done)) return [
                         3,
-                        6
+                        5
                     ];
-                    relPath = _step2.value;
+                    relPath = _step1.value;
                     absolutePath = node_path.resolve(projectRoot, relPath);
-                    if (declFilePaths.has(absolutePath)) {
-                        return [
-                            3,
-                            5
-                        ];
-                    }
+                    if (!!declFilePaths.has(absolutePath)) return [
+                        3,
+                        4
+                    ];
                     return [
                         4,
                         scanOneFile({
@@ -42903,100 +43117,87 @@ var DEFAULT_EXCLUDE = [
                             sitesBySlug: sitesBySlug
                         })
                     ];
-                case 4:
+                case 3:
                     _state.sent();
-                    _state.label = 5;
-                case 5:
-                    _iteratorNormalCompletion2 = true;
+                    _state.label = 4;
+                case 4:
+                    _iteratorNormalCompletion1 = true;
                     return [
                         3,
-                        3
+                        2
                     ];
-                case 6:
+                case 5:
                     return [
                         3,
-                        9
+                        8
                     ];
-                case 7:
+                case 6:
                     err = _state.sent();
-                    _didIteratorError2 = true;
-                    _iteratorError2 = err;
+                    _didIteratorError1 = true;
+                    _iteratorError1 = err;
                     return [
                         3,
-                        9
+                        8
                     ];
-                case 8:
+                case 7:
                     try {
-                        if (!_iteratorNormalCompletion2 && _iterator2.return != null) {
-                            _iterator2.return();
+                        if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                            _iterator1.return();
                         }
                     } finally{
-                        if (_didIteratorError2) {
-                            throw _iteratorError2;
+                        if (_didIteratorError1) {
+                            throw _iteratorError1;
                         }
                     }
                     return [
                         7
                     ];
-                case 9:
-                    _iteratorNormalCompletion3 = true, _didIteratorError3 = false, _iteratorError3 = undefined;
-                    try {
-                        for(_iterator3 = sitesBySlug[Symbol.iterator](); !(_iteratorNormalCompletion3 = (_step3 = _iterator3.next()).done); _iteratorNormalCompletion3 = true){
-                            _step_value = _sliced_to_array$2(_step3.value, 2), slug = _step_value[0], sites = _step_value[1];
-                            specCount = 0;
-                            _iteratorNormalCompletion4 = true, _didIteratorError4 = false, _iteratorError4 = undefined;
-                            try {
-                                for(_iterator4 = sites[Symbol.iterator](); !(_iteratorNormalCompletion4 = (_step4 = _iterator4.next()).done); _iteratorNormalCompletion4 = true){
-                                    site = _step4.value;
-                                    if (site.isSpec) {
-                                        specCount += 1;
-                                    }
-                                }
-                            } catch (err) {
-                                _didIteratorError4 = true;
-                                _iteratorError4 = err;
-                            } finally{
-                                try {
-                                    if (!_iteratorNormalCompletion4 && _iterator4.return != null) {
-                                        _iterator4.return();
-                                    }
-                                } finally{
-                                    if (_didIteratorError4) {
-                                        throw _iteratorError4;
-                                    }
-                                }
-                            }
-                            result.set(slug, {
-                                count: sites.length,
-                                productionCount: sites.length - specCount,
-                                specCount: specCount,
-                                referencedBy: sites
-                            });
-                        }
-                    } catch (err) {
-                        _didIteratorError3 = true;
-                        _iteratorError3 = err;
-                    } finally{
-                        try {
-                            if (!_iteratorNormalCompletion3 && _iterator3.return != null) {
-                                _iterator3.return();
-                            }
-                        } finally{
-                            if (_didIteratorError3) {
-                                throw _iteratorError3;
-                            }
-                        }
-                    }
-                    _state.label = 10;
-                case 10:
+                case 8:
                     return [
                         2,
-                        result
+                        sitesBySlug
                     ];
             }
         });
     })();
 }
+/**
+ * Tallies one slug's reference sites into a {@link FactoryReferenceCount},
+ * splitting production callers from spec-only callers.
+ *
+ * @param sites - The reference sites found for one factory.
+ * @returns The total/production/spec counts plus the sites themselves.
