@dereekb/dbx-cli 13.14.0 → 13.16.0

package/index.esm.js

@@ -349,11 +349,17 @@ function _ts_generator$1f(thisArg, body) {
     /client_secret[=:]\s*\S+/gi,
     /id_token[=:]\s*\S+/gi
 ];
+/**
+ * Default per-request HTTP timeout in milliseconds, applied when no explicit `--timeout` is set.
+ *
+ * Without a default, the HTTP layer's `fetch` waits indefinitely on an unresponsive server, which
+ * surfaces as a CLI (or CI test) that hangs forever rather than failing with a clear error.
+ */ var DEFAULT_CLI_HTTP_TIMEOUT_MS = 60000;
 var _outputOptions = {};
 var _secretPatterns = _to_consumable_array$Z(DEFAULT_CLI_SECRET_PATTERNS);
 var _errorMapper;
 var _verbose = false;
-var _timeoutMs;
+var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
 /**
  * Configures output options from parsed CLI arguments.
  *
@@ -408,7 +414,8 @@ var _timeoutMs;
  * @returns The fetch Response.
  */ function tracedFetch(fetcher, input, init) {
     return _async_to_generator$1f(function() {
-        var _ref, fetchImpl, timeoutMs, method, url, controller, timeoutHandle, finalInit, localController, e;
+        var _ref, fetchImpl, timeoutMs, method, url, controller, timeoutHandle, finalInit, // Don't let the abort timer itself keep the Node event loop (or a test worker) alive.
+        _timeoutHandle_unref, localController, e;
         return _ts_generator$1f(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -424,12 +431,13 @@ var _timeoutMs;
                     }
                     verboseLog("".concat(method, " ").concat(url));
                     finalInit = init;
-                    if (timeoutMs != null && (init === null || init === void 0 ? void 0 : init.signal) == null) {
+                    if (timeoutMs != null && timeoutMs > 0 && (init === null || init === void 0 ? void 0 : init.signal) == null) {
                         localController = new AbortController();
                         controller = localController;
                         timeoutHandle = setTimeout(function() {
                             return localController.abort();
                         }, timeoutMs);
+                        (_timeoutHandle_unref = timeoutHandle.unref) === null || _timeoutHandle_unref === void 0 ? void 0 : _timeoutHandle_unref.call(timeoutHandle);
                         finalInit = _object_spread_props$t(_object_spread$L({}, init), {
                             signal: localController.signal
                         });
@@ -476,12 +484,13 @@ var _timeoutMs;
 /**
  * Sets the process-wide HTTP timeout (in milliseconds) honored by the HTTP layer.
  *
- * Pass `undefined` to clear. The HTTP helpers thread this into an `AbortController`
- * so individual `fetch` calls cancel after the configured duration.
+ * The HTTP helpers thread a positive value into an `AbortController` so individual `fetch` calls
+ * cancel after the configured duration. `undefined` falls back to {@link DEFAULT_CLI_HTTP_TIMEOUT_MS};
+ * `0` (or a negative value) disables the timeout entirely (the request waits indefinitely).
  *
- * @param ms - Timeout in ms, or `undefined` to clear.
+ * @param ms - Timeout in ms, `0`/negative to disable, or `undefined` to fall back to the default.
  */ function setCliTimeoutMs(ms) {
-    _timeoutMs = ms;
+    _timeoutMs = ms === undefined ? DEFAULT_CLI_HTTP_TIMEOUT_MS : ms;
 }
 /**
  * @returns The current process-wide HTTP timeout in ms, or `undefined` when unset.
@@ -7053,11 +7062,11 @@ function resolveAuthSetupPrompt(input) {
                                 tokenType: tokenResponse.token_type,
                                 scope: tokenResponse.scope,
                                 expiresAt: expiresAt
-                            }, sessionExpiresAt != null ? {
+                            }, sessionExpiresAt == null ? {} : {
                                 sessionExpiresAt: sessionExpiresAt
-                            } : {}, rotationDisabled != null ? {
+                            }, rotationDisabled == null ? {} : {
                                 rotationDisabled: rotationDisabled
-                            } : {});
+                            });
                             return [
                                 4,
                                 tokens.set(envName, entry)
@@ -9277,14 +9286,15 @@ function _ts_generator$_(thisArg, body) {
     });
     return function(argv) {
         return _async_to_generator$_(function() {
-            var _argv__, command, _ref, _ref1, envName, env, entry, _readEnvTokenEntry, _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _refreshed_expires_in, meta, suppliedRefreshToken, refreshed, e;
+            var _argv__, command, _ref, envName, env, entry, e;
             return _ts_generator$_(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         // Configure verbose/timeout as early as possible so HTTP calls made from this very
                         // middleware (OIDC discovery + token refresh) honor the flags.
                         setCliVerbose(Boolean(argv.verbose));
-                        setCliTimeoutMs(typeof argv.timeout === 'number' && argv.timeout > 0 ? argv.timeout * 1000 : undefined);
+                        // No `--timeout` flag → undefined → the default timeout applies. `--timeout 0` disables it.
+                        setCliTimeoutMs(typeof argv.timeout === 'number' ? argv.timeout * 1000 : undefined);
                         command = (_argv__ = argv._) === null || _argv__ === void 0 ? void 0 : _argv__[0];
                         if (typeof command === 'string' && input.skipCommands.has(command)) {
                             return [
@@ -9295,9 +9305,9 @@ function _ts_generator$_(thisArg, body) {
                     case 1:
                         _state.trys.push([
                             1,
-                            9,
+                            4,
                             ,
-                            10
+                            5
                         ]);
                         return [
                             4,
@@ -9310,86 +9320,18 @@ function _ts_generator$_(thisArg, body) {
                             })
                         ];
                     case 2:
-                        _ref1 = _state.sent(), envName = _ref1.envName, env = _ref1.env;
+                        _ref = _state.sent(), envName = _ref.envName, env = _ref.env;
                         return [
                             4,
-                            tokens.get(envName)
-                        ];
-                    case 3:
-                        entry = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : undefined;
-                        if (!entry) {
-                            entry = (_readEnvTokenEntry = readEnvTokenEntry({
-                                cliName: input.cliName
-                            })) !== null && _readEnvTokenEntry !== void 0 ? _readEnvTokenEntry : undefined;
-                        }
-                        if (!(entry === null || entry === void 0 ? void 0 : entry.accessToken) && !(entry === null || entry === void 0 ? void 0 : entry.refreshToken)) {
-                            throw new CliError({
-                                message: 'No tokens for env "'.concat(envName, '". Run `').concat(input.cliName, " auth login --env ").concat(envName, "`."),
-                                code: 'NOT_LOGGED_IN'
-                            });
-                        }
-                        if (!(!entry.accessToken || isTokenExpired(entry))) return [
-                            3,
-                            8
-                        ];
-                        if (!entry.refreshToken) {
-                            throw new CliError({
-                                message: 'Token for env "'.concat(envName, '" is expired and no refresh token is cached. Re-login.'),
-                                code: 'TOKEN_EXPIRED',
-                                suggestion: "Run `".concat(input.cliName, " auth login --env ").concat(envName, "`.")
