@dereekb/dbx-cli 13.23.0 → 13.24.0

package/index.cjs.js

@@ -7,6 +7,7 @@ var util = require('@dereekb/util');
 var date = require('@dereekb/date');
 var nestjs = require('@dereekb/nestjs');
 var node_os = require('node:os');
+var oidc = require('@dereekb/util/oidc');
 var node_readline = require('node:readline');
 var model = require('@dereekb/model');
 var yargs = require('yargs');
@@ -18,13 +19,13 @@ var node_url = require('node:url');
 var posix = require('node:path/posix');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
-function _array_like_to_array$17(arr, len) {
+function _array_like_to_array$16(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
 function _array_without_holes$$(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$17(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$16(arr);
 }
 function _assert_this_initialized(self) {
     if (self === void 0) {
@@ -32,7 +33,7 @@ function _assert_this_initialized(self) {
     }
     return self;
 }
-function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -46,16 +47,16 @@ function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1f(fn) {
+function _async_to_generator$1e(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -87,7 +88,7 @@ function _construct(Parent, args, Class) {
     }
     return _construct.apply(null, arguments);
 }
-function _define_property$M(obj, key, value) {
+function _define_property$N(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -136,7 +137,7 @@ function _iterable_to_array$$(iter) {
 function _non_iterable_spread$$() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$M(target) {
+function _object_spread$N(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -146,12 +147,12 @@ function _object_spread$M(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$M(target, key, source[key]);
+            _define_property$N(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$u(object, enumerableOnly) {
+function ownKeys$w(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -159,12 +160,12 @@ function ownKeys$u(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$u(target, source) {
+function _object_spread_props$w(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$u(Object(source)).forEach(function(key) {
+        ownKeys$w(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -184,19 +185,19 @@ function _set_prototype_of(o, p) {
     return _set_prototype_of(o, p);
 }
 function _to_consumable_array$$(arr) {
-    return _array_without_holes$$(arr) || _iterable_to_array$$(arr) || _unsupported_iterable_to_array$17(arr) || _non_iterable_spread$$();
+    return _array_without_holes$$(arr) || _iterable_to_array$$(arr) || _unsupported_iterable_to_array$16(arr) || _non_iterable_spread$$();
 }
 function _type_of$2(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$17(o, minLen) {
+function _unsupported_iterable_to_array$16(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$17(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$16(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$17(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$16(o, minLen);
 }
 function _wrap_native_super(Class) {
     var _cache = typeof Map === "function" ? new Map() : undefined;
@@ -232,7 +233,7 @@ function _is_native_reflect_construct() {
         return !!result;
     })();
 }
-function _ts_generator$1f(thisArg, body) {
+function _ts_generator$1e(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -416,10 +417,10 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
  * @param init - The RequestInit. Any existing `signal` is preserved; we only attach our own when no signal was supplied.
  * @returns The fetch Response.
  */ function tracedFetch(fetcher, input, init) {
-    return _async_to_generator$1f(function() {
+    return _async_to_generator$1e(function() {
         var _ref, fetchImpl, timeoutMs, method, url, controller, timeoutHandle, finalInit, // Don't let the abort timer itself keep the Node event loop (or a test worker) alive.
         _timeoutHandle_unref, localController, e;
-        return _ts_generator$1f(this, function(_state) {
+        return _ts_generator$1e(this, function(_state) {
             switch(_state.label){
                 case 0:
                     fetchImpl = fetcher !== null && fetcher !== void 0 ? fetcher : fetch;
@@ -441,7 +442,7 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
                             return localController.abort();
                         }, timeoutMs);
                         (_timeoutHandle_unref = timeoutHandle.unref) === null || _timeoutHandle_unref === void 0 ? void 0 : _timeoutHandle_unref.call(timeoutHandle);
-                        finalInit = _object_spread_props$u(_object_spread$M({}, init), {
+                        finalInit = _object_spread_props$w(_object_spread$N({}, init), {
                             signal: localController.signal
                         });
                     }
@@ -590,7 +591,7 @@ function dumpResponse(data, meta) {
     if (!filePath) {
         return;
     }
-    var content = _object_spread$M({
+    var content = _object_spread$N({
         ok: true,
         data: data
     }, meta ? {
@@ -667,7 +668,7 @@ function stringifyEnvelope(value) {
  */ function outputResult(data, meta) {
     dumpResponse(data, meta);
     var outputData = _outputOptions.pick ? pickFields(data, _outputOptions.pick) : data;
-    var output = _object_spread$M({
+    var output = _object_spread$N({
         ok: true,
         data: outputData
     }, meta ? {
@@ -696,7 +697,7 @@ function stringifyEnvelope(value) {
         var _this;
         _this = _call_super(this, CliError, [
             input.message
-        ]), _define_property$M(_this, "code", void 0), _define_property$M(_this, "suggestion", void 0);
+        ]), _define_property$N(_this, "code", void 0), _define_property$N(_this, "suggestion", void 0);
         _this.name = 'CliError';
         _this.code = input.code;
         _this.suggestion = input.suggestion;
@@ -724,7 +725,7 @@ function stringifyEnvelope(value) {
     if (mapped) {
         result = mapped;
     } else if (_instanceof$o(error, CliError)) {
-        result = _object_spread$M({
+        result = _object_spread$N({
             ok: false,
             error: sanitizeString(error.message),
             code: error.code
@@ -747,15 +748,15 @@ function stringifyEnvelope(value) {
     return result;
 }
 
-function _array_like_to_array$16(arr, len) {
+function _array_like_to_array$15(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
 function _array_without_holes$_(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$16(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$15(arr);
 }
-function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -769,22 +770,22 @@ function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1e(fn) {
+function _async_to_generator$1d(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$L(obj, key, value) {
+function _define_property$M(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -803,7 +804,7 @@ function _iterable_to_array$_(iter) {
 function _non_iterable_spread$_() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$L(target) {
+function _object_spread$M(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -813,12 +814,12 @@ function _object_spread$L(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$L(target, key, source[key]);
+            _define_property$M(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$t(object, enumerableOnly) {
+function ownKeys$v(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -826,33 +827,33 @@ function ownKeys$t(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$t(target, source) {
+function _object_spread_props$v(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$t(Object(source)).forEach(function(key) {
+        ownKeys$v(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
 function _to_consumable_array$_(arr) {
-    return _array_without_holes$_(arr) || _iterable_to_array$_(arr) || _unsupported_iterable_to_array$16(arr) || _non_iterable_spread$_();
+    return _array_without_holes$_(arr) || _iterable_to_array$_(arr) || _unsupported_iterable_to_array$15(arr) || _non_iterable_spread$_();
 }
 function _type_of$1(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$16(o, minLen) {
+function _unsupported_iterable_to_array$15(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$16(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$15(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$16(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$15(o, minLen);
 }
-function _ts_generator$1e(thisArg, body) {
+function _ts_generator$1d(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -964,14 +965,14 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The call envelope describing the API target, access token, model params, and optional fetch override.
  * @returns The parsed JSON response body cast to `R`.
  */ function callModelOverHttp(input) {
-    return _async_to_generator$1e(function() {
+    return _async_to_generator$1d(function() {
         var _input_params_call;
-        return _ts_generator$1e(this, function(_state) {
+        return _ts_generator$1d(this, function(_state) {
             return [
                 2,
                 requestJson({
                     method: 'POST',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl)).concat(CALL_MODEL_API_PATH),
+                    url: "".concat(trimSlash(input.apiBaseUrl)).concat(CALL_MODEL_API_PATH),
                     accessToken: input.accessToken,
                     jsonBody: input.params,
                     fetcher: input.fetcher,
@@ -994,13 +995,13 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The request envelope describing the API target, access token, model + key, and optional fetch override.
  * @returns The parsed `{ key, data }` envelope.
  */ function getModelOverHttp(input) {
-    return _async_to_generator$1e(function() {
-        return _ts_generator$1e(this, function(_state) {
+    return _async_to_generator$1d(function() {
+        return _ts_generator$1d(this, function(_state) {
             return [
                 2,
                 requestJson({
                     method: 'GET',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get?key=").concat(encodeURIComponent(input.key)),
+                    url: "".concat(trimSlash(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get?key=").concat(encodeURIComponent(input.key)),
                     accessToken: input.accessToken,
                     fetcher: input.fetcher,
                     errorPrefix: "get ".concat(input.modelType, "/").concat(input.key, " failed")
@@ -1023,8 +1024,8 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The request envelope describing the API target, access token, model, keys, and optional fetch override.
  * @returns The parsed `{ results, errors }` envelope.
  */ function getMultipleModelsOverHttp(input) {
-    return _async_to_generator$1e(function() {
-        return _ts_generator$1e(this, function(_state) {
+    return _async_to_generator$1d(function() {
+        return _ts_generator$1d(this, function(_state) {
             if (input.keys.length === 0) {
                 throw new CliError({
                     message: 'get-many requires at least one key.',
@@ -1041,7 +1042,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                 2,
                 requestJson({
                     method: 'POST',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get"),
+                    url: "".concat(trimSlash(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get"),
                     accessToken: input.accessToken,
                     jsonBody: {
                         keys: input.keys
@@ -1062,9 +1063,9 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - Same shape as {@link GetMultipleModelsOverHttpInput} but without the 50-key cap.
  * @returns The merged `{ results, errors }` envelope across all chunks.