+ */ function tallyReferenceSites(sites) {
+    var specCount = 0;
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = sites[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var site = _step.value;
+            if (site.isSpec) {
+                specCount += 1;
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return {
+        count: sites.length,
+        productionCount: sites.length - specCount,
+        specCount: specCount,
+        referencedBy: sites
+    };
+}
 /**
  * Returns true when the supplied workspace-relative subpath looks like a
  * Vitest/Jest spec file. The scanner uses this to tag each
@@ -43151,7 +43352,7 @@ function buildCombinedRegex(names) {
     return result;
 }
 function escapeRegex(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, String.raw(_templateObject()));
+    return value.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw(_templateObject()));
 }
 function computeLineOffsets(contents) {
     var offsets = [
@@ -51659,10 +51860,9 @@ function collectExternalCssUtilitySources(configResult) {
         try {
             for(var _iterator = ((_ref = cluster === null || cluster === void 0 ? void 0 : cluster.sources) !== null && _ref !== void 0 ? _ref : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                 var source = _step.value;
-                var absolute = node_path.isAbsolute(source) ? source : node_path.resolve(baseDir, source);
                 externalSources.push({
                     origin: 'external',
-                    path: absolute
+                    path: toAbsolutePath$1(baseDir, source)
                 });
             }
         } catch (err) {
@@ -51685,10 +51885,9 @@ function collectExternalCssUtilitySources(configResult) {
                 var scan = _step1.value;
                 var out = scan.out;
                 if (typeof out === 'string' && out.length > 0) {
-                    var absolute1 = node_path.isAbsolute(out) ? out : node_path.resolve(baseDir, out);
                     externalSources.push({
                         origin: 'external',
-                        path: absolute1
+                        path: toAbsolutePath$1(baseDir, out)
                     });
                 }
             }
@@ -51709,6 +51908,16 @@ function collectExternalCssUtilitySources(configResult) {
     }
     return externalSources;
 }
+/**
+ * Resolves `value` against `baseDir` when it is relative, leaving an
+ * already-absolute path untouched (so its original spelling is preserved).
+ *
+ * @param baseDir - Directory a relative `value` is resolved against.
+ * @param value - An absolute or relative path.
+ * @returns The absolute path.
+ */ function toAbsolutePath$1(baseDir, value) {
+    return node_path.isAbsolute(value) ? value : node_path.resolve(baseDir, value);
+}
 /**
  * Re-exported so callers can build a deterministic test fixture pointing
  * at the package's bundled manifests without touching `import.meta.url`.
@@ -55361,10 +55570,9 @@ function collectExternalTokenSources(configResult) {
         try {
             for(var _iterator = ((_ref = tokensCluster === null || tokensCluster === void 0 ? void 0 : tokensCluster.sources) !== null && _ref !== void 0 ? _ref : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                 var source = _step.value;
-                var absolute = node_path.isAbsolute(source) ? source : node_path.resolve(baseDir, source);
                 externalSources.push({
                     origin: 'external',
-                    path: absolute
+                    path: toAbsolutePath(baseDir, source)
                 });
             }
         } catch (err) {
@@ -55387,10 +55595,9 @@ function collectExternalTokenSources(configResult) {
                 var scan = _step1.value;
                 var out = scan.out;
                 if (typeof out === 'string' && out.length > 0) {
-                    var absolute1 = node_path.isAbsolute(out) ? out : node_path.resolve(baseDir, out);
                     externalSources.push({
                         origin: 'external',
-                        path: absolute1
+                        path: toAbsolutePath(baseDir, out)
                     });
                 }
             }
@@ -55411,6 +55618,16 @@ function collectExternalTokenSources(configResult) {
     }
     return externalSources;
 }
+/**
+ * Resolves `value` against `baseDir` when it is relative, leaving an
+ * already-absolute path untouched (so its original spelling is preserved).
+ *
+ * @param baseDir - Directory a relative `value` is resolved against.
+ * @param value - An absolute or relative path.
+ * @returns The absolute path.
+ */ function toAbsolutePath(baseDir, value) {
+    return node_path.isAbsolute(value) ? value : node_path.resolve(baseDir, value);
+}
 /**
  * Re-exported so callers can build a deterministic test fixture pointing at
  * the package's bundled manifests without touching `import.meta.url`.
@@ -56934,6 +57151,7 @@ exports.DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME = DBX_DOCS_UI_EXAMPLES_SCAN_CO
 exports.DBX_DOCS_UI_EXAMPLE_USE_KINDS = DBX_DOCS_UI_EXAMPLE_USE_KINDS;
 exports.DEFAULT_ACTIONS_SCAN_OUT_PATH = DEFAULT_ACTIONS_SCAN_OUT_PATH;
 exports.DEFAULT_ACTION_COMMAND_NAME = DEFAULT_ACTION_COMMAND_NAME;
+exports.DEFAULT_CLI_HTTP_TIMEOUT_MS = DEFAULT_CLI_HTTP_TIMEOUT_MS;
 exports.DEFAULT_CLI_OIDC_SCOPES = DEFAULT_CLI_OIDC_SCOPES;
 exports.DEFAULT_CLI_REDIRECT_URI = DEFAULT_CLI_REDIRECT_URI;
 exports.DEFAULT_CLI_SECRET_PATTERNS = DEFAULT_CLI_SECRET_PATTERNS;