-                            });
-                        }
-                        return [
-                            4,
-                            discoverOidcMetadata({
-                                issuer: env.oidcIssuer,
-                                fallbackBaseUrl: env.apiBaseUrl
-                            })
-                        ];
-                    case 4:
-                        meta = _state.sent();
-                        suppliedRefreshToken = entry.refreshToken;
-                        return [
-                            4,
-                            refreshAccessToken({
-                                tokenEndpoint: meta.token_endpoint,
-                                clientId: env.clientId,
-                                clientSecret: env.clientSecret,
-                                refreshToken: suppliedRefreshToken
+                            resolveAccessTokenEntry({
+                                cliName: input.cliName,
+                                envName: envName,
+                                env: env,
+                                tokens: tokens
                             })
                         ];
-                    case 5:
-                        refreshed = _state.sent();
-                        entry = _object_spread_props$l(_object_spread$A({}, entry), {
-                            accessToken: refreshed.access_token,
-                            refreshToken: (_refreshed_refresh_token = refreshed.refresh_token) !== null && _refreshed_refresh_token !== void 0 ? _refreshed_refresh_token : entry.refreshToken,
-                            tokenType: (_refreshed_token_type = refreshed.token_type) !== null && _refreshed_token_type !== void 0 ? _refreshed_token_type : entry.tokenType,
-                            scope: (_refreshed_scope = refreshed.scope) !== null && _refreshed_scope !== void 0 ? _refreshed_scope : entry.scope,
-                            expiresAt: Date.now() + ((_refreshed_expires_in = refreshed.expires_in) !== null && _refreshed_expires_in !== void 0 ? _refreshed_expires_in : 0) * 1000
-                        });
-                        if (!entry.fromEnv) return [
-                            3,
-                            6
-                        ];
-                        // Service tokens do not rotate, so a one-shot env-sourced invocation is durable without
-                        // persisting. If a *rotating* refresh token was supplied, the rotation is lost on exit —
-                        // warn that env credentials should be non-rotating service tokens.
-                        if (refreshed.refresh_token != null && refreshed.refresh_token !== suppliedRefreshToken) {
-                            process.stderr.write('Warning: the refresh token supplied via environment rotated on use; the rotated token cannot be persisted for a one-shot invocation. Use a non-rotating service token (auth login --service-token).\n');
-                        }
-                        return [
-                            3,
-                            8
-                        ];
-                    case 6:
-                        return [
-                            4,
-                            tokens.set(envName, entry)
-                        ];
-                    case 7:
-                        _state.sent();
-                        _state.label = 8;
-                    case 8:
+                    case 3:
+                        entry = _state.sent();
                         setCliContext(createCliContext({
                             cliName: input.cliName,
                             envName: envName,
@@ -9399,17 +9341,17 @@ function _ts_generator$_(thisArg, body) {
                         }));
                         return [
                             3,
-                            10
+                            5
                         ];
-                    case 9:
+                    case 4:
                         e = _state.sent();
                         outputError(e);
                         process.exit(CLI_EXIT_CODE_AUTH);
                         return [
                             3,
-                            10
+                            5
                         ];
-                    case 10:
+                    case 5:
                         return [
                             2
                         ];
@@ -9418,6 +9360,146 @@ function _ts_generator$_(thisArg, body) {
         })();
     };
 }
+/**
+ * Resolves the access-token entry for an env: prefers the cached token, falls
+ * back to an env-supplied token, requires at least one token to be present,
+ * and refreshes when the access token is missing or expired.
+ *
+ * @param input - The CLI name, resolved env, env name, and token cache store.
+ * @returns The resolved (and refreshed when necessary) token entry.
+ * @throws {CliError} When no tokens are available for the env.
+ */ function resolveAccessTokenEntry(input) {
+    return _async_to_generator$_(function() {
+        var _ref, cliName, envName, env, tokens, entry, _readEnvTokenEntry;
+        return _ts_generator$_(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    cliName = input.cliName, envName = input.envName, env = input.env, tokens = input.tokens;
+                    return [
+                        4,
+                        tokens.get(envName)
+                    ];
+                case 1:
+                    entry = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : undefined;
+                    if (!entry) {
+                        entry = (_readEnvTokenEntry = readEnvTokenEntry({
+                            cliName: cliName
+                        })) !== null && _readEnvTokenEntry !== void 0 ? _readEnvTokenEntry : undefined;
+                    }
+                    if (!(entry === null || entry === void 0 ? void 0 : entry.accessToken) && !(entry === null || entry === void 0 ? void 0 : entry.refreshToken)) {
+                        throw new CliError({
+                            message: 'No tokens for env "'.concat(envName, '". Run `').concat(cliName, " auth login --env ").concat(envName, "`."),
+                            code: 'NOT_LOGGED_IN'
+                        });
+                    }
+                    if (!(!entry.accessToken || isTokenExpired(entry))) return [
+                        3,
+                        3
+                    ];
+                    return [
+                        4,
+                        refreshTokenEntry({
+                            cliName: cliName,
+                            envName: envName,
+                            env: env,
+                            tokens: tokens,
+                            entry: entry
+                        })
+                    ];
+                case 2:
+                    entry = _state.sent();
+                    _state.label = 3;
+                case 3:
+                    return [
+                        2,
+                        entry
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Refreshes an absent/expired access token via OIDC. Cache-sourced entries are
+ * persisted; env-sourced service tokens are durable for the one-shot
+ * invocation and not written back (and a rotated env refresh token is warned
+ * about, since it cannot be persisted).