  */ function getMultipleModelsOverHttpChunked(input) {
-    return _async_to_generator$1e(function() {
+    return _async_to_generator$1d(function() {
         var chunks, i, mergedResults, mergedErrors, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, chunk, _mergedResults, _mergedErrors, batch, err;
-        return _ts_generator$1e(this, function(_state) {
+        return _ts_generator$1d(this, function(_state) {
             switch(_state.label){
                 case 0:
                     if (input.keys.length === 0) {
@@ -1098,7 +1099,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                     chunk = _step.value;
                     return [
                         4,
-                        getMultipleModelsOverHttp(_object_spread_props$t(_object_spread$L({}, input), {
+                        getMultipleModelsOverHttp(_object_spread_props$v(_object_spread$M({}, input), {
                             keys: chunk
                         }))
                     ];
@@ -1152,15 +1153,15 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
     })();
 }
 function requestJson(input) {
-    return _async_to_generator$1e(function() {
+    return _async_to_generator$1d(function() {
         var hasJsonBody, init, res, _ref, ok, body, fallbackMessage;
-        return _ts_generator$1e(this, function(_state) {
+        return _ts_generator$1d(this, function(_state) {
             switch(_state.label){
                 case 0:
                     hasJsonBody = input.jsonBody !== undefined;
-                    init = _object_spread$L({
+                    init = _object_spread$M({
                         method: input.method,
-                        headers: _object_spread$L({
+                        headers: _object_spread$M({
                             Accept: 'application/json',
                             Authorization: "Bearer ".concat(input.accessToken)
                         }, hasJsonBody ? {
@@ -1197,9 +1198,9 @@ function requestJson(input) {
     })();
 }
 function readJsonResponse(res) {
-    return _async_to_generator$1e(function() {
+    return _async_to_generator$1d(function() {
         var text, body;
-        return _ts_generator$1e(this, function(_state) {
+        return _ts_generator$1d(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -1251,7 +1252,7 @@ function codeForStatus(status) {
     }
     return result;
 }
-function trimSlash$1(url) {
+function trimSlash(url) {
     return url.endsWith('/') ? url.slice(0, -1) : url;
 }
 
@@ -1355,7 +1356,7 @@ var getCliContext = _cliContextSlot.get;
     };
 }
 
-function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1369,22 +1370,22 @@ function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1d(fn) {
+function _async_to_generator$1c(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1d(thisArg, body) {
+function _ts_generator$1c(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1497,9 +1498,9 @@ function _ts_generator$1d(thisArg, body) {
  */ function wrapCommandHandler(handler) {
     var exitCode = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : CLI_EXIT_CODE_HANDLER;
     return function(argv) {
-        return _async_to_generator$1d(function() {
+        return _async_to_generator$1c(function() {
             var e;
-            return _ts_generator$1d(this, function(_state) {
+            return _ts_generator$1c(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         _state.trys.push([
@@ -1560,7 +1561,7 @@ function _ts_generator$1d(thisArg, body) {
     };
 }
 
-function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1574,22 +1575,22 @@ function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1c(fn) {
+function _async_to_generator$1b(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1c(thisArg, body) {
+function _ts_generator$1b(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1709,9 +1710,9 @@ function _ts_generator$1c(thisArg, body) {
             return spec.helpEpilogue ? built.epilogue(spec.helpEpilogue) : built;
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1c(function() {
+            return _async_to_generator$1b(function() {
                 var context, result;
-                return _ts_generator$1c(this, function(_state) {
+                return _ts_generator$1b(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             context = requireCliContext();
@@ -1735,21 +1736,21 @@ function _ts_generator$1c(thisArg, body) {
     };
 }
 
-function _array_like_to_array$15(arr, len) {
+function _array_like_to_array$14(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$j(arr) {
+function _array_with_holes$i(arr) {
     if (Array.isArray(arr)) return arr;
 }
 function _array_without_holes$Z(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$15(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$14(arr);
 }
 function _iterable_to_array$Z(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$j(arr, i) {
+function _iterable_to_array_limit$i(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -1773,25 +1774,25 @@ function _iterable_to_array_limit$j(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$j() {
+function _non_iterable_rest$i() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _non_iterable_spread$Z() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$j(arr, i) {
-    return _array_with_holes$j(arr) || _iterable_to_array_limit$j(arr, i) || _unsupported_iterable_to_array$15(arr, i) || _non_iterable_rest$j();
+function _sliced_to_array$i(arr, i) {
+    return _array_with_holes$i(arr) || _iterable_to_array_limit$i(arr, i) || _unsupported_iterable_to_array$14(arr, i) || _non_iterable_rest$i();
 }
 function _to_consumable_array$Z(arr) {
-    return _array_without_holes$Z(arr) || _iterable_to_array$Z(arr) || _unsupported_iterable_to_array$15(arr) || _non_iterable_spread$Z();
+    return _array_without_holes$Z(arr) || _iterable_to_array$Z(arr) || _unsupported_iterable_to_array$14(arr) || _non_iterable_spread$Z();
 }
-function _unsupported_iterable_to_array$15(o, minLen) {
+function _unsupported_iterable_to_array$14(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$15(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$14(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$15(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$14(o, minLen);
 }
 /**
  * Default name of the parent command that groups all registered action specs.
@@ -1847,7 +1848,7 @@ function _unsupported_iterable_to_array$15(o, minLen) {
             }
         }
         var sortedModels = _to_consumable_array$Z(byModel.entries()).sort(function(param, param1) {
-            var _param = _sliced_to_array$j(param, 1), a = _param[0], _param1 = _sliced_to_array$j(param1, 1), b = _param1[0];
+            var _param = _sliced_to_array$i(param, 1), a = _param[0], _param1 = _sliced_to_array$i(param1, 1), b = _param1[0];
             return a.localeCompare(b);
         });
         result = [
@@ -1878,7 +1879,7 @@ function _unsupported_iterable_to_array$15(o, minLen) {
                     var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                     try {
                         var _loop = function() {
-                            var _step_value = _sliced_to_array$j(_step1.value, 2), model = _step_value[0], modelSpecs = _step_value[1];
+                            var _step_value = _sliced_to_array$i(_step1.value, 2), model = _step_value[0], modelSpecs = _step_value[1];
                             yargs.command({
                                 command: "".concat(model, " <action>"),
                                 describe: "Composite actions scoped to model '".concat(model, "' (").concat(modelSpecs.length, ")."),
@@ -1936,18 +1937,18 @@ function _unsupported_iterable_to_array$15(o, minLen) {
     return result;
 }
 
-function _array_like_to_array$14(arr, len) {
+function _array_like_to_array$13(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$i(arr) {
+function _array_with_holes$h(arr) {
     if (Array.isArray(arr)) return arr;
 }
 function _array_without_holes$Y(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$14(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$13(arr);
 }
-function asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1961,22 +1962,22 @@ function asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1b(fn) {
+function _async_to_generator$1a(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$K(obj, key, value) {
+function _define_property$L(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -1992,7 +1993,7 @@ function _define_property$K(obj, key, value) {
 function _iterable_to_array$Y(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$i(arr, i) {
+function _iterable_to_array_limit$h(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -2016,13 +2017,13 @@ function _iterable_to_array_limit$i(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$i() {
+function _non_iterable_rest$h() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _non_iterable_spread$Y() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$K(target) {
+function _object_spread$L(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2032,12 +2033,12 @@ function _object_spread$K(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$K(target, key, source[key]);
+            _define_property$L(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$s(object, enumerableOnly) {
+function ownKeys$u(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -2045,32 +2046,32 @@ function ownKeys$s(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$s(target, source) {
+function _object_spread_props$u(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$s(Object(source)).forEach(function(key) {
+        ownKeys$u(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _sliced_to_array$i(arr, i) {
-    return _array_with_holes$i(arr) || _iterable_to_array_limit$i(arr, i) || _unsupported_iterable_to_array$14(arr, i) || _non_iterable_rest$i();
+function _sliced_to_array$h(arr, i) {
+    return _array_with_holes$h(arr) || _iterable_to_array_limit$h(arr, i) || _unsupported_iterable_to_array$13(arr, i) || _non_iterable_rest$h();
 }
 function _to_consumable_array$Y(arr) {
-    return _array_without_holes$Y(arr) || _iterable_to_array$Y(arr) || _unsupported_iterable_to_array$14(arr) || _non_iterable_spread$Y();
+    return _array_without_holes$Y(arr) || _iterable_to_array$Y(arr) || _unsupported_iterable_to_array$13(arr) || _non_iterable_spread$Y();
 }
-function _unsupported_iterable_to_array$14(o, minLen) {
+function _unsupported_iterable_to_array$13(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$14(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$13(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$14(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$13(o, minLen);
 }
-function _ts_generator$1b(thisArg, body) {
+function _ts_generator$1a(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2184,7 +2185,7 @@ var _defaultResponseAdapter = {
     }
 };
 function _defaultBuildRequestData(params, state, limit) {
-    var base = _object_spread$K({}, params);
+    var base = _object_spread$L({}, params);
     if (state.cursorDocumentKey != null) {
         base.cursorDocumentKey = state.cursorDocumentKey;
     }
@@ -2194,9 +2195,9 @@ function _defaultBuildRequestData(params, state, limit) {
     return base;
 }
 function _runItemTasks(input) {
-    return _async_to_generator$1b(function() {
+    return _async_to_generator$1a(function() {
         var context, items, keys, pageIndex, iterateItem, itemPerformTasksConfig, maxParallelPerPage, indexed, taskConfig, performResult;
-        return _ts_generator$1b(this, function(_state) {
+        return _ts_generator$1a(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, items = input.items, keys = input.keys, pageIndex = input.pageIndex, iterateItem = input.iterateItem, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -2208,7 +2209,7 @@ function _runItemTasks(input) {
                             itemIndex: itemIndex
                         };
                     });
-                    taskConfig = _object_spread_props$s(_object_spread$K({
+                    taskConfig = _object_spread_props$u(_object_spread$L({
                         sequential: true,
                         throwError: true
                     }, itemPerformTasksConfig), {
@@ -2232,7 +2233,7 @@ function _runItemTasks(input) {
                     return [
                         2,
                         performResult.results.map(function(param) {
-                            var _param = _sliced_to_array$i(param, 2), output = _param[1];
+                            var _param = _sliced_to_array$h(param, 2), output = _param[1];
                             return output;
                         })
                     ];
@@ -2241,9 +2242,9 @@ function _runItemTasks(input) {
     })();
 }
 function _processPage(input) {
-    return _async_to_generator$1b(function() {
+    return _async_to_generator$1a(function() {
         var context, raw, pageIndex, responseAdapter, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, items, keys, nextCursorDocumentKey, hasMore, itemResults, _tmp, pageResult, _tmp1, output;
-        return _ts_generator$1b(this, function(_state) {
+        return _ts_generator$1a(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, raw = input.raw, pageIndex = input.pageIndex, responseAdapter = input.responseAdapter, iterateItem = input.iterateItem, iteratePage = input.iteratePage, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -2383,9 +2384,9 @@ function _evaluateLoopExit(input) {
  * });
  * ```
  */ function iterateDbxCliCallModel(config) {
-    return _async_to_generator$1b(function() {
+    return _async_to_generator$1a(function() {
         var context, modelType, call, specifier, params, _config_buildRequestData, buildRequestData, _config_responseAdapter, responseAdapter, limitPerPage, totalItemsLimit, maxPages, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, _config_collectItems, collectItems, _config_collectItemResults, collectItemResults, _config_collectPageResults, collectPageResults, allItems, allItemResults, allPageResults, pageIndex, totalItems, cursorDocumentKey, hitLimit, keepGoing, collectItemsForPage, collectItemResultsForPage, collectPageResultsForPage, effectiveLimit, data, raw, pageOutcome, _allItems, _allItemResults, exit, result;
-        return _ts_generator$1b(this, function(_state) {
+        return _ts_generator$1a(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = config.context, modelType = config.modelType, call = config.call, specifier = config.specifier, params = config.params, _config_buildRequestData = config.buildRequestData, buildRequestData = _config_buildRequestData === void 0 ? _defaultBuildRequestData : _config_buildRequestData, _config_responseAdapter = config.responseAdapter, responseAdapter = _config_responseAdapter === void 0 ? _defaultResponseAdapter : _config_responseAdapter, limitPerPage = config.limitPerPage, totalItemsLimit = config.totalItemsLimit, maxPages = config.maxPages, iterateItem = config.iterateItem, iteratePage = config.iteratePage, itemPerformTasksConfig = config.itemPerformTasksConfig, maxParallelPerPage = config.maxParallelPerPage, _config_collectItems = config.collectItems, collectItems = _config_collectItems === void 0 ? true : _config_collectItems, _config_collectItemResults = config.collectItemResults, collectItemResults = _config_collectItemResults === void 0 ? iterateItem != null : _config_collectItemResults, _config_collectPageResults = config.collectPageResults, collectPageResults = _config_collectPageResults === void 0 ? iteratePage != null : _config_collectPageResults;
@@ -2465,7 +2466,7 @@ function _evaluateLoopExit(input) {
                         1
                     ];
                 case 4:
-                    result = _object_spread$K({
+                    result = _object_spread$L({
                         totalPages: pageIndex,
                         totalItems: totalItems,
                         hitLimit: hitLimit,
@@ -2486,7 +2487,7 @@ function _evaluateLoopExit(input) {
     })();
 }
 
-function asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2500,22 +2501,22 @@ function asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1a(fn) {
+function _async_to_generator$19(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$J(obj, key, value) {
+function _define_property$K(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2528,7 +2529,7 @@ function _define_property$J(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$J(target) {
+function _object_spread$K(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2538,12 +2539,12 @@ function _object_spread$J(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$J(target, key, source[key]);
+            _define_property$K(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$r(object, enumerableOnly) {
+function ownKeys$t(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -2551,18 +2552,18 @@ function ownKeys$r(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$r(target, source) {
+function _object_spread_props$t(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$r(Object(source)).forEach(function(key) {
+        ownKeys$t(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _ts_generator$1a(thisArg, body) {
+function _ts_generator$19(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2678,14 +2679,14 @@ function _ts_generator$1a(thisArg, body) {
             return spec.builder ? spec.builder(yargs) : yargs;
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1a(function() {
+            return _async_to_generator$19(function() {
                 var context, data, params, result;
-                return _ts_generator$1a(this, function(_state) {
+                return _ts_generator$19(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             context = requireCliContext();
                             data = spec.buildParams(argv);
-                            params = _object_spread_props$r(_object_spread$J({
+                            params = _object_spread_props$t(_object_spread$K({
                                 modelType: spec.model,
                                 call: spec.verb
                             }, spec.specifier == null ? {} : {
@@ -2863,7 +2864,7 @@ function AsyncFromSyncIterator$4(s) {
         }
     }, new AsyncFromSyncIterator$4(s);
 }
-function asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2877,22 +2878,22 @@ function asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$19(fn) {
+function _async_to_generator$18(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$19(thisArg, body) {
+function _ts_generator$18(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3011,9 +3012,9 @@ function _ts_generator$19(thisArg, body) {
  *
  * @returns The UTF-8 decoded stdin contents.
  */ function readAllStdin() {
-    return _async_to_generator$19(function() {
+    return _async_to_generator$18(function() {
         var chunks, _iteratorAbruptCompletion, _didIteratorError, _iteratorError, _iterator, _step, _value, chunk, err;
-        return _ts_generator$19(this, function(_state) {
+        return _ts_generator$18(this, function(_state) {
             switch(_state.label){
                 case 0:
                     chunks = [];
@@ -3111,9 +3112,9 @@ function _ts_generator$19(thisArg, body) {
  *
  * @returns The tokens parsed from stdin.
  */ function readStdinTokens() {
-    return _async_to_generator$19(function() {
+    return _async_to_generator$18(function() {
         var raw;
-        return _ts_generator$19(this, function(_state) {
+        return _ts_generator$18(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -3133,7 +3134,7 @@ function _ts_generator$19(thisArg, body) {
     })();
 }
 
-function asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3147,22 +3148,22 @@ function asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$18(fn) {
+function _async_to_generator$17(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$I(obj, key, value) {
+function _define_property$J(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3183,7 +3184,7 @@ function _instanceof$n(left, right) {
         return left instanceof right;
     }
 }
-function _object_spread$I(target) {
+function _object_spread$J(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3193,12 +3194,12 @@ function _object_spread$I(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$I(target, key, source[key]);
+            _define_property$J(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$q(object, enumerableOnly) {
+function ownKeys$s(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -3206,18 +3207,18 @@ function ownKeys$q(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$q(target, source) {
+function _object_spread_props$s(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$q(Object(source)).forEach(function(key) {
+        ownKeys$s(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _ts_generator$18(thisArg, body) {
+function _ts_generator$17(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3328,9 +3329,9 @@ function _ts_generator$18(thisArg, body) {
         return withCallModelArgs(yargs);
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$18(function() {
+        return _async_to_generator$17(function() {
             var context, data, rawData, _tmp, params, result;
-            return _ts_generator$18(this, function(_state) {
+            return _ts_generator$17(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -3370,7 +3371,7 @@ function _ts_generator$18(thisArg, body) {
                                 });
                             }
                         }
-                        params = _object_spread_props$q(_object_spread$I({
+                        params = _object_spread_props$s(_object_spread$J({
                             modelType: argv.model,
                             call: argv.verb
                         }, argv.specifier == null ? {} : {
@@ -3394,12 +3395,12 @@ function _ts_generator$18(thisArg, body) {
     })
 };
 
-function _array_like_to_array$13(arr, len) {
+function _array_like_to_array$12(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$h(arr) {
+function _array_with_holes$g(arr) {
     if (Array.isArray(arr)) return arr;
 }
 function _instanceof$m(left, right) {
@@ -3410,7 +3411,7 @@ function _instanceof$m(left, right) {
         return left instanceof right;
     }
 }
-function _iterable_to_array_limit$h(arr, i) {
+function _iterable_to_array_limit$g(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -3434,23 +3435,23 @@ function _iterable_to_array_limit$h(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$h() {
+function _non_iterable_rest$g() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$h(arr, i) {
-    return _array_with_holes$h(arr) || _iterable_to_array_limit$h(arr, i) || _unsupported_iterable_to_array$13(arr, i) || _non_iterable_rest$h();
+function _sliced_to_array$g(arr, i) {
+    return _array_with_holes$g(arr) || _iterable_to_array_limit$g(arr, i) || _unsupported_iterable_to_array$12(arr, i) || _non_iterable_rest$g();
 }
 function _type_of(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$13(o, minLen) {
+function _unsupported_iterable_to_array$12(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$13(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$12(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$13(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$12(o, minLen);
 }
 /**
  * Resolves the manifest entry for `modelType`. Lookup tries
@@ -3543,7 +3544,7 @@ function rewriteWithFields(value, fields) {
         var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
         try {
             for(var _iterator1 = Object.entries(value)[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                var _step_value = _sliced_to_array$h(_step1.value, 2), key = _step_value[0], raw = _step_value[1];
+                var _step_value = _sliced_to_array$g(_step1.value, 2), key = _step_value[0], raw = _step_value[1];
                 var field1 = fieldByName.get(key);
                 if (field1) {
                     var longKey = field1.longName.length > 0 ? field1.longName : key;
@@ -3603,13 +3604,13 @@ function isPlainObject(value) {