+ *
+ * @param input - The CLI name, env, env name, token store, and the entry to refresh.
+ * @returns The refreshed token entry.
+ * @throws {CliError} When the entry is expired and has no refresh token.
+ */ function refreshTokenEntry(input) {
+    return _async_to_generator$_(function() {
+        var _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _refreshed_expires_in, cliName, envName, env, tokens, entry, meta, suppliedRefreshToken, refreshed, updated;
+        return _ts_generator$_(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    cliName = input.cliName, envName = input.envName, env = input.env, tokens = input.tokens, entry = input.entry;
+                    if (!entry.refreshToken) {
+                        throw new CliError({
+                            message: 'Token for env "'.concat(envName, '" is expired and no refresh token is cached. Re-login.'),
+                            code: 'TOKEN_EXPIRED',
+                            suggestion: "Run `".concat(cliName, " auth login --env ").concat(envName, "`.")
+                        });
+                    }
+                    return [
+                        4,
+                        discoverOidcMetadata({
+                            issuer: env.oidcIssuer,
+                            fallbackBaseUrl: env.apiBaseUrl
+                        })
+                    ];
+                case 1:
+                    meta = _state.sent();
+                    suppliedRefreshToken = entry.refreshToken;
+                    return [
+                        4,
+                        refreshAccessToken({
+                            tokenEndpoint: meta.token_endpoint,
+                            clientId: env.clientId,
+                            clientSecret: env.clientSecret,
+                            refreshToken: suppliedRefreshToken
+                        })
+                    ];
+                case 2:
+                    refreshed = _state.sent();
+                    updated = _object_spread_props$l(_object_spread$A({}, entry), {
+                        accessToken: refreshed.access_token,
+                        refreshToken: (_refreshed_refresh_token = refreshed.refresh_token) !== null && _refreshed_refresh_token !== void 0 ? _refreshed_refresh_token : entry.refreshToken,
+                        tokenType: (_refreshed_token_type = refreshed.token_type) !== null && _refreshed_token_type !== void 0 ? _refreshed_token_type : entry.tokenType,
+                        scope: (_refreshed_scope = refreshed.scope) !== null && _refreshed_scope !== void 0 ? _refreshed_scope : entry.scope,
+                        expiresAt: Date.now() + ((_refreshed_expires_in = refreshed.expires_in) !== null && _refreshed_expires_in !== void 0 ? _refreshed_expires_in : 0) * 1000
+                    });
+                    if (!updated.fromEnv) return [
+                        3,
+                        3
+                    ];
+                    // Service tokens do not rotate, so a one-shot env-sourced invocation is durable without
+                    // persisting. If a *rotating* refresh token was supplied, the rotation is lost on exit —
+                    // warn that env credentials should be non-rotating service tokens.
+                    if (refreshed.refresh_token != null && refreshed.refresh_token !== suppliedRefreshToken) {
+                        process.stderr.write('Warning: the refresh token supplied via environment rotated on use; the rotated token cannot be persisted for a one-shot invocation. Use a non-rotating service token (auth login --service-token).\n');
+                    }
+                    return [
+                        3,
+                        5
+                    ];
+                case 3:
+                    return [
+                        4,
+                        tokens.set(envName, updated)
+                    ];
+                case 4:
+                    _state.sent();
+                    _state.label = 5;
+                case 5:
+                    return [
+                        2,
+                        updated
+                    ];
+            }
+        });
+    })();
+}
 /**
  * Test-only middleware that skips OIDC discovery, disk token loading, and token refresh, attaching
  * a pre-built {@link CliContext} directly via {@link setCliContext}.
@@ -9670,7 +9752,8 @@ function _ts_generator$Z(thisArg, body) {
                         // (auth, env, doctor, output) — which bypass the auth middleware via skipCommands —
                         // still respect `--verbose` and `--timeout`.
                         setCliVerbose(Boolean(argv.verbose));
-                        setCliTimeoutMs(typeof argv.timeout === 'number' && argv.timeout > 0 ? argv.timeout * 1000 : undefined);
+                        // No `--timeout` flag → undefined → the default timeout applies. `--timeout 0` disables it.
+                        setCliTimeoutMs(typeof argv.timeout === 'number' ? argv.timeout * 1000 : undefined);
                         commandPath = argv._ ? argv._.map(String) : [];
                         topCommand = commandPath[0];
                         setDumpDir = argv.setDumpDir;
@@ -10448,7 +10531,7 @@ function _ts_generator$X(thisArg, body) {
     }).option('timeout', {
         type: 'number',
         global: true,
-        describe: 'Per-HTTP-request timeout in seconds (aborts via AbortController)'
+        describe: 'Per-HTTP-request timeout in seconds (default 60; 0 disables; aborts via AbortController)'
     }).option('data-help', {
         type: 'string',
         choices: [
@@ -11269,6 +11352,7 @@ function hideGlobalOptions(yargs, names) {
  * @returns Multi-section epilogue string, or `undefined` when the entry has no
  *   metadata worth surfacing.
  */ function buildEntryEpilogue(entry, context) {
+    var _sections, _sections1;
     var dataHelpFormat = context.dataHelpFormat, helpMode = context.helpMode;
     var showAction = helpMode === 'action' || helpMode === 'both';
     var showParams = helpMode === 'params' || helpMode === 'both';
@@ -11277,31 +11361,67 @@ function hideGlobalOptions(yargs, names) {
         var actionSection = buildActionSection(entry);
         if (actionSection) sections.push(actionSection);
     }
-    var schemaSections = [];
-    if (showParams) {
-        var _sections;
-        var paramsSection = buildParamsSection(entry);
-        if (paramsSection) sections.push(paramsSection);
-        schemaSections = renderParamsSchemaSections(entry, dataHelpFormat);
-        (_sections = sections).push.apply(_sections, _to_consumable_array$P(schemaSections));
-        var resultSection = buildResultSection(entry);
-        if (resultSection) {
-            sections.push(resultSection);
-        } else if (entry.resultTypeName) {
-            sections.push("Result: ".concat(entry.resultTypeName));
-        }
-    }
+    var params = showParams ? collectParamsSections(entry, dataHelpFormat) : {
+        sections: [],
+        schemaCount: 0
+    };
+    (_sections = sections).push.apply(_sections, _to_consumable_array$P(params.sections));
     if (entry.sourceFile) {
         sections.push("Source: ".concat(entry.sourceFile));
     }
-    if (showParams && schemaSections.length > 0 && dataHelpFormat !== 'both') {
+    (_sections1 = sections).push.apply(_sections1, _to_consumable_array$P(collectHelpHints({
+        entry: entry,
+        helpMode: helpMode,
+        dataHelpFormat: dataHelpFormat,
+        showParams: showParams,
+        schemaCount: params.schemaCount
+    })));
+    return sections.length > 0 ? sections.join('\n\n') : undefined;
+}
+/**
+ * Collects the params-side help sections (params interface, schema renders,
+ * result) for an entry, reporting how many schema sections were produced so
+ * the caller can decide whether to surface the schema-format hint.