     return result;
 }
 
-function _array_like_to_array$12(arr, len) {
+function _array_like_to_array$11(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
 function _array_without_holes$X(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$12(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$11(arr);
 }
 function _iterable_to_array$X(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
@@ -3618,15 +3619,15 @@ function _non_iterable_spread$X() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _to_consumable_array$X(arr) {
-    return _array_without_holes$X(arr) || _iterable_to_array$X(arr) || _unsupported_iterable_to_array$12(arr) || _non_iterable_spread$X();
+    return _array_without_holes$X(arr) || _iterable_to_array$X(arr) || _unsupported_iterable_to_array$11(arr) || _non_iterable_spread$X();
 }
-function _unsupported_iterable_to_array$12(o, minLen) {
+function _unsupported_iterable_to_array$11(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$12(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$11(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$12(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$11(o, minLen);
 }
 /**
  * Default command name for the model-decode command. Top-level so it stays
@@ -3795,21 +3796,21 @@ function renderAncestorLine(ancestor) {
     return ancestor.modelName ? "- ".concat(ancestor.modelName, " — prefix ").concat(ancestor.prefix, ", id ").concat(ancestor.id) : "- <unknown> — prefix ".concat(ancestor.prefix, ", id ").concat(ancestor.id);
 }
 
-function _array_like_to_array$11(arr, len) {
+function _array_like_to_array$10(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$g(arr) {
+function _array_with_holes$f(arr) {
     if (Array.isArray(arr)) return arr;
 }
 function _array_without_holes$W(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$11(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$10(arr);
 }
 function _iterable_to_array$W(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$g(arr, i) {
+function _iterable_to_array_limit$f(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -3833,25 +3834,25 @@ function _iterable_to_array_limit$g(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$g() {
+function _non_iterable_rest$f() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _non_iterable_spread$W() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$g(arr, i) {
-    return _array_with_holes$g(arr) || _iterable_to_array_limit$g(arr, i) || _unsupported_iterable_to_array$11(arr, i) || _non_iterable_rest$g();
+function _sliced_to_array$f(arr, i) {
+    return _array_with_holes$f(arr) || _iterable_to_array_limit$f(arr, i) || _unsupported_iterable_to_array$10(arr, i) || _non_iterable_rest$f();
 }
 function _to_consumable_array$W(arr) {
-    return _array_without_holes$W(arr) || _iterable_to_array$W(arr) || _unsupported_iterable_to_array$11(arr) || _non_iterable_spread$W();
+    return _array_without_holes$W(arr) || _iterable_to_array$W(arr) || _unsupported_iterable_to_array$10(arr) || _non_iterable_spread$W();
 }
-function _unsupported_iterable_to_array$11(o, minLen) {
+function _unsupported_iterable_to_array$10(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$11(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$10(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$11(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$10(o, minLen);
 }
 /**
  * Parses the positionals for the top-level `get <modelOrKey> [key]` command into a
@@ -4019,7 +4020,7 @@ function inferModelTypeFromKeys(keys, manifest) {
             code: 'INVALID_ARGUMENT'
         });
     }
-    var _decodedTypes = _sliced_to_array$g(decodedTypes, 1), modelType = _decodedTypes[0];
+    var _decodedTypes = _sliced_to_array$f(decodedTypes, 1), modelType = _decodedTypes[0];
     return {
         modelType: modelType,
         keys: keys
@@ -4032,7 +4033,7 @@ function manifestPrefixList(manifest) {
     return prefixes.join(', ');
 }
 
-function asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4046,22 +4047,22 @@ function asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$17(fn) {
+function _async_to_generator$16(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$17(thisArg, body) {
+function _ts_generator$16(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4182,9 +4183,9 @@ function _ts_generator$17(thisArg, body) {
         });
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$17(function() {
+        return _async_to_generator$16(function() {
             var context, _parseGetArgs, modelType, key, result;
-            return _ts_generator$17(this, function(_state) {
+            return _ts_generator$16(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -4209,7 +4210,7 @@ function _ts_generator$17(thisArg, body) {
     })
 };
 
-function asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4223,22 +4224,22 @@ function asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$16(fn) {
+function _async_to_generator$15(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$16(thisArg, body) {
+function _ts_generator$15(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4364,9 +4365,9 @@ function _ts_generator$16(thisArg, body) {
         });
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$16(function() {
+        return _async_to_generator$15(function() {
             var context, firstArg, rest, resolvedFirst, resolvedRest, stdinKeys, _parseGetManyArgs, modelType, keys, result;
-            return _ts_generator$16(this, function(_state) {
+            return _ts_generator$15(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -4409,7 +4410,7 @@ function _ts_generator$16(thisArg, body) {
     })
 };
 
-function asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4423,22 +4424,22 @@ function asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$15(fn) {
+function _async_to_generator$14(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$H(obj, key, value) {
+function _define_property$I(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4451,7 +4452,7 @@ function _define_property$H(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$H(target) {
+function _object_spread$I(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4461,12 +4462,12 @@ function _object_spread$H(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$H(target, key, source[key]);
+            _define_property$I(target, key, source[key]);
         });
     }
     return target;
 }
-function _ts_generator$15(thisArg, body) {
+function _ts_generator$14(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4622,9 +4623,9 @@ function _ts_generator$15(thisArg, body) {
  * @param input.updates - The partial {@link CliConfig} to merge on top of the existing on-disk config.
  * @returns The merged {@link CliConfig} that was just written.
  */ function mergeCliConfig(input) {
-    return _async_to_generator$15(function() {
+    return _async_to_generator$14(function() {
         var _ref, _input_updates_activeEnv, existing, merged;
-        return _ts_generator$15(this, function(_state) {
+        return _ts_generator$14(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -4637,7 +4638,7 @@ function _ts_generator$15(thisArg, body) {
                     existing = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : {};
                     merged = {
                         activeEnv: (_input_updates_activeEnv = input.updates.activeEnv) !== null && _input_updates_activeEnv !== void 0 ? _input_updates_activeEnv : existing.activeEnv,
-                        envs: input.updates.envs ? _object_spread$H({}, existing.envs, input.updates.envs) : existing.envs,
+                        envs: input.updates.envs ? _object_spread$I({}, existing.envs, input.updates.envs) : existing.envs,
                         output: input.updates.output === undefined ? existing.output : mergeOutputConfig(existing.output, input.updates.output)
                     };
                     return [
@@ -4679,12 +4680,12 @@ function mergeOutputCommandsConfig(existing, updates) {
     var result;
     if ('commands' in updates) {
         if (updates.commands) {
-            var merged = _object_spread$H({}, existing);
+            var merged = _object_spread$I({}, existing);
             var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
             try {
                 for(var _iterator = Object.keys(updates.commands)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                     var key = _step.value;
-                    merged[key] = _object_spread$H({}, existing === null || existing === void 0 ? void 0 : existing[key], updates.commands[key]);
+                    merged[key] = _object_spread$I({}, existing === null || existing === void 0 ? void 0 : existing[key], updates.commands[key]);
                 }
             } catch (err) {
                 _didIteratorError = true;
@@ -4749,15 +4750,15 @@ function mergeOutputCommandsConfig(existing, updates) {
     return result;
 }
 
-function _array_like_to_array$10(arr, len) {
+function _array_like_to_array$$(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
 function _array_without_holes$V(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$10(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$$(arr);
 }
-function _define_property$G(obj, key, value) {
+function _define_property$H(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4776,7 +4777,7 @@ function _iterable_to_array$V(iter) {
 function _non_iterable_spread$V() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$G(target) {
+function _object_spread$H(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4786,12 +4787,12 @@ function _object_spread$G(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$G(target, key, source[key]);
+            _define_property$H(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$p(object, enumerableOnly) {
+function ownKeys$r(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -4799,27 +4800,27 @@ function ownKeys$p(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$p(target, source) {
+function _object_spread_props$r(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$p(Object(source)).forEach(function(key) {
+        ownKeys$r(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
 function _to_consumable_array$V(arr) {
-    return _array_without_holes$V(arr) || _iterable_to_array$V(arr) || _unsupported_iterable_to_array$10(arr) || _non_iterable_spread$V();
+    return _array_without_holes$V(arr) || _iterable_to_array$V(arr) || _unsupported_iterable_to_array$$(arr) || _non_iterable_spread$V();
 }
-function _unsupported_iterable_to_array$10(o, minLen) {
+function _unsupported_iterable_to_array$$(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$10(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$$(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$10(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$$(o, minLen);
 }
 /**
  * The default OAuth/OIDC scopes requested by the CLI when none are configured.
@@ -5020,7 +5021,7 @@ function nonEmpty(value) {
     if (refreshToken) {
         var accessToken = nonEmpty(process.env["".concat(prefix, "_ACCESS_TOKEN")]);
         var scope = nonEmpty(process.env["".concat(prefix, "_TOKEN_SCOPE")]);
-        result = _object_spread_props$p(_object_spread$G({
+        result = _object_spread_props$r(_object_spread$H({
             accessToken: accessToken !== null && accessToken !== void 0 ? accessToken : '',
             refreshToken: refreshToken,
             // No reliable expiry is supplied via env, so force a refresh on first use (expiresAt 0 = expired).
@@ -5034,7 +5035,7 @@ function nonEmpty(value) {
     return result;
 }
 
-function asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -5048,22 +5049,22 @@ function asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$14(fn) {
+function _async_to_generator$13(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$14(thisArg, body) {
+function _ts_generator$13(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5190,9 +5191,9 @@ function _ts_generator$14(thisArg, body) {
  * @param input - Resolution inputs.
  * @returns The resolved env triple.