+ *
+ * @param entry - The manifest entry being documented.
+ * @param dataHelpFormat - The requested schema render format.
+ * @returns The ordered sections and the number of schema sections produced.
+ */ function collectParamsSections(entry, dataHelpFormat) {
+    var _sections;
+    var sections = [];
+    var paramsSection = buildParamsSection(entry);
+    if (paramsSection) sections.push(paramsSection);
+    var schemaSections = renderParamsSchemaSections(entry, dataHelpFormat);
+    (_sections = sections).push.apply(_sections, _to_consumable_array$P(schemaSections));
+    var resultSection = buildResultSection(entry);
+    if (resultSection) {
+        sections.push(resultSection);
+    } else if (entry.resultTypeName) {
+        sections.push("Result: ".concat(entry.resultTypeName));
+    }
+    return {
+        sections: sections,
+        schemaCount: schemaSections.length
+    };
+}
+/**
+ * Builds the trailing `--help` hint lines: how to switch the schema format,
+ * and (in `both` mode, when there is something to focus on) how to narrow the
+ * help to a single section.
+ *
+ * @param input - The entry, help mode, schema format, params visibility, and schema-section count.
+ * @returns The hint lines (possibly empty).
+ */ function collectHelpHints(input) {
+    var entry = input.entry, helpMode = input.helpMode, dataHelpFormat = input.dataHelpFormat, showParams = input.showParams, schemaCount = input.schemaCount;
+    var hints = [];
+    if (showParams && schemaCount > 0 && dataHelpFormat !== 'both') {
         var other = dataHelpFormat === 'jsonschema' ? 'arktype' : 'jsonschema';
-        sections.push("(Pass --data-help=".concat(other, " or --data-help=both to switch the schema format above.)"));
+        hints.push("(Pass --data-help=".concat(other, " or --data-help=both to switch the schema format above.)"));
     }
     if (helpMode === 'both' && (entry.description || entry.paramsTypeDescription || entry.paramsFields && entry.paramsFields.length > 0)) {
-        sections.push("(Pass --help-mode=action or --help-mode=params to focus this help on a single section.)");
+        hints.push("(Pass --help-mode=action or --help-mode=params to focus this help on a single section.)");
     }
-    return sections.length > 0 ? sections.join('\n\n') : undefined;
+    return hints;
 }
 function buildActionSection(entry) {
     return entry.description ? "About:\n".concat(indentLines(entry.description, '  ')) : undefined;
@@ -11317,31 +11437,8 @@ function buildParamsSection(entry) {
             lines.push(indentLines(entry.paramsTypeDescription, '  '));
         }
         if (entry.paramsFields && entry.paramsFields.length > 0) {
-            lines.push('', 'Fields:');
-            var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-            try {
-                for(var _iterator = entry.paramsFields[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                    var field = _step.value;
-                    var header = "  - ".concat(field.name, ": ").concat(field.typeText);
-                    lines.push(header);
-                    if (field.description) {
-                        lines.push(indentLines(field.description, '      '));
-                    }
-                }
-            } catch (err) {
-                _didIteratorError = true;
-                _iteratorError = err;
-            } finally{
-                try {
-                    if (!_iteratorNormalCompletion && _iterator.return != null) {
-                        _iterator.return();
-                    }
-                } finally{
-                    if (_didIteratorError) {
-                        throw _iteratorError;
-                    }
-                }
-            }
+            var _lines;
+            (_lines = lines).push.apply(_lines, _to_consumable_array$P(buildFieldLines(entry.paramsFields)));
         }
         result = lines.join('\n');
     }
@@ -11358,36 +11455,49 @@ function buildResultSection(entry) {
             lines.push(indentLines(entry.resultTypeDescription, '  '));
         }
         if (entry.resultFields && entry.resultFields.length > 0) {
-            lines.push('', 'Fields:');
-            var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-            try {
-                for(var _iterator = entry.resultFields[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                    var field = _step.value;
-                    var header = "  - ".concat(field.name, ": ").concat(field.typeText);
-                    lines.push(header);
-                    if (field.description) {
-                        lines.push(indentLines(field.description, '      '));
-                    }
-                }
-            } catch (err) {
-                _didIteratorError = true;
-                _iteratorError = err;
-            } finally{
-                try {
-                    if (!_iteratorNormalCompletion && _iterator.return != null) {
-                        _iterator.return();
-                    }
-                } finally{
-                    if (_didIteratorError) {
-                        throw _iteratorError;
-                    }
-                }
-            }
+            var _lines;
+            (_lines = lines).push.apply(_lines, _to_consumable_array$P(buildFieldLines(entry.resultFields)));
         }
         result = lines.join('\n');
     }
     return result;
 }
+/**
+ * Renders the `Fields:` block shared by the params and result help sections —
+ * one `- name: type` header per field, with its indented description below.
+ *
+ * @param fields - The manifest fields to render.
+ * @returns The lines for the fields block, beginning with a blank line and the `Fields:` header.