  */ function resolveCliEnv(input) {
-    return _async_to_generator$14(function() {
+    return _async_to_generator$13(function() {
         var _ref, _input_envVarName, _ref1, _input_flagEnv, _config_envs, _findCliEnvDefault, config, envVarName, envName, stored, defaultEnv, merged, env;
-        return _ts_generator$14(this, function(_state) {
+        return _ts_generator$13(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -5231,9 +5232,9 @@ function _ts_generator$14(thisArg, body) {
     })();
 }
 function resolveCliEnvOrThrow(input) {
-    return _async_to_generator$14(function() {
+    return _async_to_generator$13(function() {
         var _ref, config, envName, env;
-        return _ts_generator$14(this, function(_state) {
+        return _ts_generator$13(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -5328,7 +5329,7 @@ function resolveCliEnvOrThrow(input) {
     }).hasExpired();
 }
 
-function asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -5342,22 +5343,22 @@ function asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$13(fn) {
+function _async_to_generator$12(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$F(obj, key, value) {
+function _define_property$G(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -5378,7 +5379,7 @@ function _instanceof$l(left, right) {
         return left instanceof right;
     }
 }
-function _object_spread$F(target) {
+function _object_spread$G(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -5388,12 +5389,31 @@ function _object_spread$F(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$F(target, key, source[key]);
+            _define_property$G(target, key, source[key]);
         });
     }
     return target;
 }
-function _ts_generator$13(thisArg, body) {
+function ownKeys$q(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$q(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$q(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _ts_generator$12(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5492,842 +5512,268 @@ function _ts_generator$13(thisArg, body) {
         };
     }
 }
+// The CLI's fetch transport: the global `fetch` wrapped with verbose tracing + the configured
+// `--timeout`. A plain transport — it injects no `Authorization` header (public + confidential
+// clients authenticate via `code_verifier` / `client_secret`, not a bearer token).
+var cliOidcFetch = function cliOidcFetch(input, init) {
+    return tracedFetch(undefined, input, init);
+};
 /**
- * Builds the ordered list of `.well-known/openid-configuration` URLs the CLI probes when
- * discovering OIDC metadata.
- *
- *   1. `<issuer>/.well-known/openid-configuration` (OpenID Connect Discovery 1.0).
- *   2. `<issuer-origin>/.well-known/openid-configuration` (host-rooted; matches projects that
- *      mount the discovery controller at the API/dev-server root rather than under the issuer
- *      sub-path — e.g. demo's `OidcWellKnownController`).
- *   3. `<fallbackBaseUrl>/.well-known/openid-configuration` when supplied and not already covered.
- *
- * Exported so diagnostic surfaces (e.g. `doctor`) can show the exact URLs the discovery step
- * tried — without re-implementing the candidate ordering.
- *
- * @param input - The discovery request.
- * @param input.issuer - The OIDC issuer URL whose `.well-known/openid-configuration` is fetched first.
- * @param input.fallbackBaseUrl - Optional sibling base URL appended after the issuer-prefixed and origin-rooted candidates.
- * @returns The candidate URL list in probe order, de-duplicated.
- */ function buildOidcDiscoveryCandidates(input) {
-    var candidates = [
-        "".concat(trimSlash(input.issuer), "/.well-known/openid-configuration")
-    ];
-    try {
-        var originCandidate = "".concat(new URL(input.issuer).origin, "/.well-known/openid-configuration");
-        if (!candidates.includes(originCandidate)) {
-            candidates.push(originCandidate);
-        }
-    } catch (unused) {
-    // Issuer URL didn't parse — skip the origin-rooted candidate and let the explicit fallback handle it.
+ * Maps each shared {@link OidcRelyingPartyErrorCode} back onto the CLI's historical error code +
+ * suggestion, so refactoring the implementation onto the shared core does not change the
+ * `{ ok: false, code, suggestion }` envelope users and scripts depend on.
+ */ var OIDC_ERROR_CODE_MAP = {
+    DISCOVERY_FAILED: {
+        code: 'OIDC_DISCOVERY_FAILED',
+        suggestion: 'Verify the env oidcIssuer URL is reachable and serves /.well-known/openid-configuration.'
+    },
+    TOKEN_INVALID_GRANT: {
+        code: 'TOKEN_INVALID_GRANT',
+        suggestion: 'Re-run auth login to obtain a fresh code or refresh token.'
+    },
+    TOKEN_EXCHANGE_FAILED: {
+        code: 'TOKEN_EXCHANGE_FAILED'
+    },
+    TOKEN_REVOCATION_FAILED: {
+        code: 'TOKEN_REVOCATION_FAILED'
+    },
+    USERINFO_FAILED: {
+        code: 'USERINFO_FAILED',
+        suggestion: 'Try: <cli> auth login --env <name>'
+    },
+    SESSION_INFO_FAILED: {
+        code: 'SESSION_INFO_FAILED'
+    },
+    AUTH_NO_CODE: {
+        code: 'AUTH_NO_CODE'
+    },
+    AUTH_PROVIDER_ERROR: {
+        code: 'AUTH_PROVIDER_ERROR'
+    },
+    AUTH_REDIRECT_PARSE_FAILED: {
+        code: 'AUTH_REDIRECT_PARSE_FAILED'
+    },
+    INVALID_STATE: {
+        code: 'AUTH_STATE_MISMATCH'
+    },
+    INVALID_SESSION_TTL: {
+        code: 'AUTH_LOGIN_FOR_INVALID'
     }
-    if (input.fallbackBaseUrl) {
-        var fallbackCandidate = "".concat(trimSlash(input.fallbackBaseUrl), "/.well-known/openid-configuration");
-        if (!candidates.includes(fallbackCandidate)) {
-            candidates.push(fallbackCandidate);
-        }
+};
+/**
+ * Converts an {@link OidcRelyingPartyError} thrown by the shared core into the CLI's {@link CliError}
+ * (preserving message + mapped code + suggestion). Any other value is returned unchanged.
+ *
+ * @param error - The thrown value.
+ * @returns A {@link CliError} for relying-party errors, otherwise the original value.
+ */ function oidcRelyingPartyErrorToCliError(error) {
+    var result = error;
+    if (_instanceof$l(error, util.OidcRelyingPartyError)) {
+        var mapped = OIDC_ERROR_CODE_MAP[error.code];
+        result = new CliError(_object_spread$G({
+            message: error.message,
+            code: mapped.code
+        }, mapped.suggestion ? {
+            suggestion: mapped.suggestion
+        } : {}));
     }
-    return candidates;
+    return result;
 }
-/**
- * Fetches the OIDC discovery document for the given issuer, trying the candidates returned by
- * {@link buildOidcDiscoveryCandidates} in order.
- *
- * @param input - The discovery request.
- * @param input.issuer - The OIDC issuer URL whose `.well-known/openid-configuration` is fetched first.
- * @param input.fallbackBaseUrl - Optional sibling base URL tried after the issuer-prefixed and origin-rooted candidates.
- * @returns The parsed {@link OidcDiscoveryMetadata}. Throws a {@link CliError} (`OIDC_DISCOVERY_FAILED`) when every candidate fails.
- */ function discoverOidcMetadata(input) {
-    return _async_to_generator$13(function() {
-        var _ref, candidates, lastError, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, url, res, e, err;
-        return _ts_generator$13(this, function(_state) {
+function withCliErrors(fn) {
+    return _async_to_generator$12(function() {
+        var e;
+        return _ts_generator$12(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    candidates = buildOidcDiscoveryCandidates(input);
-                    _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-                    _state.label = 1;
-                case 1:
                     _state.trys.push([
-                        1,
-                        10,
-                        11,
-                        12
-                    ]);
-                    _iterator = candidates[Symbol.iterator]();
-                    _state.label = 2;
-                case 2:
-                    if (!!(_iteratorNormalCompletion = (_step = _iterator.next()).done)) return [
-                        3,
-                        9
-                    ];
-                    url = _step.value;
-                    _state.label = 3;
-                case 3:
-                    _state.trys.push([
-                        3,
-                        7,
+                        0,
+                        2,
                         ,
-                        8
+                        3
                     ]);
                     return [
                         4,
-                        tracedFetch(undefined, url, {
-                            headers: {
-                                Accept: 'application/json'
-                            }
-                        })
-                    ];
-                case 4:
-                    res = _state.sent();
-                    if (!res.ok) return [
-                        3,
-                        6
-                    ];
-                    return [
-                        4,
-                        res.json()
+                        fn()
                     ];
-                case 5:
+                case 1:
                     return [
                         2,
                         _state.sent()
                     ];
-                case 6:
-                    lastError = new Error("OIDC discovery failed at ".concat(url, ": ").concat(res.status, " ").concat(res.statusText));
-                    return [
-                        3,
-                        8
-                    ];
-                case 7:
+                case 2:
                     e = _state.sent();
-                    lastError = new Error("OIDC discovery failed at ".concat(url, ": ").concat(_instanceof$l(e, Error) ? e.message : String(e)));
-                    return [
-                        3,
-                        8
-                    ];
-                case 8:
-                    _iteratorNormalCompletion = true;
+                    throw oidcRelyingPartyErrorToCliError(e);
+                case 3:
                     return [
-                        3,
                         2
                     ];
-                case 9:
-                    return [
-                        3,
-                        12
-                    ];
-                case 10:
-                    err = _state.sent();
-                    _didIteratorError = true;
-                    _iteratorError = err;
-                    return [
-                        3,
-                        12
-                    ];
-                case 11:
-                    try {
-                        if (!_iteratorNormalCompletion && _iterator.return != null) {
-                            _iterator.return();
-                        }
-                    } finally{
-                        if (_didIteratorError) {
-                            throw _iteratorError;
-                        }
-                    }
-                    return [
-                        7
-                    ];
-                case 12:
-                    throw new CliError({
-                        message: (_ref = lastError === null || lastError === void 0 ? void 0 : lastError.message) !== null && _ref !== void 0 ? _ref : "OIDC discovery failed for all candidates: ".concat(candidates.join(', ')),
-                        code: 'OIDC_DISCOVERY_FAILED',
-                        suggestion: 'Verify the env oidcIssuer URL is reachable and serves /.well-known/openid-configuration.'
-                    });
             }
         });
     })();
 }
 /**
- * Exchanges an authorization code (from the redirect) for an access token + refresh token.
+ * Fetches the OIDC discovery document for the given issuer.
  *
- * Uses `client_secret_post` auth — the demo's oidc-provider config registers clients with that method.
+ * @param input - The discovery request.
+ * @returns The parsed {@link OidcDiscoveryMetadata}. Throws a {@link CliError} (`OIDC_DISCOVERY_FAILED`) when every candidate fails.
+ */ function discoverOidcMetadata(input) {
+    return withCliErrors(function() {
+        return oidc.discoverOidcMetadata(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
+}
+/**
+ * Exchanges an authorization code (from the redirect) for an access token + refresh token.
  *
  * @param input - The token exchange parameters.
- * @param input.tokenEndpoint - The OIDC token endpoint URL discovered from the issuer.
- * @param input.clientId - The OAuth client ID.
- * @param input.clientSecret - The OAuth client secret used for `client_secret_post` auth.
- * @param input.redirectUri - The redirect URI registered with the OAuth client (must match the value used when requesting the code).
- * @param input.code - The authorization code returned to the redirect URI.
- * @param input.codeVerifier - The PKCE code verifier originally paired with the code challenge in the authorization request.
  * @returns The parsed {@link OidcTokenResponse} with access/refresh tokens.
  */ function exchangeAuthorizationCode(input) {
-    return _async_to_generator$13(function() {
-        var params;
-        return _ts_generator$13(this, function(_state) {
-            params = new URLSearchParams({
-                grant_type: 'authorization_code',
-                client_id: input.clientId,
-                client_secret: input.clientSecret,
-                redirect_uri: input.redirectUri,
-                code: input.code,
-                code_verifier: input.codeVerifier
-            });
-            return [
-                2,
-                postTokenEndpoint({
-                    tokenEndpoint: input.tokenEndpoint,
-                    body: params
-                })
-            ];
-        });
-    })();
+    return withCliErrors(function() {
+        return oidc.exchangeAuthorizationCode(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
 }
 /**
  * Exchanges a refresh token for a new access token (and possibly a rotated refresh token).
  *
  * @param input - The refresh request.
- * @param input.tokenEndpoint - The OIDC token endpoint URL discovered from the issuer.
- * @param input.clientId - The OAuth client ID.
- * @param input.clientSecret - The OAuth client secret used for `client_secret_post` auth.
- * @param input.refreshToken - The cached refresh token to redeem.
  * @returns The parsed {@link OidcTokenResponse} with the refreshed access token.
  */ function refreshAccessToken(input) {
-    return _async_to_generator$13(function() {
-        var params;
-        return _ts_generator$13(this, function(_state) {
-            params = new URLSearchParams({
-                grant_type: 'refresh_token',
-                client_id: input.clientId,
-                client_secret: input.clientSecret,
-                refresh_token: input.refreshToken
-            });
-            return [
-                2,
-                postTokenEndpoint({
-                    tokenEndpoint: input.tokenEndpoint,
-                    body: params
-                })
-            ];
-        });
-    })();
+    return withCliErrors(function() {
+        return oidc.refreshAccessToken(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
 }
 /**
  * Revokes an access or refresh token at the OIDC revocation endpoint.
  *
  * @param input - The revocation request.
- * @param input.revocationEndpoint - The OIDC revocation endpoint URL.
- * @param input.clientId - The OAuth client ID used for `client_secret_post` auth.
- * @param input.clientSecret - The OAuth client secret used for `client_secret_post` auth.
- * @param input.token - The access or refresh token to revoke.
- * @param input.tokenTypeHint - Optional hint passed as `token_type_hint` (`access_token` or `refresh_token`).
  * @returns Resolves when the server returns a non-error status. Throws a {@link CliError} (`TOKEN_REVOCATION_FAILED`) on error.
  */ function revokeToken(input) {
-    return _async_to_generator$13(function() {
-        var params, res;
-        return _ts_generator$13(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    params = new URLSearchParams(_object_spread$F({
-                        client_id: input.clientId,
-                        client_secret: input.clientSecret,
-                        token: input.token
-                    }, input.tokenTypeHint ? {
-                        token_type_hint: input.tokenTypeHint
-                    } : {}));
-                    return [
-                        4,
-                        tracedFetch(undefined, input.revocationEndpoint, {
-                            method: 'POST',
-                            headers: {
-                                'Content-Type': 'application/x-www-form-urlencoded',
-                                Accept: 'application/json'
-                            },
-                            body: params.toString()
-                        })
-                    ];
-                case 1:
-                    res = _state.sent();
-                    if (!res.ok) {
-                        throw new CliError({
-                            message: "Token revocation failed: ".concat(res.status, " ").concat(res.statusText),
-                            code: 'TOKEN_REVOCATION_FAILED'
-                        });
-                    }
-                    return [
-                        2
-                    ];
-            }
-        });
-    })();
+    return withCliErrors(function() {
+        return oidc.revokeToken(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
 }
 /**
  * Fetches the OIDC `userinfo` endpoint and returns the parsed claims object.
  *
  * @param input - The userinfo request.
- * @param input.userinfoEndpoint - The OIDC userinfo endpoint URL discovered from the issuer.
- * @param input.accessToken - The Bearer access token sent in the `Authorization` header.
  * @returns The parsed userinfo claims. Throws a {@link CliError} (`USERINFO_FAILED`) on a non-OK response.
  */ function fetchUserInfo(input) {
-    return _async_to_generator$13(function() {
-        var res;
-        return _ts_generator$13(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    return [
-                        4,
-                        tracedFetch(undefined, input.userinfoEndpoint, {
-                            headers: {
-                                Authorization: "Bearer ".concat(input.accessToken),
-                                Accept: 'application/json'
-                            }
-                        })
-                    ];
-                case 1:
-                    res = _state.sent();
-                    if (!res.ok) {
-                        throw new CliError({
-                            message: "Userinfo request failed: ".concat(res.status, " ").concat(res.statusText),
-                            code: 'USERINFO_FAILED',
-                            suggestion: 'Try: <cli> auth login --env <name>'
-                        });
-                    }
-                    return [
-                        4,
-                        res.json()
-                    ];
-                case 2:
-                    return [
-                        2,
-                        _state.sent()
-                    ];
-            }
-        });
-    })();
+    return withCliErrors(function() {
+        return oidc.fetchUserInfo(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
 }
 /**
  * Fetches the dbx-components `GET /oidc/session` route and returns the parsed session lifetime metadata.
  *
- * Mirrors {@link fetchUserInfo}, but reads the access token's baked-in session-lifetime claims
- * (`dbx_session_expires_at` / `dbx_rotation_disabled`) which userinfo does not echo.
- *
  * @param input - The session request.
- * @param input.sessionEndpoint - The `GET /oidc/session` endpoint URL.
- * @param input.accessToken - The Bearer access token sent in the `Authorization` header.
  * @returns The parsed {@link OidcSessionInfo}. Throws a {@link CliError} (`SESSION_INFO_FAILED`) on a non-OK response.