+ */ function buildFieldLines(fields) {
+    var lines = [
+        '',
+        'Fields:'
+    ];
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = fields[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var field = _step.value;
+            lines.push("  - ".concat(field.name, ": ").concat(field.typeText));
+            if (field.description) {
+                lines.push(indentLines(field.description, '      '));
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return lines;
+}
 function indentLines(text, indent) {
     return text.split('\n').map(function(line) {
         return "".concat(indent).concat(line);
@@ -11396,25 +11506,38 @@ function indentLines(text, indent) {
 function renderParamsSchemaSections(entry, dataHelpFormat) {
     var sections = [];
     if (entry.paramsValidator) {
-        if (dataHelpFormat === 'jsonschema' || dataHelpFormat === 'both') {
-            var jsonSchemaSection = renderJsonSchemaSection(entry);
-            if (jsonSchemaSection) {
-                sections.push(jsonSchemaSection);
-            }
+        sections = collectSchemaSections(entry, dataHelpFormat);
+    }
+    return sections;
+}
+/**
+ * Renders the requested params-schema sections (JSON Schema and/or arktype),
+ * with a last-ditch arktype-expression fallback when the requested format
+ * produced nothing usable. Assumes the entry has a bound params validator.
+ *
+ * @param entry - The manifest entry whose params validator is rendered.
+ * @param dataHelpFormat - The requested schema render format.
+ * @returns The rendered schema sections (possibly empty).
+ */ function collectSchemaSections(entry, dataHelpFormat) {
+    var sections = [];
+    if (dataHelpFormat === 'jsonschema' || dataHelpFormat === 'both') {
+        var jsonSchemaSection = renderJsonSchemaSection(entry);
+        if (jsonSchemaSection) {
+            sections.push(jsonSchemaSection);
         }
-        if (dataHelpFormat === 'arktype' || dataHelpFormat === 'both') {
-            var arktypeSection = renderArktypeExpressionSection(entry);
-            if (arktypeSection) {
-                sections.push(arktypeSection);
-            }
+    }
+    if (dataHelpFormat === 'arktype' || dataHelpFormat === 'both') {
+        var arktypeSection = renderArktypeExpressionSection(entry);
+        if (arktypeSection) {
+            sections.push(arktypeSection);
         }
-        if (sections.length === 0) {
-            // Last-ditch fallback when the requested format produced nothing usable
-            // (e.g. arktype was requested but the bound validator has no expression).
-            var expression = readArktypeExpression(entry);
-            if (expression) {
-                sections.push("Params Schema (arktype): ".concat(expression));
-            }
+    }
+    if (sections.length === 0) {
+        // Last-ditch fallback when the requested format produced nothing usable
+        // (e.g. arktype was requested but the bound validator has no expression).
+        var expression = readArktypeExpression(entry);
+        if (expression) {
+            sections.push("Params Schema (arktype): ".concat(expression));
         }
     }
     return sections;
@@ -19788,28 +19911,50 @@ function buildModelEntry(args) {
         sourceFile: input.sourceFile,
         fields: fields,
         enums: relevantEnums.map(function(e) {
-            return _object_spread$u({
-                name: e.name,
-                values: e.values.map(function(v) {
-                    return v.description ? {
-                        name: v.name,
-                        value: v.value,
-                        description: v.description
-                    } : {
-                        name: v.name,
-                        value: v.value
-                    };
-                })
-            }, e.description ? {
-                description: e.description
-            } : {});
+            return buildModelEnumEntry(e);
         }),
         detectionHints: detectionHints
     }), groupName ? {
         modelGroup: groupName
     } : {}, collectionKind ? {
         collectionKind: collectionKind
-    } : {}, markers.userKeyedById ? {
+    } : {}, buildModelMarkerFlags(markers), buildModelArchetypeFields(archetypeInfo), compositeKey ? {
+        compositeKey: compositeKey
+    } : {}, iface.tags.dbxModelRead ? {
+        read: iface.tags.dbxModelRead
+    } : {});
+}
+/**
+ * Projects one extracted enum into the manifest enum shape, omitting empty
+ * value/enum descriptions.
+ *
+ * @param e - The extracted enum.
+ * @returns The manifest enum entry.
+ */ function buildModelEnumEntry(e) {
+    return _object_spread$u({
+        name: e.name,
+        values: e.values.map(function(v) {
+            return v.description ? {
+                name: v.name,
+                value: v.value,
+                description: v.description
+            } : {
+                name: v.name,
+                value: v.value
+            };
+        })
+    }, e.description ? {
+        description: e.description
+    } : {});
+}
+/**
+ * Builds the optional keyed-by/aggregation marker flags portion of a model
+ * entry, including each flag only when set.
+ *
+ * @param markers - The computed marker flags.
+ * @returns A partial model entry with only the active marker fields.
+ */ function buildModelMarkerFlags(markers) {
+    return _object_spread$u({}, markers.userKeyedById ? {
         userKeyedById: true
     } : {}, markers.hasUserUidField ? {
         hasUserUidField: true
@@ -19825,14 +19970,19 @@ function buildModelEntry(args) {
         organizationalGroupRoot: true
     } : {}, markers.aggregatesFromNonEmpty ? {
         aggregatesFrom: markers.aggregatesFrom
-    } : {}, archetypeInfo.archetypes.length > 0 ? {
+    } : {});
+}
+/**
+ * Builds the optional archetype portion of a model entry, including the
+ * archetype list and per-slug axes only when present.
+ *
+ * @param archetypeInfo - The computed archetype info.
+ * @returns A partial model entry with only the present archetype fields.
+ */ function buildModelArchetypeFields(archetypeInfo) {
+    return _object_spread$u({}, archetypeInfo.archetypes.length > 0 ? {
         archetypes: archetypeInfo.archetypes
     } : {}, archetypeInfo.archetypeAxesBySlug ? {
         archetypeAxesBySlug: archetypeInfo.archetypeAxesBySlug
-    } : {}, compositeKey ? {
-        compositeKey: compositeKey
-    } : {}, iface.tags.dbxModelRead ? {
-        read: iface.tags.dbxModelRead
     } : {});
 }
 function filterRelevantEnums(fields, enums) {
@@ -20882,25 +21032,8 @@ var COMPOSITE_KEY_MODEL_NAME_RE = /^[A-Za-z][A-Za-z0-9_$]*$/;
             var key = token.slice(0, eq).trim();
             var v = token.slice(eq + 1).trim();
             if (key === 'from') {
-                if (v === '*') {
-                    fromValue = '*';
-                } else if (v.length > 0) {
-                    // Tolerate the wildcard mixed with concrete entries here; the
-                    // validator emits MODEL_COMPOSITE_KEY_WILDCARD_MIXED when it sees both.
-                    var parts = v.split(',').map(function(p) {
-                        return p.trim();
-                    }).filter(function(p) {
-                        return p.length > 0;
-                    });
-                    if (parts.includes('*')) {
-                        // Preserve the literal list so the validator can flag the mix.
-                        fromValue = parts;
-                    } else {
-                        fromValue = parts.filter(function(p) {
-                            return COMPOSITE_KEY_MODEL_NAME_RE.test(p);
-                        });
-                    }
-                }
+                var parsedFrom = parseCompositeKeyFromValue(v);
+                if (parsedFrom !== undefined) fromValue = parsedFrom;
             } else if (key === 'encoding' && (v === 'two-way' || v === 'one-way')) encoding = v;
         }
     } catch (err) {
@@ -20922,6 +21055,32 @@ var COMPOSITE_KEY_MODEL_NAME_RE = /^[A-Za-z][A-Za-z0-9_$]*$/;
         encoding: encoding
     };
 }
+/**
+ * Parses the `from=` value of a `@dbxModelCompositeKey` tag into the wildcard
+ * `'*'` or a concrete model-name list. Returns `undefined` for an empty value
+ * so the caller leaves any previously-parsed `from` untouched.
+ *
+ * @param v - The raw text after `from=`.
+ * @returns `'*'`, the parsed model-name list, or `undefined` when the value is empty.
+ */ function parseCompositeKeyFromValue(v) {
+    var result;
+    if (v === '*') {
+        result = '*';
+    } else if (v.length > 0) {
+        // Tolerate the wildcard mixed with concrete entries here; the validator
+        // emits MODEL_COMPOSITE_KEY_WILDCARD_MIXED when it sees both.
+        var parts = v.split(',').map(function(p) {
+            return p.trim();
+        }).filter(function(p) {
+            return p.length > 0;
+        });
+        // Preserve the literal list (incl. `*`) so the validator can flag the mix.
+        result = parts.includes('*') ? parts : parts.filter(function(p) {
+            return COMPOSITE_KEY_MODEL_NAME_RE.test(p);
+        });
+    }
+    return result;
+}
 function takeFirstTagText(current, tag) {
     var _tag_getCommentText;
     if (current !== undefined) return current;
@@ -30963,14 +31122,7 @@ var EMPTY_ROLE_CONST_RESOLUTION = {
  */ function resolveRoleConstByName(name, ctx) {
     var result;
     var scalar = ctx.knownRoles.get(name);
-    if (scalar !== undefined) {
-        result = {
-            roles: [
-                scalar
-            ],
-            unresolved: []
-        };
-    } else {
+    if (scalar === undefined) {
         var arrayExpr = ctx.localArrayRoles.get(name);
         if (arrayExpr === undefined) {
             result = {
@@ -30988,6 +31140,13 @@ var EMPTY_ROLE_CONST_RESOLUTION = {
                 seen: nextSeen
             }));
         }
+    } else {
+        result = {
+            roles: [
+                scalar
+            ],
+            unresolved: []
+        };
     }
     return result;
 }
@@ -42792,7 +42951,7 @@ var DEFAULT_EXCLUDE = [
  * @returns Map keyed by entry slug → reference count + locations.
  */ function scanFactoryReferences(input) {
     return _async_to_generator$z(function() {
-        var projectRoot, entries, _input_include, include, _input_exclude, exclude, _input_readFile, readFile, _input_globber, globber, result, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, entry, namesBySlug, declFilePathsBySlug, declFilePaths, filePaths, combinedPattern, sitesBySlug, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, entry1, _iteratorNormalCompletion2, _didIteratorError2, _iteratorError2, _iterator2, _step2, relPath, absolutePath, err, _iteratorNormalCompletion3, _didIteratorError3, _iteratorError3, _iterator3, _step3, _step_value, slug, sites, specCount, _iteratorNormalCompletion4, _didIteratorError4, _iteratorError4, _iterator4, _step4, site;
+        var projectRoot, entries, _input_include, include, _input_exclude, exclude, _input_readFile, readFile, _input_globber, globber, result, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, entry, namesBySlug, declFilePathsBySlug, declFilePaths, filePaths, combinedPattern, sitesBySlug, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, _step_value, slug, sites;
         return _ts_generator$z(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -42825,7 +42984,7 @@ var DEFAULT_EXCLUDE = [
                     }
                     if (!(entries.length > 0)) return [
                         3,
-                        10
+                        3
                     ];
                     namesBySlug = buildNameLookup(entries);
                     declFilePathsBySlug = buildDeclFilePathLookup(entries);
@@ -42843,14 +43002,27 @@ var DEFAULT_EXCLUDE = [
                     combinedPattern = buildCombinedRegex(Array.from(namesBySlug.values()));
                     if (!(combinedPattern !== undefined)) return [
                         3,
-                        10
+                        3
                     ];
-                    sitesBySlug = new Map();
+                    return [
+                        4,
+                        collectReferenceSites({
+                            entries: entries,
+                            filePaths: filePaths,
+                            projectRoot: projectRoot,
+                            declFilePaths: declFilePaths,
+                            readFile: readFile,
+                            combinedPattern: combinedPattern,
+                            namesBySlug: namesBySlug
+                        })
+                    ];
+                case 2:
+                    sitesBySlug = _state.sent();
                     _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                     try {
-                        for(_iterator1 = entries[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                            entry1 = _step1.value;
-                            sitesBySlug.set(entry1.slug, []);
+                        for(_iterator1 = sitesBySlug[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                            _step_value = _sliced_to_array$2(_step1.value, 2), slug = _step_value[0], sites = _step_value[1];
+                            result.set(slug, tallyReferenceSites(sites));
                         }
                     } catch (err) {
                         _didIteratorError1 = true;
@@ -42866,30 +43038,72 @@ var DEFAULT_EXCLUDE = [
                             }
                         }
                     }
-                    _iteratorNormalCompletion2 = true, _didIteratorError2 = false, _iteratorError2 = undefined;
-                    _state.label = 2;
-                case 2:
-                    _state.trys.push([
+                    _state.label = 3;
+                case 3:
+                    return [
                         2,
+                        result
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Seeds an empty site list per entry slug, then scans every non-declaration
+ * file for factory references, accumulating the hits per slug.