  */ function fetchSessionInfo(input) {
-    return _async_to_generator$13(function() {
-        var res;
-        return _ts_generator$13(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    return [
-                        4,
-                        tracedFetch(undefined, input.sessionEndpoint, {
-                            headers: {
-                                Authorization: "Bearer ".concat(input.accessToken),
-                                Accept: 'application/json'
-                            }
-                        })
-                    ];
-                case 1:
-                    res = _state.sent();
-                    if (!res.ok) {
-                        throw new CliError({
-                            message: "Session info request failed: ".concat(res.status, " ").concat(res.statusText),
-                            code: 'SESSION_INFO_FAILED'
-                        });
-                    }
-                    return [
-                        4,
-                        res.json()
-                    ];
-                case 2:
-                    return [
-                        2,
-                        _state.sent()
-                    ];
-            }
-        });
-    })();
-}
-function postTokenEndpoint(input) {
-    return _async_to_generator$13(function() {
-        var res, body, _ref, _body_error_description, message;
-        return _ts_generator$13(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    return [
-                        4,
-                        tracedFetch(undefined, input.tokenEndpoint, {
-                            method: 'POST',
-                            headers: {
-                                'Content-Type': 'application/x-www-form-urlencoded',
-                                Accept: 'application/json'
-                            },
-                            body: input.body.toString()
-                        })
-                    ];
-                case 1:
-                    res = _state.sent();
-                    return [
-                        4,
-                        res.json().catch(function() {
-                            return {};
-                        })
-                    ];
-                case 2:
-                    body = _state.sent();
-                    if (!res.ok || body.error) {
-                        message = (_ref = (_body_error_description = body.error_description) !== null && _body_error_description !== void 0 ? _body_error_description : body.error) !== null && _ref !== void 0 ? _ref : "".concat(res.status, " ").concat(res.statusText);
-                        throw new CliError({
-                            message: "OIDC token endpoint error: ".concat(message),
-                            code: body.error === 'invalid_grant' ? 'TOKEN_INVALID_GRANT' : 'TOKEN_EXCHANGE_FAILED',
-                            suggestion: body.error === 'invalid_grant' ? 'Re-run auth login to obtain a fresh code or refresh token.' : undefined
-                        });
-                    }
-                    if (!body.access_token) {
-                        throw new CliError({
-                            message: 'OIDC token endpoint returned no access_token.',
-                            code: 'TOKEN_EXCHANGE_FAILED'
-                        });
-                    }
-                    return [
-                        2,
-                        body
-                    ];
-            }
-        });
-    })();
-}
-function trimSlash(url) {
-    return url.endsWith('/') ? url.slice(0, -1) : url;
+    return withCliErrors(function() {
+        return oidc.fetchSessionInfo(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
 }
 
-function _array_like_to_array$$(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_with_holes$f(arr) {
-    if (Array.isArray(arr)) return arr;
-}
-function asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, key, arg) {
-    try {
-        var info = gen[key](arg);
-        var value = info.value;
-    } catch (error) {
-        reject(error);
-        return;
-    }
-    if (info.done) {
-        resolve(value);
+function _define_property$F(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
     } else {
-        Promise.resolve(value).then(_next, _throw);
+        obj[key] = value;
     }
+    return obj;
 }
-function _async_to_generator$12(fn) {
-    return function() {
-        var self = this, args = arguments;
-        return new Promise(function(resolve, reject) {
-            var gen = fn.apply(self, args);
-            function _next(value) {
-                asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, "next", value);
-            }
-            function _throw(err) {
-                asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, "throw", err);
-            }
-            _next(undefined);
-        });
-    };
-}
-function _iterable_to_array_limit$f(arr, i) {
-    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
-    if (_i == null) return;
-    var _arr = [];
-    var _n = true;
-    var _d = false;
-    var _s, _e;
-    try {
-        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
-            _arr.push(_s.value);
-            if (i && _arr.length === i) break;
-        }
-    } catch (err) {
-        _d = true;
-        _e = err;
-    } finally{
-        try {
-            if (!_n && _i["return"] != null) _i["return"]();
-        } finally{
-            if (_d) throw _e;
+function _object_spread$F(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
         }
+        ownKeys.forEach(function(key) {
+            _define_property$F(target, key, source[key]);
+        });
     }
-    return _arr;
-}
-function _non_iterable_rest$f() {
-    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _sliced_to_array$f(arr, i) {
-    return _array_with_holes$f(arr) || _iterable_to_array_limit$f(arr, i) || _unsupported_iterable_to_array$$(arr, i) || _non_iterable_rest$f();
-}
-function _unsupported_iterable_to_array$$(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$$(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$$(o, minLen);
+    return target;
 }
-function _ts_generator$12(thisArg, body) {
-    var f, y, t, _ = {
-        label: 0,
-        sent: function() {
-            if (t[0] & 1) throw t[1];
-            return t[1];
-        },
-        trys: [],
-        ops: []
-    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
-    return d(g, "next", {
-        value: verb(0)
-    }), d(g, "throw", {
-        value: verb(1)
-    }), d(g, "return", {
-        value: verb(2)
-    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
-        value: function() {
-            return this;
-        }
-    }), g;
-    function verb(n) {
-        return function(v) {
-            return step([
-                n,
-                v
-            ]);
-        };
+function ownKeys$p(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
     }
-    function step(op) {
-        if (f) throw new TypeError("Generator is already executing.");
-        while(g && (g = 0, op[0] && (_ = 0)), _)try {
-            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-            if (y = 0, t) op = [
-                op[0] & 2,
-                t.value
-            ];
-            switch(op[0]){
-                case 0:
-                case 1:
-                    t = op;
-                    break;
-                case 4:
-                    _.label++;
-                    return {
-                        value: op[1],
-                        done: false
-                    };
-                case 5:
-                    _.label++;
-                    y = op[1];
-                    op = [
-                        0
-                    ];
-                    continue;
-                case 7:
-                    op = _.ops.pop();
-                    _.trys.pop();
-                    continue;
-                default:
-                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
-                        _ = 0;
-                        continue;
-                    }
-                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
-                        _.label = op[1];
-                        break;
-                    }
-                    if (op[0] === 6 && _.label < t[1]) {
-                        _.label = t[1];
-                        t = op;
-                        break;
-                    }
-                    if (t && _.label < t[2]) {
-                        _.label = t[2];
-                        _.ops.push(op);
-                        break;
-                    }
-                    if (t[2]) _.ops.pop();
-                    _.trys.pop();
-                    continue;
-            }
-            op = body.call(thisArg, _);
-        } catch (e) {
-            op = [
-                6,
-                e
-            ];
-            y = 0;
-        } finally{
-            f = t = 0;
-        }
-        if (op[0] & 5) throw op[1];
-        return {
-            value: op[0] ? op[1] : void 0,
-            done: true
-        };
+    return keys;
+}
+function _object_spread_props$p(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$p(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
     }
+    return target;
 }
 /**
  * Builds the authorization URL the user opens in a browser to start the PKCE flow.
  *
- * The user-facing endpoint is the discovered `authorizationEndpoint` (typically `/oidc/auth`)
- * with its origin optionally rebased. The rebase origin is the first non-empty value among
- * `appClientUrl` → `oidcIssuer` origin → `apiBaseUrl` origin. In a typical single-host
- * deployment all three resolve to the same origin and the rebase is a no-op; in a split-host
- * setup (frontend dev server proxying `/oidc/**` to the API) `appClientUrl` redirects the user
- * through the frontend. When none of the three is provided, the discovered endpoint is used
- * unchanged.
+ * Thin CLI wrapper over the shared {@link buildAuthorizationUrlHelper}: defaults the scope to
+ * {@link DEFAULT_CLI_OIDC_SCOPES} when none is supplied, and re-wraps the shared
+ * {@link OidcRelyingPartyError} into the CLI's {@link CliError} (`AUTH_LOGIN_FOR_INVALID`).
  *
- * Always lands at the actual authorization endpoint so oidc-provider can create an interaction
- * and redirect to the app login page with a `uid`. (Earlier versions targeted a convenience
- * `/oidc/login/client` redirect that forwarded query params to the app without creating an
- * interaction — that branch is gone.)
- *
- * @param input - The authorization URL inputs.
- * @param input.authorizationEndpoint - The authorization endpoint discovered from OIDC metadata.
- * @param input.appClientUrl - Optional client origin to rebase the authorization endpoint onto. Takes precedence over `oidcIssuer` and `apiBaseUrl`.
- * @param input.oidcIssuer - Optional OIDC issuer URL; falls back to its origin as the rebase target when `appClientUrl` is missing.
- * @param input.apiBaseUrl - Optional API base URL; falls back to its origin as the rebase target when neither `appClientUrl` nor `oidcIssuer` is set.
- * @param input.clientId - The OAuth client ID.
- * @param input.redirectUri - The redirect URI registered with the OAuth client.
- * @param input.scopes - Space-separated scope list. Defaults to {@link DEFAULT_CLI_OIDC_SCOPES}.
- * @param input.state - The opaque OAuth state token used for CSRF protection.
- * @param input.codeChallenge - The PKCE code challenge derived from the verifier.
+ * @param input - The authorization URL inputs. When `scopes` is omitted, the CLI default is used.
  * @returns The full authorization URL with all OAuth params merged in.
  * @throws {CliError} When `requestedSessionTtlSeconds` is provided but is not a positive integer.
  *
  * @__NO_SIDE_EFFECTS__
  */ function buildAuthorizationUrl(input) {
-    var _input_scopes;
-    var resolvedScope = (_input_scopes = input.scopes) !== null && _input_scopes !== void 0 ? _input_scopes : DEFAULT_CLI_OIDC_SCOPES;
-    var authParams = {
-        response_type: 'code',
-        client_id: input.clientId,
-        redirect_uri: input.redirectUri,
-        scope: resolvedScope,
-        code_challenge: input.codeChallenge,
-        code_challenge_method: 'S256',
-        state: input.state
-    };
-    // oidc-provider's check_scope middleware silently strips `offline_access` unless the
-    // auth request also includes `prompt=consent`. Auto-add it so refresh tokens are
-    // actually issued whenever the CLI requests offline access.
-    if (resolvedScope.split(/\s+/).includes('offline_access')) {
-        authParams.prompt = 'consent';
-    }
-    if (input.requestedSessionTtlSeconds != null) {
-        if (!Number.isInteger(input.requestedSessionTtlSeconds) || input.requestedSessionTtlSeconds <= 0) {
-            throw new CliError({
-                message: "requestedSessionTtlSeconds must be a positive integer (got ".concat(input.requestedSessionTtlSeconds, ")."),
-                code: 'AUTH_LOGIN_FOR_INVALID'
-            });
-        }
-        authParams.dbx_session_ttl = String(input.requestedSessionTtlSeconds);
-    }
-    var rebaseOrigin = resolveAuthorizationRebaseOrigin({
-        appClientUrl: input.appClientUrl,
-        oidcIssuer: input.oidcIssuer,
-        apiBaseUrl: input.apiBaseUrl
-    });
-    var endpoint = rebaseOrigin ? rebaseUrlOrigin({
-        url: input.authorizationEndpoint,
-        originUrl: rebaseOrigin
-    }) : input.authorizationEndpoint;
-    // Merge into the existing query string (preserving any params already on the endpoint) so
-    // a pre-baked endpoint like `/oidc/auth?source=cli` survives unchanged.
-    var url = new URL(endpoint);
-    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
-        for(var _iterator = Object.entries(authParams)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array$f(_step.value, 2), key = _step_value[0], value = _step_value[1];
-            url.searchParams.set(key, value);
-        }
-    } catch (err) {
-        _didIteratorError = true;
-        _iteratorError = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion && _iterator.return != null) {
-                _iterator.return();
-            }
-        } finally{
-            if (_didIteratorError) {
-                throw _iteratorError;
-            }
-        }
-    }
-    return url.toString();
-}
-/**
- * Picks the origin used to rebase the discovered authorization endpoint, in priority order:
- *   1. `appClientUrl` (verbatim — the explicit override)
- *   2. `oidcIssuer` (parsed `origin`, e.g. `https://api.example.com/oidc` → `https://api.example.com`)
- *   3. `apiBaseUrl` (parsed `origin`, e.g. `https://api.example.com/api` → `https://api.example.com`)
- *
- * Returns `undefined` when none is set or every candidate fails to parse; the caller should then
- * use the discovered endpoint unchanged.