+ *
+ * @param input - The entries, globbed file paths, project root, declaration-file guard set, reader, combined pattern, and name lookup.
+ * @returns The reference sites discovered, keyed by entry slug.
+ */ function collectReferenceSites(input) {
+    return _async_to_generator$z(function() {
+        var entries, filePaths, projectRoot, declFilePaths, readFile, combinedPattern, namesBySlug, sitesBySlug, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, entry, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, relPath, absolutePath, err;
+        return _ts_generator$z(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    entries = input.entries, filePaths = input.filePaths, projectRoot = input.projectRoot, declFilePaths = input.declFilePaths, readFile = input.readFile, combinedPattern = input.combinedPattern, namesBySlug = input.namesBySlug;
+                    sitesBySlug = new Map();
+                    _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                    try {
+                        for(_iterator = entries[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                            entry = _step.value;
+                            sitesBySlug.set(entry.slug, []);
+                        }
+                    } catch (err) {
+                        _didIteratorError = true;
+                        _iteratorError = err;
+                    } finally{
+                        try {
+                            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                                _iterator.return();
+                            }
+                        } finally{
+                            if (_didIteratorError) {
+                                throw _iteratorError;
+                            }
+                        }
+                    }
+                    _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        6,
                         7,
-                        8,
-                        9
+                        8
                     ]);
-                    _iterator2 = filePaths[Symbol.iterator]();
-                    _state.label = 3;
-                case 3:
-                    if (!!(_iteratorNormalCompletion2 = (_step2 = _iterator2.next()).done)) return [
+                    _iterator1 = filePaths[Symbol.iterator]();
+                    _state.label = 2;
+                case 2:
+                    if (!!(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done)) return [
                         3,
-                        6
+                        5
                     ];
-                    relPath = _step2.value;
+                    relPath = _step1.value;
                     absolutePath = resolve(projectRoot, relPath);
-                    if (declFilePaths.has(absolutePath)) {
-                        return [
-                            3,
-                            5
-                        ];
-                    }
+                    if (!!declFilePaths.has(absolutePath)) return [
+                        3,
+                        4
+                    ];
                     return [
                         4,
                         scanOneFile({
@@ -42901,100 +43115,87 @@ var DEFAULT_EXCLUDE = [
                             sitesBySlug: sitesBySlug
                         })
                     ];
-                case 4:
+                case 3:
                     _state.sent();
-                    _state.label = 5;
-                case 5:
-                    _iteratorNormalCompletion2 = true;
+                    _state.label = 4;
+                case 4:
+                    _iteratorNormalCompletion1 = true;
                     return [
                         3,
-                        3
+                        2
                     ];
-                case 6:
+                case 5:
                     return [
                         3,
-                        9
+                        8
                     ];
-                case 7:
+                case 6:
                     err = _state.sent();
-                    _didIteratorError2 = true;
-                    _iteratorError2 = err;
+                    _didIteratorError1 = true;
+                    _iteratorError1 = err;
                     return [
                         3,
-                        9
+                        8
                     ];
-                case 8:
+                case 7:
                     try {
-                        if (!_iteratorNormalCompletion2 && _iterator2.return != null) {
-                            _iterator2.return();
+                        if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                            _iterator1.return();
                         }
                     } finally{
-                        if (_didIteratorError2) {
-                            throw _iteratorError2;
+                        if (_didIteratorError1) {
+                            throw _iteratorError1;
                         }
                     }
                     return [
                         7
                     ];
-                case 9:
-                    _iteratorNormalCompletion3 = true, _didIteratorError3 = false, _iteratorError3 = undefined;
-                    try {
-                        for(_iterator3 = sitesBySlug[Symbol.iterator](); !(_iteratorNormalCompletion3 = (_step3 = _iterator3.next()).done); _iteratorNormalCompletion3 = true){
-                            _step_value = _sliced_to_array$2(_step3.value, 2), slug = _step_value[0], sites = _step_value[1];
-                            specCount = 0;
-                            _iteratorNormalCompletion4 = true, _didIteratorError4 = false, _iteratorError4 = undefined;
-                            try {
-                                for(_iterator4 = sites[Symbol.iterator](); !(_iteratorNormalCompletion4 = (_step4 = _iterator4.next()).done); _iteratorNormalCompletion4 = true){
-                                    site = _step4.value;
-                                    if (site.isSpec) {
-                                        specCount += 1;
-                                    }
-                                }
-                            } catch (err) {
-                                _didIteratorError4 = true;
-                                _iteratorError4 = err;
-                            } finally{
-                                try {
-                                    if (!_iteratorNormalCompletion4 && _iterator4.return != null) {
-                                        _iterator4.return();
-                                    }
-                                } finally{
-                                    if (_didIteratorError4) {
-                                        throw _iteratorError4;
-                                    }
-                                }
-                            }
-                            result.set(slug, {
-                                count: sites.length,
-                                productionCount: sites.length - specCount,
-                                specCount: specCount,
-                                referencedBy: sites
-                            });
-                        }
-                    } catch (err) {
-                        _didIteratorError3 = true;
-                        _iteratorError3 = err;
-                    } finally{
-                        try {
-                            if (!_iteratorNormalCompletion3 && _iterator3.return != null) {
-                                _iterator3.return();
-                            }
-                        } finally{
-                            if (_didIteratorError3) {
-                                throw _iteratorError3;
-                            }
-                        }
-                    }
-                    _state.label = 10;
-                case 10:
+                case 8:
                     return [
                         2,
-                        result
+                        sitesBySlug
                     ];
             }
         });
     })();
 }
+/**
+ * Tallies one slug's reference sites into a {@link FactoryReferenceCount},
+ * splitting production callers from spec-only callers.
+ *
+ * @param sites - The reference sites found for one factory.
+ * @returns The total/production/spec counts plus the sites themselves.