- *
- * @param input - The candidate URLs in priority order.
- * @returns The selected origin, or `undefined` when no candidate yields one.
- */ function resolveAuthorizationRebaseOrigin(input) {
-    var result;
-    if (input.appClientUrl) {
-        result = input.appClientUrl;
-    } else {
-        var _input_oidcIssuer;
-        var fallbackSource = (_input_oidcIssuer = input.oidcIssuer) !== null && _input_oidcIssuer !== void 0 ? _input_oidcIssuer : input.apiBaseUrl;
-        if (fallbackSource) {
-            try {
-                result = new URL(fallbackSource).origin;
-            } catch (unused) {
-            // Fall through with result undefined
-            }
-        }
-    }
-    return result;
-}
-/**
- * Returns `url` with its origin replaced by the origin of `originUrl`. The path and search of
- * `url` are preserved. When `originUrl` is empty/missing or either URL fails to parse, returns
- * `url` unchanged.
- *
- * @param input - The rebase inputs.
- * @param input.url - The URL whose path/search should be preserved.
- * @param input.originUrl - The origin to rebase `url` onto.
- * @returns The rebased URL string, or `input.url` unchanged when rebasing isn't possible.
- */ function rebaseUrlOrigin(input) {
-    var result = input.url;
-    if (input.originUrl) {
-        try {
-            var parsedUrl = new URL(input.url);
-            var parsedOrigin = new URL(input.originUrl);
-            parsedUrl.protocol = parsedOrigin.protocol;
-            parsedUrl.host = parsedOrigin.host;
-            result = parsedUrl.toString();
-        } catch (unused) {
-        // Fall through with the original url unchanged
-        }
-    }
-    return result;
-}
-/**
- * Generates a fresh PKCE code verifier and the matching SHA-256 code challenge.
- *
- * @returns A {@link PkceMaterial} pair consisting of the random `codeVerifier` and its derived `codeChallenge`.
- */ function generatePkceMaterial() {
-    return _async_to_generator$12(function() {
-        var codeVerifier, codeChallenge;
-        return _ts_generator$12(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    codeVerifier = util.generatePkceCodeVerifier();
-                    return [
-                        4,
-                        util.generatePkceCodeChallenge(codeVerifier)
-                    ];
-                case 1:
-                    codeChallenge = _state.sent();
-                    return [
-                        2,
-                        {
-                            codeVerifier: codeVerifier,
-                            codeChallenge: codeChallenge
-                        }
-                    ];
-            }
-        });
-    })();
-}
-/**
- * Generates a random URL-safe state value for the OAuth state parameter.
- *
- * @returns A 32-character hex string derived from 16 random bytes.
- */ function generateOAuthState() {
-    var bytes = new Uint8Array(16);
-    crypto.getRandomValues(bytes);
-    return Array.from(bytes, function(b) {
-        return b.toString(16).padStart(2, '0');
-    }).join('');
-}
-function parseRedirectUrlOrThrow(trimmed) {
-    var url;
-    try {
-        // Native URL doesn't parse all urn: schemes — handle the urn:ietf paste case explicitly
-        url = trimmed.startsWith('urn:') ? new URL("https://placeholder.invalid?".concat(trimmed.split('?').slice(1).join('?'))) : new URL(trimmed);
-    } catch (unused) {
-        throw new CliError({
-            message: 'Could not parse redirect URL',
-            code: 'AUTH_REDIRECT_PARSE_FAILED'
-        });
-    }
-    return url;
-}
-function throwForUrlMissingCode(url) {
-    var errorParam = url.searchParams.get('error');
-    if (errorParam) {
-        var errorDescription = url.searchParams.get('error_description');
-        var descriptionSuffix = errorDescription ? " (".concat(errorDescription, ")") : '';
-        throw new CliError({
-            message: "Authorization server returned an error: ".concat(errorParam).concat(descriptionSuffix),
-            code: 'AUTH_PROVIDER_ERROR'
-        });
-    }
-    throw new CliError({
-        message: 'No `code` parameter found in the pasted URL.',
-        code: 'AUTH_NO_CODE'
-    });
-}
-function parseUrlRedirect(trimmed, expectedState) {
-    var _url_searchParams_get;
-    var url = parseRedirectUrlOrThrow(trimmed);
-    var code = url.searchParams.get('code');
-    if (!code) {
-        throwForUrlMissingCode(url);
-    }
-    var state = (_url_searchParams_get = url.searchParams.get('state')) !== null && _url_searchParams_get !== void 0 ? _url_searchParams_get : undefined;
-    if (expectedState && state !== expectedState) {
-        throw new CliError({
-            message: 'OAuth state mismatch — possible CSRF or stale flow.',
-            code: 'AUTH_STATE_MISMATCH'
-        });
+        var _input_scopes;
+        return util.buildAuthorizationUrl(_object_spread_props$p(_object_spread$F({}, input), {
+            scopes: (_input_scopes = input.scopes) !== null && _input_scopes !== void 0 ? _input_scopes : DEFAULT_CLI_OIDC_SCOPES
+        }));
+    } catch (e) {
+        throw oidcRelyingPartyErrorToCliError(e);
     }
-    return {
-        code: code,
-        state: state
-    };
 }
 /**
  * Parses an authorization code out of a pasted redirect URL or a bare code string.
  *
- * Validates the `state` parameter when an expected value is provided.
+ * Thin CLI wrapper over the shared {@link parseAuthorizationRedirect}: keeps the CLI's pasted-string
+ * input shape and re-wraps the shared {@link OidcRelyingPartyError} into the CLI's {@link CliError}
+ * (`AUTH_NO_CODE` / `AUTH_PROVIDER_ERROR` / `AUTH_REDIRECT_PARSE_FAILED` / `AUTH_STATE_MISMATCH`).
  *
  * @param input - The parse inputs.
  * @param input.pasted - The redirect URL or bare authorization code pasted by the user.
  * @param input.expectedState - Optional state value to assert against `state` when present in the URL.
  * @returns The {@link ParsedRedirect} containing `code` and (when present) `state`.
- * @throws {CliError} When `pasted` is empty, when the URL contains no `code` parameter, or when `expectedState` does not match the URL's `state`.
+ * @throws {CliError} When `pasted` is empty, contains no `code`, or the `state` does not match.
  */ function parsePastedRedirect(input) {
-    var trimmed = input.pasted.trim();
-    if (!trimmed) {
-        throw new CliError({
-            message: 'No code or redirect URL was provided.',
-            code: 'AUTH_NO_CODE'
+    try {
+        return util.parseAuthorizationRedirect({
+            url: input.pasted,
+            expectedState: input.expectedState
         });
+    } catch (e) {
+        throw oidcRelyingPartyErrorToCliError(e);
     }
-    var isUrl = trimmed.startsWith('http://') || trimmed.startsWith('https://') || trimmed.startsWith('urn:');
-    return isUrl ? parseUrlRedirect(trimmed, input.expectedState) : {
-        code: trimmed
-    };
 }
 
 /**
@@ -6971,11 +6417,11 @@ function resolveAuthSetupPrompt(input) {
                             meta = _state.sent();
                             return [
                                 4,
-                                generatePkceMaterial()
+                                util.generatePkceMaterial()
                             ];
                         case 3:
                             _ref2 = _state.sent(), codeVerifier = _ref2.codeVerifier, codeChallenge = _ref2.codeChallenge;
-                            state = generateOAuthState();
+                            state = util.generateOAuthState();
                             requestedScopes = argv.readOnlyScopes ? filterReadOnlyModelScopes(env.scopes) : env.scopes;
                             if (argv.serviceToken) {
                                 // Adds token.service + offline_access (de-duped); applied after the read-only filter so a
@@ -7721,7 +7167,7 @@ function _ts_generator$10(thisArg, body) {
                                 3,
                                 5
                             ];
-                            candidates = buildOidcDiscoveryCandidates({
+                            candidates = util.buildOidcDiscoveryCandidates({
                                 issuer: env.oidcIssuer,
                                 fallbackBaseUrl: env.apiBaseUrl
                             });
@@ -60033,7 +59479,6 @@ exports.buildMcpToolName = buildMcpToolName;
 exports.buildModelDecodeCommand = buildModelDecodeCommand;
 exports.buildModelInfoCommand = buildModelInfoCommand;
 exports.buildModelSnapshotFieldsManifest = buildModelSnapshotFieldsManifest;
-exports.buildOidcDiscoveryCandidates = buildOidcDiscoveryCandidates;
 exports.buildPipesManifest = buildPipesManifest;
 exports.buildRouteManifest = buildRouteManifest;
 exports.buildRouteTree = buildRouteTree;
@@ -60120,8 +59565,6 @@ exports.findAndLoadConfig = findAndLoadConfig;
 exports.findCliEnvDefault = findCliEnvDefault;
 exports.findCliModelManifestEntry = findCliModelManifestEntry;
 exports.flattenList = flattenList;
-exports.generateOAuthState = generateOAuthState;
-exports.generatePkceMaterial = generatePkceMaterial;
 exports.getBundledManifestsDirectory = getBundledManifestsDirectory;
 exports.getCliContext = getCliContext;
 exports.getCliEnvVarName = getCliEnvVarName;
@@ -60206,6 +59649,7 @@ exports.mergeCliConfig = mergeCliConfig;
 exports.mergeCliEnvWithDefault = mergeCliEnvWithDefault;
 exports.mergeOutputConfig = mergeOutputConfig;
 exports.normalizePathname = normalizePathname;
+exports.oidcRelyingPartyErrorToCliError = oidcRelyingPartyErrorToCliError;
 exports.openStreamingDump = openStreamingDump;
 exports.outputError = outputError;
 exports.outputResult = outputResult;