+ */ function tallyReferenceSites(sites) {
+    var specCount = 0;
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = sites[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var site = _step.value;
+            if (site.isSpec) {
+                specCount += 1;
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return {
+        count: sites.length,
+        productionCount: sites.length - specCount,
+        specCount: specCount,
+        referencedBy: sites
+    };
+}
 /**
  * Returns true when the supplied workspace-relative subpath looks like a
  * Vitest/Jest spec file. The scanner uses this to tag each
@@ -43149,7 +43350,7 @@ function buildCombinedRegex(names) {
     return result;
 }
 function escapeRegex(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, String.raw(_templateObject()));
+    return value.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw(_templateObject()));
 }
 function computeLineOffsets(contents) {
     var offsets = [
@@ -51657,10 +51858,9 @@ function collectExternalCssUtilitySources(configResult) {
         try {
             for(var _iterator = ((_ref = cluster === null || cluster === void 0 ? void 0 : cluster.sources) !== null && _ref !== void 0 ? _ref : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                 var source = _step.value;
-                var absolute = isAbsolute(source) ? source : resolve(baseDir, source);
                 externalSources.push({
                     origin: 'external',
-                    path: absolute
+                    path: toAbsolutePath$1(baseDir, source)
                 });
             }
         } catch (err) {
@@ -51683,10 +51883,9 @@ function collectExternalCssUtilitySources(configResult) {
                 var scan = _step1.value;
                 var out = scan.out;
                 if (typeof out === 'string' && out.length > 0) {
-                    var absolute1 = isAbsolute(out) ? out : resolve(baseDir, out);
                     externalSources.push({
                         origin: 'external',
-                        path: absolute1
+                        path: toAbsolutePath$1(baseDir, out)
                     });
                 }
             }
@@ -51707,6 +51906,16 @@ function collectExternalCssUtilitySources(configResult) {
     }
     return externalSources;
 }
+/**
+ * Resolves `value` against `baseDir` when it is relative, leaving an
+ * already-absolute path untouched (so its original spelling is preserved).
+ *
+ * @param baseDir - Directory a relative `value` is resolved against.
+ * @param value - An absolute or relative path.
+ * @returns The absolute path.
+ */ function toAbsolutePath$1(baseDir, value) {
+    return isAbsolute(value) ? value : resolve(baseDir, value);
+}
 /**
  * Re-exported so callers can build a deterministic test fixture pointing
  * at the package's bundled manifests without touching `import.meta.url`.
@@ -55359,10 +55568,9 @@ function collectExternalTokenSources(configResult) {
         try {
             for(var _iterator = ((_ref = tokensCluster === null || tokensCluster === void 0 ? void 0 : tokensCluster.sources) !== null && _ref !== void 0 ? _ref : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                 var source = _step.value;
-                var absolute = isAbsolute(source) ? source : resolve(baseDir, source);
                 externalSources.push({
                     origin: 'external',
-                    path: absolute
+                    path: toAbsolutePath(baseDir, source)
                 });
             }
         } catch (err) {
@@ -55385,10 +55593,9 @@ function collectExternalTokenSources(configResult) {
                 var scan = _step1.value;
                 var out = scan.out;
                 if (typeof out === 'string' && out.length > 0) {
-                    var absolute1 = isAbsolute(out) ? out : resolve(baseDir, out);
                     externalSources.push({
                         origin: 'external',
-                        path: absolute1
+                        path: toAbsolutePath(baseDir, out)
                     });
                 }
             }
@@ -55409,6 +55616,16 @@ function collectExternalTokenSources(configResult) {
     }
     return externalSources;
 }
+/**
+ * Resolves `value` against `baseDir` when it is relative, leaving an
+ * already-absolute path untouched (so its original spelling is preserved).
+ *
+ * @param baseDir - Directory a relative `value` is resolved against.
+ * @param value - An absolute or relative path.
+ * @returns The absolute path.
+ */ function toAbsolutePath(baseDir, value) {
+    return isAbsolute(value) ? value : resolve(baseDir, value);
+}
 /**
  * Re-exported so callers can build a deterministic test fixture pointing at
  * the package's bundled manifests without touching `import.meta.url`.
@@ -56891,4 +57108,4 @@ function printPaginatedOutput(input) {
     })();
 }
 
-export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, applyEnvVarOverrides, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildOidcDiscoveryCandidates, buildPipesManifest, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, clearDownstreamCatalogCache, collectClassPropertiesWithInheritance, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCallModelCommand, createCli, createCliContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, detectDataHelpFormat, detectHelpMode, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUtilEntries, fetchSessionInfo, fetchUserInfo, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, flattenList, generateOAuthState, generatePkceMaterial, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverHttp, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, isCliEnvConfigComplete, isCliVerbose, isCoreTopic, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadPackageName, loadPipeManifests, loadPipeRegistry, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeOutputConfig, openStreamingDump, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseGetArgs, parseGetManyArgs, parsePastedRedirect, parseScanArgs, pickFields, promptLine, readAllStdin, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderDecodedKey, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, requireCliContext, resolveActiveEnvName, resolveCliEnv, resolveCliEnvOrThrow, resolveCliModel, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveModelArchetype, resolveOutputConfig, resolvePerModelGetKey, revokeToken, runActionsScanCli, runCli, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, saveCliConfig, scanFactoryReferences, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, toActionEntryInfo, toFilterEntryInfo, toFormFieldInfo, tracedFetch, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler };
+export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_HTTP_TIMEOUT_MS, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, applyEnvVarOverrides, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildOidcDiscoveryCandidates, buildPipesManifest, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, clearDownstreamCatalogCache, collectClassPropertiesWithInheritance, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCallModelCommand, createCli, createCliContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, detectDataHelpFormat, detectHelpMode, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUtilEntries, fetchSessionInfo, fetchUserInfo, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, flattenList, generateOAuthState, generatePkceMaterial, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverHttp, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, isCliEnvConfigComplete, isCliVerbose, isCoreTopic, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadPackageName, loadPipeManifests, loadPipeRegistry, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeOutputConfig, openStreamingDump, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseGetArgs, parseGetManyArgs, parsePastedRedirect, parseScanArgs, pickFields, promptLine, readAllStdin, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderDecodedKey, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, requireCliContext, resolveActiveEnvName, resolveCliEnv, resolveCliEnvOrThrow, resolveCliModel, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveModelArchetype, resolveOutputConfig, resolvePerModelGetKey, revokeToken, runActionsScanCli, runCli, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, saveCliConfig, scanFactoryReferences, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, toActionEntryInfo, toFilterEntryInfo, toFormFieldInfo, tracedFetch, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler };