@dereekb/dbx-cli 13.23.0 → 13.25.0

package/index.esm.js

@@ -2,10 +2,11 @@ import { existsSync, mkdirSync, writeFileSync, appendFileSync } from 'node:fs';
 import { join, resolve, sep, basename, relative, posix, dirname, isAbsolute } from 'node:path';
 import { CALL_MODEL_OIDC_SCOPES, CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, CALL_MODEL_OIDC_SCOPE_PREFIX, STORAGE_FILE_UPLOAD_USER_ROLE } from '@dereekb/firebase';
 export { CALL_MODEL_APP_FUNCTION_KEY } from '@dereekb/firebase';
-import { performAsyncTasks, compareStrings, expirationDetails, generatePkceCodeVerifier, generatePkceCodeChallenge, noop, MS_IN_SECOND, AUTH_TOS_SIGNED_ROLE, AUTH_ONBOARDED_ROLE, AUTH_ADMIN_ROLE, AUTH_USER_ROLE } from '@dereekb/util';
+import { performAsyncTasks, compareStrings, expirationDetails, OidcRelyingPartyError, buildAuthorizationUrl as buildAuthorizationUrl$1, parseAuthorizationRedirect, noop, generateOAuthState, generatePkceMaterial, MS_IN_SECOND, buildOidcDiscoveryCandidates, AUTH_TOS_SIGNED_ROLE, AUTH_ONBOARDED_ROLE, AUTH_ADMIN_ROLE, AUTH_USER_ROLE } from '@dereekb/util';
 import { durationDataToMilliseconds, parseDurationString } from '@dereekb/date';
 import { readJsonFile, writeJsonFile, createMemoizedJsonFileAsyncKeyedValueCache } from '@dereekb/nestjs';
 import { homedir } from 'node:os';
+import { discoverOidcMetadata as discoverOidcMetadata$1, exchangeAuthorizationCode as exchangeAuthorizationCode$1, refreshAccessToken as refreshAccessToken$1, revokeToken as revokeToken$1, fetchUserInfo as fetchUserInfo$1, fetchSessionInfo as fetchSessionInfo$1 } from '@dereekb/util/oidc';
 import { createInterface } from 'node:readline';
 import { arktypeToJsonSchemaForExport } from '@dereekb/model';
 import yargs from 'yargs';
@@ -16,13 +17,13 @@ import { Node, SyntaxKind, Project } from 'ts-morph';
 import { fileURLToPath } from 'node:url';
 import { normalize, join as join$1, dirname as dirname$1 } from 'node:path/posix';
 
-function _array_like_to_array$17(arr, len) {
+function _array_like_to_array$16(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
 function _array_without_holes$$(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$17(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$16(arr);
 }
 function _assert_this_initialized(self) {
     if (self === void 0) {
@@ -30,7 +31,7 @@ function _assert_this_initialized(self) {
     }
     return self;
 }
-function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -44,16 +45,16 @@ function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1f(fn) {
+function _async_to_generator$1e(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -85,7 +86,7 @@ function _construct(Parent, args, Class) {
     }
     return _construct.apply(null, arguments);
 }
-function _define_property$M(obj, key, value) {
+function _define_property$N(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -134,7 +135,7 @@ function _iterable_to_array$$(iter) {
 function _non_iterable_spread$$() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$M(target) {
+function _object_spread$N(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -144,12 +145,12 @@ function _object_spread$M(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$M(target, key, source[key]);
+            _define_property$N(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$u(object, enumerableOnly) {
+function ownKeys$w(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -157,12 +158,12 @@ function ownKeys$u(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$u(target, source) {
+function _object_spread_props$w(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$u(Object(source)).forEach(function(key) {
+        ownKeys$w(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -182,19 +183,19 @@ function _set_prototype_of(o, p) {
     return _set_prototype_of(o, p);
 }
 function _to_consumable_array$$(arr) {
-    return _array_without_holes$$(arr) || _iterable_to_array$$(arr) || _unsupported_iterable_to_array$17(arr) || _non_iterable_spread$$();
+    return _array_without_holes$$(arr) || _iterable_to_array$$(arr) || _unsupported_iterable_to_array$16(arr) || _non_iterable_spread$$();
 }
 function _type_of$2(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$17(o, minLen) {
+function _unsupported_iterable_to_array$16(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$17(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$16(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$17(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$16(o, minLen);
 }
 function _wrap_native_super(Class) {
     var _cache = typeof Map === "function" ? new Map() : undefined;
@@ -230,7 +231,7 @@ function _is_native_reflect_construct() {
         return !!result;
     })();
 }
-function _ts_generator$1f(thisArg, body) {
+function _ts_generator$1e(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -414,10 +415,10 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
  * @param init - The RequestInit. Any existing `signal` is preserved; we only attach our own when no signal was supplied.
  * @returns The fetch Response.
  */ function tracedFetch(fetcher, input, init) {
-    return _async_to_generator$1f(function() {
+    return _async_to_generator$1e(function() {
         var _ref, fetchImpl, timeoutMs, method, url, controller, timeoutHandle, finalInit, // Don't let the abort timer itself keep the Node event loop (or a test worker) alive.
         _timeoutHandle_unref, localController, e;
-        return _ts_generator$1f(this, function(_state) {
+        return _ts_generator$1e(this, function(_state) {
             switch(_state.label){
                 case 0:
                     fetchImpl = fetcher !== null && fetcher !== void 0 ? fetcher : fetch;
@@ -439,7 +440,7 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
                             return localController.abort();
                         }, timeoutMs);
                         (_timeoutHandle_unref = timeoutHandle.unref) === null || _timeoutHandle_unref === void 0 ? void 0 : _timeoutHandle_unref.call(timeoutHandle);
-                        finalInit = _object_spread_props$u(_object_spread$M({}, init), {
+                        finalInit = _object_spread_props$w(_object_spread$N({}, init), {
                             signal: localController.signal
                         });
                     }
@@ -588,7 +589,7 @@ function dumpResponse(data, meta) {
     if (!filePath) {
         return;
     }
-    var content = _object_spread$M({
+    var content = _object_spread$N({
         ok: true,
         data: data
     }, meta ? {
@@ -665,7 +666,7 @@ function stringifyEnvelope(value) {
  */ function outputResult(data, meta) {
     dumpResponse(data, meta);
     var outputData = _outputOptions.pick ? pickFields(data, _outputOptions.pick) : data;
-    var output = _object_spread$M({
+    var output = _object_spread$N({
         ok: true,
         data: outputData
     }, meta ? {
@@ -694,7 +695,7 @@ function stringifyEnvelope(value) {
         var _this;
         _this = _call_super(this, CliError, [
             input.message
-        ]), _define_property$M(_this, "code", void 0), _define_property$M(_this, "suggestion", void 0);
+        ]), _define_property$N(_this, "code", void 0), _define_property$N(_this, "suggestion", void 0);
         _this.name = 'CliError';
         _this.code = input.code;
         _this.suggestion = input.suggestion;
@@ -722,7 +723,7 @@ function stringifyEnvelope(value) {
     if (mapped) {
         result = mapped;
     } else if (_instanceof$o(error, CliError)) {
-        result = _object_spread$M({
+        result = _object_spread$N({
             ok: false,
             error: sanitizeString(error.message),
             code: error.code
@@ -745,15 +746,15 @@ function stringifyEnvelope(value) {
     return result;
 }
 
-function _array_like_to_array$16(arr, len) {
+function _array_like_to_array$15(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
 function _array_without_holes$_(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$16(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$15(arr);
 }
-function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -767,22 +768,22 @@ function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1e(fn) {
+function _async_to_generator$1d(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$L(obj, key, value) {
+function _define_property$M(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -801,7 +802,7 @@ function _iterable_to_array$_(iter) {
 function _non_iterable_spread$_() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$L(target) {
+function _object_spread$M(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -811,12 +812,12 @@ function _object_spread$L(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$L(target, key, source[key]);
+            _define_property$M(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$t(object, enumerableOnly) {
+function ownKeys$v(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -824,33 +825,33 @@ function ownKeys$t(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$t(target, source) {
+function _object_spread_props$v(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$t(Object(source)).forEach(function(key) {
+        ownKeys$v(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
 function _to_consumable_array$_(arr) {
-    return _array_without_holes$_(arr) || _iterable_to_array$_(arr) || _unsupported_iterable_to_array$16(arr) || _non_iterable_spread$_();
+    return _array_without_holes$_(arr) || _iterable_to_array$_(arr) || _unsupported_iterable_to_array$15(arr) || _non_iterable_spread$_();
 }
 function _type_of$1(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$16(o, minLen) {
+function _unsupported_iterable_to_array$15(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$16(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$15(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$16(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$15(o, minLen);
 }
-function _ts_generator$1e(thisArg, body) {
+function _ts_generator$1d(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -962,14 +963,14 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The call envelope describing the API target, access token, model params, and optional fetch override.
  * @returns The parsed JSON response body cast to `R`.
  */ function callModelOverHttp(input) {
-    return _async_to_generator$1e(function() {
+    return _async_to_generator$1d(function() {
         var _input_params_call;
-        return _ts_generator$1e(this, function(_state) {
+        return _ts_generator$1d(this, function(_state) {
             return [
                 2,
                 requestJson({
                     method: 'POST',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl)).concat(CALL_MODEL_API_PATH),
+                    url: "".concat(trimSlash(input.apiBaseUrl)).concat(CALL_MODEL_API_PATH),
                     accessToken: input.accessToken,
                     jsonBody: input.params,
                     fetcher: input.fetcher,
@@ -992,13 +993,13 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The request envelope describing the API target, access token, model + key, and optional fetch override.
  * @returns The parsed `{ key, data }` envelope.
  */ function getModelOverHttp(input) {
-    return _async_to_generator$1e(function() {
-        return _ts_generator$1e(this, function(_state) {
+    return _async_to_generator$1d(function() {
+        return _ts_generator$1d(this, function(_state) {
             return [
                 2,
                 requestJson({
                     method: 'GET',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get?key=").concat(encodeURIComponent(input.key)),
+                    url: "".concat(trimSlash(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get?key=").concat(encodeURIComponent(input.key)),
                     accessToken: input.accessToken,
                     fetcher: input.fetcher,
                     errorPrefix: "get ".concat(input.modelType, "/").concat(input.key, " failed")
@@ -1021,8 +1022,8 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The request envelope describing the API target, access token, model, keys, and optional fetch override.
  * @returns The parsed `{ results, errors }` envelope.
  */ function getMultipleModelsOverHttp(input) {
-    return _async_to_generator$1e(function() {
-        return _ts_generator$1e(this, function(_state) {
+    return _async_to_generator$1d(function() {
+        return _ts_generator$1d(this, function(_state) {
             if (input.keys.length === 0) {
                 throw new CliError({
                     message: 'get-many requires at least one key.',
@@ -1039,7 +1040,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                 2,
                 requestJson({
                     method: 'POST',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get"),
+                    url: "".concat(trimSlash(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get"),
                     accessToken: input.accessToken,
                     jsonBody: {
                         keys: input.keys
@@ -1060,9 +1061,9 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - Same shape as {@link GetMultipleModelsOverHttpInput} but without the 50-key cap.
  * @returns The merged `{ results, errors }` envelope across all chunks.
  */ function getMultipleModelsOverHttpChunked(input) {
-    return _async_to_generator$1e(function() {
+    return _async_to_generator$1d(function() {
         var chunks, i, mergedResults, mergedErrors, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, chunk, _mergedResults, _mergedErrors, batch, err;
-        return _ts_generator$1e(this, function(_state) {
+        return _ts_generator$1d(this, function(_state) {
             switch(_state.label){
                 case 0:
                     if (input.keys.length === 0) {
@@ -1096,7 +1097,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                     chunk = _step.value;
                     return [
                         4,
-                        getMultipleModelsOverHttp(_object_spread_props$t(_object_spread$L({}, input), {
+                        getMultipleModelsOverHttp(_object_spread_props$v(_object_spread$M({}, input), {
                             keys: chunk
                         }))
                     ];
@@ -1150,15 +1151,15 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
     })();
 }
 function requestJson(input) {
-    return _async_to_generator$1e(function() {
+    return _async_to_generator$1d(function() {
         var hasJsonBody, init, res, _ref, ok, body, fallbackMessage;
-        return _ts_generator$1e(this, function(_state) {
+        return _ts_generator$1d(this, function(_state) {
             switch(_state.label){
                 case 0:
                     hasJsonBody = input.jsonBody !== undefined;
-                    init = _object_spread$L({
+                    init = _object_spread$M({
                         method: input.method,
-                        headers: _object_spread$L({
+                        headers: _object_spread$M({
                             Accept: 'application/json',
                             Authorization: "Bearer ".concat(input.accessToken)
                         }, hasJsonBody ? {
@@ -1195,9 +1196,9 @@ function requestJson(input) {
     })();
 }
 function readJsonResponse(res) {
-    return _async_to_generator$1e(function() {
+    return _async_to_generator$1d(function() {
         var text, body;
-        return _ts_generator$1e(this, function(_state) {
+        return _ts_generator$1d(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -1249,7 +1250,7 @@ function codeForStatus(status) {
     }
     return result;
 }
-function trimSlash$1(url) {
+function trimSlash(url) {
     return url.endsWith('/') ? url.slice(0, -1) : url;
 }
 
@@ -1353,7 +1354,7 @@ var getCliContext = _cliContextSlot.get;
     };
 }
 
-function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1367,22 +1368,22 @@ function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1d(fn) {
+function _async_to_generator$1c(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1d(thisArg, body) {
+function _ts_generator$1c(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1495,9 +1496,9 @@ function _ts_generator$1d(thisArg, body) {
  */ function wrapCommandHandler(handler) {
     var exitCode = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : CLI_EXIT_CODE_HANDLER;
     return function(argv) {
-        return _async_to_generator$1d(function() {
+        return _async_to_generator$1c(function() {
             var e;
-            return _ts_generator$1d(this, function(_state) {
+            return _ts_generator$1c(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         _state.trys.push([
@@ -1558,7 +1559,7 @@ function _ts_generator$1d(thisArg, body) {
     };
 }
 
-function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1572,22 +1573,22 @@ function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1c(fn) {
+function _async_to_generator$1b(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1c(thisArg, body) {
+function _ts_generator$1b(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1707,9 +1708,9 @@ function _ts_generator$1c(thisArg, body) {
             return spec.helpEpilogue ? built.epilogue(spec.helpEpilogue) : built;
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1c(function() {
+            return _async_to_generator$1b(function() {
                 var context, result;
-                return _ts_generator$1c(this, function(_state) {
+                return _ts_generator$1b(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             context = requireCliContext();
@@ -1733,21 +1734,21 @@ function _ts_generator$1c(thisArg, body) {
     };
 }
 
-function _array_like_to_array$15(arr, len) {
+function _array_like_to_array$14(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$j(arr) {
+function _array_with_holes$i(arr) {
     if (Array.isArray(arr)) return arr;
 }
 function _array_without_holes$Z(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$15(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$14(arr);
 }
 function _iterable_to_array$Z(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$j(arr, i) {
+function _iterable_to_array_limit$i(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -1771,25 +1772,25 @@ function _iterable_to_array_limit$j(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$j() {
+function _non_iterable_rest$i() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _non_iterable_spread$Z() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$j(arr, i) {
-    return _array_with_holes$j(arr) || _iterable_to_array_limit$j(arr, i) || _unsupported_iterable_to_array$15(arr, i) || _non_iterable_rest$j();
+function _sliced_to_array$i(arr, i) {
+    return _array_with_holes$i(arr) || _iterable_to_array_limit$i(arr, i) || _unsupported_iterable_to_array$14(arr, i) || _non_iterable_rest$i();
 }
 function _to_consumable_array$Z(arr) {
-    return _array_without_holes$Z(arr) || _iterable_to_array$Z(arr) || _unsupported_iterable_to_array$15(arr) || _non_iterable_spread$Z();
+    return _array_without_holes$Z(arr) || _iterable_to_array$Z(arr) || _unsupported_iterable_to_array$14(arr) || _non_iterable_spread$Z();
 }
-function _unsupported_iterable_to_array$15(o, minLen) {
+function _unsupported_iterable_to_array$14(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$15(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$14(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$15(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$14(o, minLen);
 }
 /**
  * Default name of the parent command that groups all registered action specs.
@@ -1845,7 +1846,7 @@ function _unsupported_iterable_to_array$15(o, minLen) {
             }
         }
         var sortedModels = _to_consumable_array$Z(byModel.entries()).sort(function(param, param1) {
-            var _param = _sliced_to_array$j(param, 1), a = _param[0], _param1 = _sliced_to_array$j(param1, 1), b = _param1[0];
+            var _param = _sliced_to_array$i(param, 1), a = _param[0], _param1 = _sliced_to_array$i(param1, 1), b = _param1[0];
             return a.localeCompare(b);
         });
         result = [
@@ -1876,7 +1877,7 @@ function _unsupported_iterable_to_array$15(o, minLen) {
                     var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                     try {
                         var _loop = function() {
-                            var _step_value = _sliced_to_array$j(_step1.value, 2), model = _step_value[0], modelSpecs = _step_value[1];
+                            var _step_value = _sliced_to_array$i(_step1.value, 2), model = _step_value[0], modelSpecs = _step_value[1];
                             yargs.command({
                                 command: "".concat(model, " <action>"),
                                 describe: "Composite actions scoped to model '".concat(model, "' (").concat(modelSpecs.length, ")."),
@@ -1934,18 +1935,18 @@ function _unsupported_iterable_to_array$15(o, minLen) {
     return result;
 }
 
-function _array_like_to_array$14(arr, len) {
+function _array_like_to_array$13(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$i(arr) {
+function _array_with_holes$h(arr) {
     if (Array.isArray(arr)) return arr;
 }
 function _array_without_holes$Y(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$14(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$13(arr);
 }
-function asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1959,22 +1960,22 @@ function asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1b(fn) {
+function _async_to_generator$1a(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$K(obj, key, value) {
+function _define_property$L(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -1990,7 +1991,7 @@ function _define_property$K(obj, key, value) {
 function _iterable_to_array$Y(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$i(arr, i) {
+function _iterable_to_array_limit$h(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -2014,13 +2015,13 @@ function _iterable_to_array_limit$i(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$i() {
+function _non_iterable_rest$h() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _non_iterable_spread$Y() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$K(target) {
+function _object_spread$L(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2030,12 +2031,12 @@ function _object_spread$K(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$K(target, key, source[key]);
+            _define_property$L(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$s(object, enumerableOnly) {
+function ownKeys$u(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -2043,32 +2044,32 @@ function ownKeys$s(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$s(target, source) {
+function _object_spread_props$u(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$s(Object(source)).forEach(function(key) {
+        ownKeys$u(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _sliced_to_array$i(arr, i) {
-    return _array_with_holes$i(arr) || _iterable_to_array_limit$i(arr, i) || _unsupported_iterable_to_array$14(arr, i) || _non_iterable_rest$i();
+function _sliced_to_array$h(arr, i) {
+    return _array_with_holes$h(arr) || _iterable_to_array_limit$h(arr, i) || _unsupported_iterable_to_array$13(arr, i) || _non_iterable_rest$h();
 }
 function _to_consumable_array$Y(arr) {
-    return _array_without_holes$Y(arr) || _iterable_to_array$Y(arr) || _unsupported_iterable_to_array$14(arr) || _non_iterable_spread$Y();
+    return _array_without_holes$Y(arr) || _iterable_to_array$Y(arr) || _unsupported_iterable_to_array$13(arr) || _non_iterable_spread$Y();
 }
-function _unsupported_iterable_to_array$14(o, minLen) {
+function _unsupported_iterable_to_array$13(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$14(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$13(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$14(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$13(o, minLen);
 }
-function _ts_generator$1b(thisArg, body) {
+function _ts_generator$1a(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2182,7 +2183,7 @@ var _defaultResponseAdapter = {
     }
 };
 function _defaultBuildRequestData(params, state, limit) {
-    var base = _object_spread$K({}, params);
+    var base = _object_spread$L({}, params);
     if (state.cursorDocumentKey != null) {
         base.cursorDocumentKey = state.cursorDocumentKey;
     }
@@ -2192,9 +2193,9 @@ function _defaultBuildRequestData(params, state, limit) {
     return base;
 }
 function _runItemTasks(input) {
-    return _async_to_generator$1b(function() {
+    return _async_to_generator$1a(function() {
         var context, items, keys, pageIndex, iterateItem, itemPerformTasksConfig, maxParallelPerPage, indexed, taskConfig, performResult;
-        return _ts_generator$1b(this, function(_state) {
+        return _ts_generator$1a(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, items = input.items, keys = input.keys, pageIndex = input.pageIndex, iterateItem = input.iterateItem, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -2206,7 +2207,7 @@ function _runItemTasks(input) {
                             itemIndex: itemIndex
                         };
                     });
-                    taskConfig = _object_spread_props$s(_object_spread$K({
+                    taskConfig = _object_spread_props$u(_object_spread$L({
                         sequential: true,
                         throwError: true
                     }, itemPerformTasksConfig), {
@@ -2230,7 +2231,7 @@ function _runItemTasks(input) {
                     return [
                         2,
                         performResult.results.map(function(param) {
-                            var _param = _sliced_to_array$i(param, 2), output = _param[1];
+                            var _param = _sliced_to_array$h(param, 2), output = _param[1];
                             return output;
                         })
                     ];
@@ -2239,9 +2240,9 @@ function _runItemTasks(input) {
     })();
 }
 function _processPage(input) {
-    return _async_to_generator$1b(function() {
+    return _async_to_generator$1a(function() {
         var context, raw, pageIndex, responseAdapter, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, items, keys, nextCursorDocumentKey, hasMore, itemResults, _tmp, pageResult, _tmp1, output;
-        return _ts_generator$1b(this, function(_state) {
+        return _ts_generator$1a(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, raw = input.raw, pageIndex = input.pageIndex, responseAdapter = input.responseAdapter, iterateItem = input.iterateItem, iteratePage = input.iteratePage, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -2381,9 +2382,9 @@ function _evaluateLoopExit(input) {
  * });
  * ```
  */ function iterateDbxCliCallModel(config) {
-    return _async_to_generator$1b(function() {
+    return _async_to_generator$1a(function() {
         var context, modelType, call, specifier, params, _config_buildRequestData, buildRequestData, _config_responseAdapter, responseAdapter, limitPerPage, totalItemsLimit, maxPages, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, _config_collectItems, collectItems, _config_collectItemResults, collectItemResults, _config_collectPageResults, collectPageResults, allItems, allItemResults, allPageResults, pageIndex, totalItems, cursorDocumentKey, hitLimit, keepGoing, collectItemsForPage, collectItemResultsForPage, collectPageResultsForPage, effectiveLimit, data, raw, pageOutcome, _allItems, _allItemResults, exit, result;
-        return _ts_generator$1b(this, function(_state) {
+        return _ts_generator$1a(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = config.context, modelType = config.modelType, call = config.call, specifier = config.specifier, params = config.params, _config_buildRequestData = config.buildRequestData, buildRequestData = _config_buildRequestData === void 0 ? _defaultBuildRequestData : _config_buildRequestData, _config_responseAdapter = config.responseAdapter, responseAdapter = _config_responseAdapter === void 0 ? _defaultResponseAdapter : _config_responseAdapter, limitPerPage = config.limitPerPage, totalItemsLimit = config.totalItemsLimit, maxPages = config.maxPages, iterateItem = config.iterateItem, iteratePage = config.iteratePage, itemPerformTasksConfig = config.itemPerformTasksConfig, maxParallelPerPage = config.maxParallelPerPage, _config_collectItems = config.collectItems, collectItems = _config_collectItems === void 0 ? true : _config_collectItems, _config_collectItemResults = config.collectItemResults, collectItemResults = _config_collectItemResults === void 0 ? iterateItem != null : _config_collectItemResults, _config_collectPageResults = config.collectPageResults, collectPageResults = _config_collectPageResults === void 0 ? iteratePage != null : _config_collectPageResults;
@@ -2463,7 +2464,7 @@ function _evaluateLoopExit(input) {
                         1
                     ];
                 case 4:
-                    result = _object_spread$K({
+                    result = _object_spread$L({
                         totalPages: pageIndex,
                         totalItems: totalItems,
                         hitLimit: hitLimit,
@@ -2484,7 +2485,7 @@ function _evaluateLoopExit(input) {
     })();
 }
 
-function asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2498,22 +2499,22 @@ function asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$1a(fn) {
+function _async_to_generator$19(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$J(obj, key, value) {
+function _define_property$K(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2526,7 +2527,7 @@ function _define_property$J(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$J(target) {
+function _object_spread$K(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2536,12 +2537,12 @@ function _object_spread$J(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$J(target, key, source[key]);
+            _define_property$K(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$r(object, enumerableOnly) {
+function ownKeys$t(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -2549,18 +2550,18 @@ function ownKeys$r(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$r(target, source) {
+function _object_spread_props$t(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$r(Object(source)).forEach(function(key) {
+        ownKeys$t(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _ts_generator$1a(thisArg, body) {
+function _ts_generator$19(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2676,14 +2677,14 @@ function _ts_generator$1a(thisArg, body) {
             return spec.builder ? spec.builder(yargs) : yargs;
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1a(function() {
+            return _async_to_generator$19(function() {
                 var context, data, params, result;
-                return _ts_generator$1a(this, function(_state) {
+                return _ts_generator$19(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             context = requireCliContext();
                             data = spec.buildParams(argv);
-                            params = _object_spread_props$r(_object_spread$J({
+                            params = _object_spread_props$t(_object_spread$K({
                                 modelType: spec.model,
                                 call: spec.verb
                             }, spec.specifier == null ? {} : {
@@ -2861,7 +2862,7 @@ function AsyncFromSyncIterator$4(s) {
         }
     }, new AsyncFromSyncIterator$4(s);
 }
-function asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2875,22 +2876,22 @@ function asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$19(fn) {
+function _async_to_generator$18(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$19(thisArg, body) {
+function _ts_generator$18(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3009,9 +3010,9 @@ function _ts_generator$19(thisArg, body) {
  *
  * @returns The UTF-8 decoded stdin contents.
  */ function readAllStdin() {
-    return _async_to_generator$19(function() {
+    return _async_to_generator$18(function() {
         var chunks, _iteratorAbruptCompletion, _didIteratorError, _iteratorError, _iterator, _step, _value, chunk, err;
-        return _ts_generator$19(this, function(_state) {
+        return _ts_generator$18(this, function(_state) {
             switch(_state.label){
                 case 0:
                     chunks = [];
@@ -3109,9 +3110,9 @@ function _ts_generator$19(thisArg, body) {
  *
  * @returns The tokens parsed from stdin.
  */ function readStdinTokens() {
-    return _async_to_generator$19(function() {
+    return _async_to_generator$18(function() {
         var raw;
-        return _ts_generator$19(this, function(_state) {
+        return _ts_generator$18(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -3131,7 +3132,7 @@ function _ts_generator$19(thisArg, body) {
     })();
 }
 
-function asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3145,22 +3146,22 @@ function asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$18(fn) {
+function _async_to_generator$17(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$I(obj, key, value) {
+function _define_property$J(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3181,7 +3182,7 @@ function _instanceof$n(left, right) {
         return left instanceof right;
     }
 }
-function _object_spread$I(target) {
+function _object_spread$J(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3191,12 +3192,12 @@ function _object_spread$I(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$I(target, key, source[key]);
+            _define_property$J(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$q(object, enumerableOnly) {
+function ownKeys$s(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -3204,18 +3205,18 @@ function ownKeys$q(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$q(target, source) {
+function _object_spread_props$s(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$q(Object(source)).forEach(function(key) {
+        ownKeys$s(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _ts_generator$18(thisArg, body) {
+function _ts_generator$17(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3326,9 +3327,9 @@ function _ts_generator$18(thisArg, body) {
         return withCallModelArgs(yargs);
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$18(function() {
+        return _async_to_generator$17(function() {
             var context, data, rawData, _tmp, params, result;
-            return _ts_generator$18(this, function(_state) {
+            return _ts_generator$17(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -3368,7 +3369,7 @@ function _ts_generator$18(thisArg, body) {
                                 });
                             }
                         }
-                        params = _object_spread_props$q(_object_spread$I({
+                        params = _object_spread_props$s(_object_spread$J({
                             modelType: argv.model,
                             call: argv.verb
                         }, argv.specifier == null ? {} : {
@@ -3392,12 +3393,12 @@ function _ts_generator$18(thisArg, body) {
     })
 };
 
-function _array_like_to_array$13(arr, len) {
+function _array_like_to_array$12(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$h(arr) {
+function _array_with_holes$g(arr) {
     if (Array.isArray(arr)) return arr;
 }
 function _instanceof$m(left, right) {
@@ -3408,7 +3409,7 @@ function _instanceof$m(left, right) {
         return left instanceof right;
     }
 }
-function _iterable_to_array_limit$h(arr, i) {
+function _iterable_to_array_limit$g(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -3432,23 +3433,23 @@ function _iterable_to_array_limit$h(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$h() {
+function _non_iterable_rest$g() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$h(arr, i) {
-    return _array_with_holes$h(arr) || _iterable_to_array_limit$h(arr, i) || _unsupported_iterable_to_array$13(arr, i) || _non_iterable_rest$h();
+function _sliced_to_array$g(arr, i) {
+    return _array_with_holes$g(arr) || _iterable_to_array_limit$g(arr, i) || _unsupported_iterable_to_array$12(arr, i) || _non_iterable_rest$g();
 }
 function _type_of(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$13(o, minLen) {
+function _unsupported_iterable_to_array$12(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$13(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$12(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$13(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$12(o, minLen);
 }
 /**
  * Resolves the manifest entry for `modelType`. Lookup tries
@@ -3541,7 +3542,7 @@ function rewriteWithFields(value, fields) {
         var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
         try {
             for(var _iterator1 = Object.entries(value)[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                var _step_value = _sliced_to_array$h(_step1.value, 2), key = _step_value[0], raw = _step_value[1];
+                var _step_value = _sliced_to_array$g(_step1.value, 2), key = _step_value[0], raw = _step_value[1];
                 var field1 = fieldByName.get(key);
                 if (field1) {
                     var longKey = field1.longName.length > 0 ? field1.longName : key;
@@ -3601,13 +3602,13 @@ function isPlainObject(value) {
     return result;
 }
 
-function _array_like_to_array$12(arr, len) {
+function _array_like_to_array$11(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
 function _array_without_holes$X(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$12(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$11(arr);
 }
 function _iterable_to_array$X(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
@@ -3616,15 +3617,15 @@ function _non_iterable_spread$X() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _to_consumable_array$X(arr) {
-    return _array_without_holes$X(arr) || _iterable_to_array$X(arr) || _unsupported_iterable_to_array$12(arr) || _non_iterable_spread$X();
+    return _array_without_holes$X(arr) || _iterable_to_array$X(arr) || _unsupported_iterable_to_array$11(arr) || _non_iterable_spread$X();
 }
-function _unsupported_iterable_to_array$12(o, minLen) {
+function _unsupported_iterable_to_array$11(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$12(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$11(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$12(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$11(o, minLen);
 }
 /**
  * Default command name for the model-decode command. Top-level so it stays
@@ -3793,21 +3794,21 @@ function renderAncestorLine(ancestor) {
     return ancestor.modelName ? "- ".concat(ancestor.modelName, " — prefix ").concat(ancestor.prefix, ", id ").concat(ancestor.id) : "- <unknown> — prefix ".concat(ancestor.prefix, ", id ").concat(ancestor.id);
 }
 
-function _array_like_to_array$11(arr, len) {
+function _array_like_to_array$10(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$g(arr) {
+function _array_with_holes$f(arr) {
     if (Array.isArray(arr)) return arr;
 }
 function _array_without_holes$W(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$11(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$10(arr);
 }
 function _iterable_to_array$W(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$g(arr, i) {
+function _iterable_to_array_limit$f(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -3831,25 +3832,25 @@ function _iterable_to_array_limit$g(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$g() {
+function _non_iterable_rest$f() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _non_iterable_spread$W() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$g(arr, i) {
-    return _array_with_holes$g(arr) || _iterable_to_array_limit$g(arr, i) || _unsupported_iterable_to_array$11(arr, i) || _non_iterable_rest$g();
+function _sliced_to_array$f(arr, i) {
+    return _array_with_holes$f(arr) || _iterable_to_array_limit$f(arr, i) || _unsupported_iterable_to_array$10(arr, i) || _non_iterable_rest$f();
 }
 function _to_consumable_array$W(arr) {
-    return _array_without_holes$W(arr) || _iterable_to_array$W(arr) || _unsupported_iterable_to_array$11(arr) || _non_iterable_spread$W();
+    return _array_without_holes$W(arr) || _iterable_to_array$W(arr) || _unsupported_iterable_to_array$10(arr) || _non_iterable_spread$W();
 }
-function _unsupported_iterable_to_array$11(o, minLen) {
+function _unsupported_iterable_to_array$10(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$11(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$10(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$11(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$10(o, minLen);
 }
 /**
  * Parses the positionals for the top-level `get <modelOrKey> [key]` command into a
@@ -4017,7 +4018,7 @@ function inferModelTypeFromKeys(keys, manifest) {
             code: 'INVALID_ARGUMENT'
         });
     }
-    var _decodedTypes = _sliced_to_array$g(decodedTypes, 1), modelType = _decodedTypes[0];
+    var _decodedTypes = _sliced_to_array$f(decodedTypes, 1), modelType = _decodedTypes[0];
     return {
         modelType: modelType,
         keys: keys
@@ -4030,7 +4031,7 @@ function manifestPrefixList(manifest) {
     return prefixes.join(', ');
 }
 
-function asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4044,22 +4045,22 @@ function asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$17(fn) {
+function _async_to_generator$16(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$17(thisArg, body) {
+function _ts_generator$16(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4180,9 +4181,9 @@ function _ts_generator$17(thisArg, body) {
         });
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$17(function() {
+        return _async_to_generator$16(function() {
             var context, _parseGetArgs, modelType, key, result;
-            return _ts_generator$17(this, function(_state) {
+            return _ts_generator$16(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -4207,7 +4208,7 @@ function _ts_generator$17(thisArg, body) {
     })
 };
 
-function asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4221,22 +4222,22 @@ function asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$16(fn) {
+function _async_to_generator$15(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$16(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$16(thisArg, body) {
+function _ts_generator$15(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4362,9 +4363,9 @@ function _ts_generator$16(thisArg, body) {
         });
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$16(function() {
+        return _async_to_generator$15(function() {
             var context, firstArg, rest, resolvedFirst, resolvedRest, stdinKeys, _parseGetManyArgs, modelType, keys, result;
-            return _ts_generator$16(this, function(_state) {
+            return _ts_generator$15(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -4407,7 +4408,7 @@ function _ts_generator$16(thisArg, body) {
     })
 };
 
-function asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4421,22 +4422,22 @@ function asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$15(fn) {
+function _async_to_generator$14(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$15(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$H(obj, key, value) {
+function _define_property$I(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4449,7 +4450,7 @@ function _define_property$H(obj, key, value) {
     }
     return obj;
 }
-function _object_spread$H(target) {
+function _object_spread$I(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4459,12 +4460,12 @@ function _object_spread$H(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$H(target, key, source[key]);
+            _define_property$I(target, key, source[key]);
         });
     }
     return target;
 }
-function _ts_generator$15(thisArg, body) {
+function _ts_generator$14(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4620,9 +4621,9 @@ function _ts_generator$15(thisArg, body) {
  * @param input.updates - The partial {@link CliConfig} to merge on top of the existing on-disk config.
  * @returns The merged {@link CliConfig} that was just written.
  */ function mergeCliConfig(input) {
-    return _async_to_generator$15(function() {
+    return _async_to_generator$14(function() {
         var _ref, _input_updates_activeEnv, existing, merged;
-        return _ts_generator$15(this, function(_state) {
+        return _ts_generator$14(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -4635,7 +4636,7 @@ function _ts_generator$15(thisArg, body) {
                     existing = (_ref = _state.sent()) !== null && _ref !== void 0 ? _ref : {};
                     merged = {
                         activeEnv: (_input_updates_activeEnv = input.updates.activeEnv) !== null && _input_updates_activeEnv !== void 0 ? _input_updates_activeEnv : existing.activeEnv,
-                        envs: input.updates.envs ? _object_spread$H({}, existing.envs, input.updates.envs) : existing.envs,
+                        envs: input.updates.envs ? _object_spread$I({}, existing.envs, input.updates.envs) : existing.envs,
                         output: input.updates.output === undefined ? existing.output : mergeOutputConfig(existing.output, input.updates.output)
                     };
                     return [
@@ -4677,12 +4678,12 @@ function mergeOutputCommandsConfig(existing, updates) {
     var result;
     if ('commands' in updates) {
         if (updates.commands) {
-            var merged = _object_spread$H({}, existing);
+            var merged = _object_spread$I({}, existing);
             var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
             try {
                 for(var _iterator = Object.keys(updates.commands)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                     var key = _step.value;
-                    merged[key] = _object_spread$H({}, existing === null || existing === void 0 ? void 0 : existing[key], updates.commands[key]);
+                    merged[key] = _object_spread$I({}, existing === null || existing === void 0 ? void 0 : existing[key], updates.commands[key]);
                 }
             } catch (err) {
                 _didIteratorError = true;
@@ -4747,15 +4748,15 @@ function mergeOutputCommandsConfig(existing, updates) {
     return result;
 }
 
-function _array_like_to_array$10(arr, len) {
+function _array_like_to_array$$(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
 function _array_without_holes$V(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$10(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$$(arr);
 }
-function _define_property$G(obj, key, value) {
+function _define_property$H(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4774,7 +4775,7 @@ function _iterable_to_array$V(iter) {
 function _non_iterable_spread$V() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$G(target) {
+function _object_spread$H(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4784,12 +4785,12 @@ function _object_spread$G(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$G(target, key, source[key]);
+            _define_property$H(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$p(object, enumerableOnly) {
+function ownKeys$r(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -4797,27 +4798,27 @@ function ownKeys$p(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$p(target, source) {
+function _object_spread_props$r(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) {
         Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     } else {
-        ownKeys$p(Object(source)).forEach(function(key) {
+        ownKeys$r(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
 function _to_consumable_array$V(arr) {
-    return _array_without_holes$V(arr) || _iterable_to_array$V(arr) || _unsupported_iterable_to_array$10(arr) || _non_iterable_spread$V();
+    return _array_without_holes$V(arr) || _iterable_to_array$V(arr) || _unsupported_iterable_to_array$$(arr) || _non_iterable_spread$V();
 }
-function _unsupported_iterable_to_array$10(o, minLen) {
+function _unsupported_iterable_to_array$$(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$10(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$$(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$10(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$$(o, minLen);
 }
 /**
  * The default OAuth/OIDC scopes requested by the CLI when none are configured.
@@ -5018,7 +5019,7 @@ function nonEmpty(value) {
     if (refreshToken) {
         var accessToken = nonEmpty(process.env["".concat(prefix, "_ACCESS_TOKEN")]);
         var scope = nonEmpty(process.env["".concat(prefix, "_TOKEN_SCOPE")]);
-        result = _object_spread_props$p(_object_spread$G({
+        result = _object_spread_props$r(_object_spread$H({
             accessToken: accessToken !== null && accessToken !== void 0 ? accessToken : '',
             refreshToken: refreshToken,
             // No reliable expiry is supplied via env, so force a refresh on first use (expiresAt 0 = expired).
@@ -5032,7 +5033,7 @@ function nonEmpty(value) {
     return result;
 }
 
-function asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -5046,22 +5047,22 @@ function asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$14(fn) {
+function _async_to_generator$13(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$14(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$14(thisArg, body) {
+function _ts_generator$13(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5188,9 +5189,9 @@ function _ts_generator$14(thisArg, body) {
  * @param input - Resolution inputs.
  * @returns The resolved env triple.
  */ function resolveCliEnv(input) {
-    return _async_to_generator$14(function() {
+    return _async_to_generator$13(function() {
         var _ref, _input_envVarName, _ref1, _input_flagEnv, _config_envs, _findCliEnvDefault, config, envVarName, envName, stored, defaultEnv, merged, env;
-        return _ts_generator$14(this, function(_state) {
+        return _ts_generator$13(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -5229,9 +5230,9 @@ function _ts_generator$14(thisArg, body) {
     })();
 }
 function resolveCliEnvOrThrow(input) {
-    return _async_to_generator$14(function() {
+    return _async_to_generator$13(function() {
         var _ref, config, envName, env;
-        return _ts_generator$14(this, function(_state) {
+        return _ts_generator$13(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -5326,7 +5327,7 @@ function resolveCliEnvOrThrow(input) {
     }).hasExpired();
 }
 
-function asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -5340,22 +5341,22 @@ function asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, key, arg) {
         Promise.resolve(value).then(_next, _throw);
     }
 }
-function _async_to_generator$13(fn) {
+function _async_to_generator$12(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$13(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$F(obj, key, value) {
+function _define_property$G(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -5376,7 +5377,7 @@ function _instanceof$l(left, right) {
         return left instanceof right;
     }
 }
-function _object_spread$F(target) {
+function _object_spread$G(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -5386,12 +5387,31 @@ function _object_spread$F(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$F(target, key, source[key]);
+            _define_property$G(target, key, source[key]);
         });
     }
     return target;
 }
-function _ts_generator$13(thisArg, body) {
+function ownKeys$q(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$q(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$q(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _ts_generator$12(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5490,842 +5510,268 @@ function _ts_generator$13(thisArg, body) {
         };
     }
 }
+// The CLI's fetch transport: the global `fetch` wrapped with verbose tracing + the configured
+// `--timeout`. A plain transport — it injects no `Authorization` header (public + confidential
+// clients authenticate via `code_verifier` / `client_secret`, not a bearer token).
+var cliOidcFetch = function cliOidcFetch(input, init) {
+    return tracedFetch(undefined, input, init);
+};
 /**
- * Builds the ordered list of `.well-known/openid-configuration` URLs the CLI probes when
- * discovering OIDC metadata.
- *
- *   1. `<issuer>/.well-known/openid-configuration` (OpenID Connect Discovery 1.0).
- *   2. `<issuer-origin>/.well-known/openid-configuration` (host-rooted; matches projects that
- *      mount the discovery controller at the API/dev-server root rather than under the issuer
- *      sub-path — e.g. demo's `OidcWellKnownController`).
- *   3. `<fallbackBaseUrl>/.well-known/openid-configuration` when supplied and not already covered.
- *
- * Exported so diagnostic surfaces (e.g. `doctor`) can show the exact URLs the discovery step
- * tried — without re-implementing the candidate ordering.
- *
- * @param input - The discovery request.
- * @param input.issuer - The OIDC issuer URL whose `.well-known/openid-configuration` is fetched first.
- * @param input.fallbackBaseUrl - Optional sibling base URL appended after the issuer-prefixed and origin-rooted candidates.
- * @returns The candidate URL list in probe order, de-duplicated.
- */ function buildOidcDiscoveryCandidates(input) {
-    var candidates = [
-        "".concat(trimSlash(input.issuer), "/.well-known/openid-configuration")
-    ];
-    try {
-        var originCandidate = "".concat(new URL(input.issuer).origin, "/.well-known/openid-configuration");
-        if (!candidates.includes(originCandidate)) {
-            candidates.push(originCandidate);
-        }
-    } catch (unused) {
-    // Issuer URL didn't parse — skip the origin-rooted candidate and let the explicit fallback handle it.
+ * Maps each shared {@link OidcRelyingPartyErrorCode} back onto the CLI's historical error code +
+ * suggestion, so refactoring the implementation onto the shared core does not change the
+ * `{ ok: false, code, suggestion }` envelope users and scripts depend on.
+ */ var OIDC_ERROR_CODE_MAP = {
+    DISCOVERY_FAILED: {
+        code: 'OIDC_DISCOVERY_FAILED',
+        suggestion: 'Verify the env oidcIssuer URL is reachable and serves /.well-known/openid-configuration.'
+    },
+    TOKEN_INVALID_GRANT: {
+        code: 'TOKEN_INVALID_GRANT',
+        suggestion: 'Re-run auth login to obtain a fresh code or refresh token.'
+    },
+    TOKEN_EXCHANGE_FAILED: {
+        code: 'TOKEN_EXCHANGE_FAILED'
+    },
+    TOKEN_REVOCATION_FAILED: {
+        code: 'TOKEN_REVOCATION_FAILED'
+    },
+    USERINFO_FAILED: {
+        code: 'USERINFO_FAILED',
+        suggestion: 'Try: <cli> auth login --env <name>'
+    },
+    SESSION_INFO_FAILED: {
+        code: 'SESSION_INFO_FAILED'
+    },
+    AUTH_NO_CODE: {
+        code: 'AUTH_NO_CODE'
+    },
+    AUTH_PROVIDER_ERROR: {
+        code: 'AUTH_PROVIDER_ERROR'
+    },
+    AUTH_REDIRECT_PARSE_FAILED: {
+        code: 'AUTH_REDIRECT_PARSE_FAILED'
+    },
+    INVALID_STATE: {
+        code: 'AUTH_STATE_MISMATCH'
+    },
+    INVALID_SESSION_TTL: {
+        code: 'AUTH_LOGIN_FOR_INVALID'
     }
-    if (input.fallbackBaseUrl) {
-        var fallbackCandidate = "".concat(trimSlash(input.fallbackBaseUrl), "/.well-known/openid-configuration");
-        if (!candidates.includes(fallbackCandidate)) {
-            candidates.push(fallbackCandidate);
-        }
+};
+/**
+ * Converts an {@link OidcRelyingPartyError} thrown by the shared core into the CLI's {@link CliError}
+ * (preserving message + mapped code + suggestion). Any other value is returned unchanged.
+ *
+ * @param error - The thrown value.
+ * @returns A {@link CliError} for relying-party errors, otherwise the original value.
+ */ function oidcRelyingPartyErrorToCliError(error) {
+    var result = error;
+    if (_instanceof$l(error, OidcRelyingPartyError)) {
+        var mapped = OIDC_ERROR_CODE_MAP[error.code];
+        result = new CliError(_object_spread$G({
+            message: error.message,
+            code: mapped.code
+        }, mapped.suggestion ? {
+            suggestion: mapped.suggestion
+        } : {}));
     }
-    return candidates;
+    return result;
 }
-/**
- * Fetches the OIDC discovery document for the given issuer, trying the candidates returned by
- * {@link buildOidcDiscoveryCandidates} in order.
- *
- * @param input - The discovery request.
- * @param input.issuer - The OIDC issuer URL whose `.well-known/openid-configuration` is fetched first.
- * @param input.fallbackBaseUrl - Optional sibling base URL tried after the issuer-prefixed and origin-rooted candidates.
- * @returns The parsed {@link OidcDiscoveryMetadata}. Throws a {@link CliError} (`OIDC_DISCOVERY_FAILED`) when every candidate fails.
- */ function discoverOidcMetadata(input) {
-    return _async_to_generator$13(function() {
-        var _ref, candidates, lastError, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, url, res, e, err;
-        return _ts_generator$13(this, function(_state) {
+function withCliErrors(fn) {
+    return _async_to_generator$12(function() {
+        var e;
+        return _ts_generator$12(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    candidates = buildOidcDiscoveryCandidates(input);
-                    _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-                    _state.label = 1;
-                case 1:
                     _state.trys.push([
-                        1,
-                        10,
-                        11,
-                        12
-                    ]);
-                    _iterator = candidates[Symbol.iterator]();
-                    _state.label = 2;
-                case 2:
-                    if (!!(_iteratorNormalCompletion = (_step = _iterator.next()).done)) return [
-                        3,
-                        9
-                    ];
-                    url = _step.value;
-                    _state.label = 3;
-                case 3:
-                    _state.trys.push([
-                        3,
-                        7,
+                        0,
+                        2,
                         ,
-                        8
+                        3
                     ]);
                     return [
                         4,
-                        tracedFetch(undefined, url, {
-                            headers: {
-                                Accept: 'application/json'
-                            }
-                        })
-                    ];
-                case 4:
-                    res = _state.sent();
-                    if (!res.ok) return [
-                        3,
-                        6
-                    ];
-                    return [
-                        4,
-                        res.json()
+                        fn()
                     ];
-                case 5:
+                case 1:
                     return [
                         2,
                         _state.sent()
                     ];
-                case 6:
-                    lastError = new Error("OIDC discovery failed at ".concat(url, ": ").concat(res.status, " ").concat(res.statusText));
-                    return [
-                        3,
-                        8
-                    ];
-                case 7:
+                case 2:
                     e = _state.sent();
-                    lastError = new Error("OIDC discovery failed at ".concat(url, ": ").concat(_instanceof$l(e, Error) ? e.message : String(e)));
-                    return [
-                        3,
-                        8
-                    ];
-                case 8:
-                    _iteratorNormalCompletion = true;
+                    throw oidcRelyingPartyErrorToCliError(e);
+                case 3:
                     return [
-                        3,
                         2
                     ];
-                case 9:
-                    return [
-                        3,
-                        12
-                    ];
-                case 10:
-                    err = _state.sent();
-                    _didIteratorError = true;
-                    _iteratorError = err;
-                    return [
-                        3,
-                        12
-                    ];
-                case 11:
-                    try {
-                        if (!_iteratorNormalCompletion && _iterator.return != null) {
-                            _iterator.return();
-                        }
-                    } finally{
-                        if (_didIteratorError) {
-                            throw _iteratorError;
-                        }
-                    }
-                    return [
-                        7
-                    ];
-                case 12:
-                    throw new CliError({
-                        message: (_ref = lastError === null || lastError === void 0 ? void 0 : lastError.message) !== null && _ref !== void 0 ? _ref : "OIDC discovery failed for all candidates: ".concat(candidates.join(', ')),
-                        code: 'OIDC_DISCOVERY_FAILED',
-                        suggestion: 'Verify the env oidcIssuer URL is reachable and serves /.well-known/openid-configuration.'
-                    });
             }
         });
     })();
 }
 /**
- * Exchanges an authorization code (from the redirect) for an access token + refresh token.
+ * Fetches the OIDC discovery document for the given issuer.
  *
- * Uses `client_secret_post` auth — the demo's oidc-provider config registers clients with that method.
+ * @param input - The discovery request.
+ * @returns The parsed {@link OidcDiscoveryMetadata}. Throws a {@link CliError} (`OIDC_DISCOVERY_FAILED`) when every candidate fails.
+ */ function discoverOidcMetadata(input) {
+    return withCliErrors(function() {
+        return discoverOidcMetadata$1(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
+}
+/**
+ * Exchanges an authorization code (from the redirect) for an access token + refresh token.
  *
  * @param input - The token exchange parameters.
- * @param input.tokenEndpoint - The OIDC token endpoint URL discovered from the issuer.
- * @param input.clientId - The OAuth client ID.
- * @param input.clientSecret - The OAuth client secret used for `client_secret_post` auth.
- * @param input.redirectUri - The redirect URI registered with the OAuth client (must match the value used when requesting the code).
- * @param input.code - The authorization code returned to the redirect URI.
- * @param input.codeVerifier - The PKCE code verifier originally paired with the code challenge in the authorization request.
  * @returns The parsed {@link OidcTokenResponse} with access/refresh tokens.
  */ function exchangeAuthorizationCode(input) {
-    return _async_to_generator$13(function() {
-        var params;
-        return _ts_generator$13(this, function(_state) {
-            params = new URLSearchParams({
-                grant_type: 'authorization_code',
-                client_id: input.clientId,
-                client_secret: input.clientSecret,
-                redirect_uri: input.redirectUri,
-                code: input.code,
-                code_verifier: input.codeVerifier
-            });
-            return [
-                2,
-                postTokenEndpoint({
-                    tokenEndpoint: input.tokenEndpoint,
-                    body: params
-                })
-            ];
-        });
-    })();
+    return withCliErrors(function() {
+        return exchangeAuthorizationCode$1(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
 }
 /**
  * Exchanges a refresh token for a new access token (and possibly a rotated refresh token).
  *
  * @param input - The refresh request.
- * @param input.tokenEndpoint - The OIDC token endpoint URL discovered from the issuer.
- * @param input.clientId - The OAuth client ID.
- * @param input.clientSecret - The OAuth client secret used for `client_secret_post` auth.
- * @param input.refreshToken - The cached refresh token to redeem.
  * @returns The parsed {@link OidcTokenResponse} with the refreshed access token.
  */ function refreshAccessToken(input) {
-    return _async_to_generator$13(function() {
-        var params;
-        return _ts_generator$13(this, function(_state) {
-            params = new URLSearchParams({
-                grant_type: 'refresh_token',
-                client_id: input.clientId,
-                client_secret: input.clientSecret,
-                refresh_token: input.refreshToken
-            });
-            return [
-                2,
-                postTokenEndpoint({
-                    tokenEndpoint: input.tokenEndpoint,
-                    body: params
-                })
-            ];
-        });
-    })();
+    return withCliErrors(function() {
+        return refreshAccessToken$1(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
 }
 /**
  * Revokes an access or refresh token at the OIDC revocation endpoint.
  *
  * @param input - The revocation request.
- * @param input.revocationEndpoint - The OIDC revocation endpoint URL.
- * @param input.clientId - The OAuth client ID used for `client_secret_post` auth.
- * @param input.clientSecret - The OAuth client secret used for `client_secret_post` auth.
- * @param input.token - The access or refresh token to revoke.
- * @param input.tokenTypeHint - Optional hint passed as `token_type_hint` (`access_token` or `refresh_token`).
  * @returns Resolves when the server returns a non-error status. Throws a {@link CliError} (`TOKEN_REVOCATION_FAILED`) on error.
  */ function revokeToken(input) {
-    return _async_to_generator$13(function() {
-        var params, res;
-        return _ts_generator$13(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    params = new URLSearchParams(_object_spread$F({
-                        client_id: input.clientId,
-                        client_secret: input.clientSecret,
-                        token: input.token
-                    }, input.tokenTypeHint ? {
-                        token_type_hint: input.tokenTypeHint
-                    } : {}));
-                    return [
-                        4,
-                        tracedFetch(undefined, input.revocationEndpoint, {
-                            method: 'POST',
-                            headers: {
-                                'Content-Type': 'application/x-www-form-urlencoded',
-                                Accept: 'application/json'
-                            },
-                            body: params.toString()
-                        })
-                    ];
-                case 1:
-                    res = _state.sent();
-                    if (!res.ok) {
-                        throw new CliError({
-                            message: "Token revocation failed: ".concat(res.status, " ").concat(res.statusText),
-                            code: 'TOKEN_REVOCATION_FAILED'
-                        });
-                    }
-                    return [
-                        2
-                    ];
-            }
-        });
-    })();
+    return withCliErrors(function() {
+        return revokeToken$1(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
 }
 /**
  * Fetches the OIDC `userinfo` endpoint and returns the parsed claims object.
  *
  * @param input - The userinfo request.
- * @param input.userinfoEndpoint - The OIDC userinfo endpoint URL discovered from the issuer.
- * @param input.accessToken - The Bearer access token sent in the `Authorization` header.
  * @returns The parsed userinfo claims. Throws a {@link CliError} (`USERINFO_FAILED`) on a non-OK response.
  */ function fetchUserInfo(input) {
-    return _async_to_generator$13(function() {
-        var res;
-        return _ts_generator$13(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    return [
-                        4,
-                        tracedFetch(undefined, input.userinfoEndpoint, {
-                            headers: {
-                                Authorization: "Bearer ".concat(input.accessToken),
-                                Accept: 'application/json'
-                            }
-                        })
-                    ];
-                case 1:
-                    res = _state.sent();
-                    if (!res.ok) {
-                        throw new CliError({
-                            message: "Userinfo request failed: ".concat(res.status, " ").concat(res.statusText),
-                            code: 'USERINFO_FAILED',
-                            suggestion: 'Try: <cli> auth login --env <name>'
-                        });
-                    }
-                    return [
-                        4,
-                        res.json()
-                    ];
-                case 2:
-                    return [
-                        2,
-                        _state.sent()
-                    ];
-            }
-        });
-    })();
+    return withCliErrors(function() {
+        return fetchUserInfo$1(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
 }
 /**
  * Fetches the dbx-components `GET /oidc/session` route and returns the parsed session lifetime metadata.
  *
- * Mirrors {@link fetchUserInfo}, but reads the access token's baked-in session-lifetime claims
- * (`dbx_session_expires_at` / `dbx_rotation_disabled`) which userinfo does not echo.
- *
  * @param input - The session request.
- * @param input.sessionEndpoint - The `GET /oidc/session` endpoint URL.
- * @param input.accessToken - The Bearer access token sent in the `Authorization` header.
  * @returns The parsed {@link OidcSessionInfo}. Throws a {@link CliError} (`SESSION_INFO_FAILED`) on a non-OK response.
  */ function fetchSessionInfo(input) {
-    return _async_to_generator$13(function() {
-        var res;
-        return _ts_generator$13(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    return [
-                        4,
-                        tracedFetch(undefined, input.sessionEndpoint, {
-                            headers: {
-                                Authorization: "Bearer ".concat(input.accessToken),
-                                Accept: 'application/json'
-                            }
-                        })
-                    ];
-                case 1:
-                    res = _state.sent();
-                    if (!res.ok) {
-                        throw new CliError({
-                            message: "Session info request failed: ".concat(res.status, " ").concat(res.statusText),
-                            code: 'SESSION_INFO_FAILED'
-                        });
-                    }
-                    return [
-                        4,
-                        res.json()
-                    ];
-                case 2:
-                    return [
-                        2,
-                        _state.sent()
-                    ];
-            }
-        });
-    })();
-}
-function postTokenEndpoint(input) {
-    return _async_to_generator$13(function() {
-        var res, body, _ref, _body_error_description, message;
-        return _ts_generator$13(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    return [
-                        4,
-                        tracedFetch(undefined, input.tokenEndpoint, {
-                            method: 'POST',
-                            headers: {
-                                'Content-Type': 'application/x-www-form-urlencoded',
-                                Accept: 'application/json'
-                            },
-                            body: input.body.toString()
-                        })
-                    ];
-                case 1:
-                    res = _state.sent();
-                    return [
-                        4,
-                        res.json().catch(function() {
-                            return {};
-                        })
-                    ];
-                case 2:
-                    body = _state.sent();
-                    if (!res.ok || body.error) {
-                        message = (_ref = (_body_error_description = body.error_description) !== null && _body_error_description !== void 0 ? _body_error_description : body.error) !== null && _ref !== void 0 ? _ref : "".concat(res.status, " ").concat(res.statusText);
-                        throw new CliError({
-                            message: "OIDC token endpoint error: ".concat(message),
-                            code: body.error === 'invalid_grant' ? 'TOKEN_INVALID_GRANT' : 'TOKEN_EXCHANGE_FAILED',
-                            suggestion: body.error === 'invalid_grant' ? 'Re-run auth login to obtain a fresh code or refresh token.' : undefined
-                        });
-                    }
-                    if (!body.access_token) {
-                        throw new CliError({
-                            message: 'OIDC token endpoint returned no access_token.',
-                            code: 'TOKEN_EXCHANGE_FAILED'
-                        });
-                    }
-                    return [
-                        2,
-                        body
-                    ];
-            }
-        });
-    })();
-}
-function trimSlash(url) {
-    return url.endsWith('/') ? url.slice(0, -1) : url;
+    return withCliErrors(function() {
+        return fetchSessionInfo$1(_object_spread_props$q(_object_spread$G({}, input), {
+            fetch: cliOidcFetch
+        }));
+    });
 }
 
-function _array_like_to_array$$(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_with_holes$f(arr) {
-    if (Array.isArray(arr)) return arr;
-}
-function asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, key, arg) {
-    try {
-        var info = gen[key](arg);
-        var value = info.value;
-    } catch (error) {
-        reject(error);
-        return;
-    }
-    if (info.done) {
-        resolve(value);
+function _define_property$F(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
     } else {
-        Promise.resolve(value).then(_next, _throw);
+        obj[key] = value;
     }
+    return obj;
 }
-function _async_to_generator$12(fn) {
-    return function() {
-        var self = this, args = arguments;
-        return new Promise(function(resolve, reject) {
-            var gen = fn.apply(self, args);
-            function _next(value) {
-                asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, "next", value);
-            }
-            function _throw(err) {
-                asyncGeneratorStep$12(gen, resolve, reject, _next, _throw, "throw", err);
-            }
-            _next(undefined);
-        });
-    };
-}
-function _iterable_to_array_limit$f(arr, i) {
-    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
-    if (_i == null) return;
-    var _arr = [];
-    var _n = true;
-    var _d = false;
-    var _s, _e;
-    try {
-        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
-            _arr.push(_s.value);
-            if (i && _arr.length === i) break;
-        }
-    } catch (err) {
-        _d = true;
-        _e = err;
-    } finally{
-        try {
-            if (!_n && _i["return"] != null) _i["return"]();
-        } finally{
-            if (_d) throw _e;
+function _object_spread$F(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
         }
+        ownKeys.forEach(function(key) {
+            _define_property$F(target, key, source[key]);
+        });
     }
-    return _arr;
-}
-function _non_iterable_rest$f() {
-    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _sliced_to_array$f(arr, i) {
-    return _array_with_holes$f(arr) || _iterable_to_array_limit$f(arr, i) || _unsupported_iterable_to_array$$(arr, i) || _non_iterable_rest$f();
-}
-function _unsupported_iterable_to_array$$(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$$(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$$(o, minLen);
+    return target;
 }
-function _ts_generator$12(thisArg, body) {
-    var f, y, t, _ = {
-        label: 0,
-        sent: function() {
-            if (t[0] & 1) throw t[1];
-            return t[1];
-        },
-        trys: [],
-        ops: []
-    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
-    return d(g, "next", {
-        value: verb(0)
-    }), d(g, "throw", {
-        value: verb(1)
-    }), d(g, "return", {
-        value: verb(2)
-    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
-        value: function() {
-            return this;
-        }
-    }), g;
-    function verb(n) {
-        return function(v) {
-            return step([
-                n,
-                v
-            ]);
-        };
+function ownKeys$p(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
     }
-    function step(op) {
-        if (f) throw new TypeError("Generator is already executing.");
-        while(g && (g = 0, op[0] && (_ = 0)), _)try {
-            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-            if (y = 0, t) op = [
-                op[0] & 2,
-                t.value
-            ];
-            switch(op[0]){
-                case 0:
-                case 1:
-                    t = op;
-                    break;
-                case 4:
-                    _.label++;
-                    return {
-                        value: op[1],
-                        done: false
-                    };
-                case 5:
-                    _.label++;
-                    y = op[1];
-                    op = [
-                        0
-                    ];
-                    continue;
-                case 7:
-                    op = _.ops.pop();
-                    _.trys.pop();
-                    continue;
-                default:
-                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
-                        _ = 0;
-                        continue;
-                    }
-                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
-                        _.label = op[1];
-                        break;
-                    }
-                    if (op[0] === 6 && _.label < t[1]) {
-                        _.label = t[1];
-                        t = op;
-                        break;
-                    }
-                    if (t && _.label < t[2]) {
-                        _.label = t[2];
-                        _.ops.push(op);
-                        break;
-                    }
-                    if (t[2]) _.ops.pop();
-                    _.trys.pop();
-                    continue;
-            }
-            op = body.call(thisArg, _);
-        } catch (e) {
-            op = [
-                6,
-                e
-            ];
-            y = 0;
-        } finally{
-            f = t = 0;
-        }
-        if (op[0] & 5) throw op[1];
-        return {
-            value: op[0] ? op[1] : void 0,
-            done: true
-        };
+    return keys;
+}
+function _object_spread_props$p(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$p(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
     }
+    return target;
 }
 /**
  * Builds the authorization URL the user opens in a browser to start the PKCE flow.
  *
- * The user-facing endpoint is the discovered `authorizationEndpoint` (typically `/oidc/auth`)
- * with its origin optionally rebased. The rebase origin is the first non-empty value among
- * `appClientUrl` → `oidcIssuer` origin → `apiBaseUrl` origin. In a typical single-host
- * deployment all three resolve to the same origin and the rebase is a no-op; in a split-host
- * setup (frontend dev server proxying `/oidc/**` to the API) `appClientUrl` redirects the user
- * through the frontend. When none of the three is provided, the discovered endpoint is used
- * unchanged.
+ * Thin CLI wrapper over the shared {@link buildAuthorizationUrlHelper}: defaults the scope to
+ * {@link DEFAULT_CLI_OIDC_SCOPES} when none is supplied, and re-wraps the shared
+ * {@link OidcRelyingPartyError} into the CLI's {@link CliError} (`AUTH_LOGIN_FOR_INVALID`).
  *
- * Always lands at the actual authorization endpoint so oidc-provider can create an interaction
- * and redirect to the app login page with a `uid`. (Earlier versions targeted a convenience
- * `/oidc/login/client` redirect that forwarded query params to the app without creating an
- * interaction — that branch is gone.)
- *
- * @param input - The authorization URL inputs.
- * @param input.authorizationEndpoint - The authorization endpoint discovered from OIDC metadata.
- * @param input.appClientUrl - Optional client origin to rebase the authorization endpoint onto. Takes precedence over `oidcIssuer` and `apiBaseUrl`.
- * @param input.oidcIssuer - Optional OIDC issuer URL; falls back to its origin as the rebase target when `appClientUrl` is missing.
- * @param input.apiBaseUrl - Optional API base URL; falls back to its origin as the rebase target when neither `appClientUrl` nor `oidcIssuer` is set.
- * @param input.clientId - The OAuth client ID.
- * @param input.redirectUri - The redirect URI registered with the OAuth client.
- * @param input.scopes - Space-separated scope list. Defaults to {@link DEFAULT_CLI_OIDC_SCOPES}.
- * @param input.state - The opaque OAuth state token used for CSRF protection.
- * @param input.codeChallenge - The PKCE code challenge derived from the verifier.
+ * @param input - The authorization URL inputs. When `scopes` is omitted, the CLI default is used.
  * @returns The full authorization URL with all OAuth params merged in.
  * @throws {CliError} When `requestedSessionTtlSeconds` is provided but is not a positive integer.
  *
  * @__NO_SIDE_EFFECTS__
  */ function buildAuthorizationUrl(input) {
-    var _input_scopes;
-    var resolvedScope = (_input_scopes = input.scopes) !== null && _input_scopes !== void 0 ? _input_scopes : DEFAULT_CLI_OIDC_SCOPES;
-    var authParams = {
-        response_type: 'code',
-        client_id: input.clientId,
-        redirect_uri: input.redirectUri,
-        scope: resolvedScope,
-        code_challenge: input.codeChallenge,
-        code_challenge_method: 'S256',
-        state: input.state
-    };
-    // oidc-provider's check_scope middleware silently strips `offline_access` unless the
-    // auth request also includes `prompt=consent`. Auto-add it so refresh tokens are
-    // actually issued whenever the CLI requests offline access.
-    if (resolvedScope.split(/\s+/).includes('offline_access')) {
-        authParams.prompt = 'consent';
-    }
-    if (input.requestedSessionTtlSeconds != null) {
-        if (!Number.isInteger(input.requestedSessionTtlSeconds) || input.requestedSessionTtlSeconds <= 0) {
-            throw new CliError({
-                message: "requestedSessionTtlSeconds must be a positive integer (got ".concat(input.requestedSessionTtlSeconds, ")."),
-                code: 'AUTH_LOGIN_FOR_INVALID'
-            });
-        }
-        authParams.dbx_session_ttl = String(input.requestedSessionTtlSeconds);
-    }
-    var rebaseOrigin = resolveAuthorizationRebaseOrigin({
-        appClientUrl: input.appClientUrl,
-        oidcIssuer: input.oidcIssuer,
-        apiBaseUrl: input.apiBaseUrl
-    });
-    var endpoint = rebaseOrigin ? rebaseUrlOrigin({
-        url: input.authorizationEndpoint,
-        originUrl: rebaseOrigin
-    }) : input.authorizationEndpoint;
-    // Merge into the existing query string (preserving any params already on the endpoint) so
-    // a pre-baked endpoint like `/oidc/auth?source=cli` survives unchanged.
-    var url = new URL(endpoint);
-    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
-        for(var _iterator = Object.entries(authParams)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array$f(_step.value, 2), key = _step_value[0], value = _step_value[1];
-            url.searchParams.set(key, value);
-        }
-    } catch (err) {
-        _didIteratorError = true;
-        _iteratorError = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion && _iterator.return != null) {
-                _iterator.return();
-            }
-        } finally{
-            if (_didIteratorError) {
-                throw _iteratorError;
-            }
-        }
-    }
-    return url.toString();
-}
-/**
- * Picks the origin used to rebase the discovered authorization endpoint, in priority order:
- *   1. `appClientUrl` (verbatim — the explicit override)
- *   2. `oidcIssuer` (parsed `origin`, e.g. `https://api.example.com/oidc` → `https://api.example.com`)
- *   3. `apiBaseUrl` (parsed `origin`, e.g. `https://api.example.com/api` → `https://api.example.com`)
- *
- * Returns `undefined` when none is set or every candidate fails to parse; the caller should then
- * use the discovered endpoint unchanged.
- *
- * @param input - The candidate URLs in priority order.
- * @returns The selected origin, or `undefined` when no candidate yields one.
- */ function resolveAuthorizationRebaseOrigin(input) {
-    var result;
-    if (input.appClientUrl) {
-        result = input.appClientUrl;
-    } else {
-        var _input_oidcIssuer;
-        var fallbackSource = (_input_oidcIssuer = input.oidcIssuer) !== null && _input_oidcIssuer !== void 0 ? _input_oidcIssuer : input.apiBaseUrl;
-        if (fallbackSource) {
-            try {
-                result = new URL(fallbackSource).origin;
-            } catch (unused) {
-            // Fall through with result undefined
-            }
-        }
-    }
-    return result;
-}
-/**
- * Returns `url` with its origin replaced by the origin of `originUrl`. The path and search of
- * `url` are preserved. When `originUrl` is empty/missing or either URL fails to parse, returns
- * `url` unchanged.
- *
- * @param input - The rebase inputs.
- * @param input.url - The URL whose path/search should be preserved.
- * @param input.originUrl - The origin to rebase `url` onto.
- * @returns The rebased URL string, or `input.url` unchanged when rebasing isn't possible.
- */ function rebaseUrlOrigin(input) {
-    var result = input.url;
-    if (input.originUrl) {
-        try {
-            var parsedUrl = new URL(input.url);
-            var parsedOrigin = new URL(input.originUrl);
-            parsedUrl.protocol = parsedOrigin.protocol;
-            parsedUrl.host = parsedOrigin.host;
-            result = parsedUrl.toString();
-        } catch (unused) {
-        // Fall through with the original url unchanged
-        }
-    }
-    return result;
-}
-/**
- * Generates a fresh PKCE code verifier and the matching SHA-256 code challenge.
- *
- * @returns A {@link PkceMaterial} pair consisting of the random `codeVerifier` and its derived `codeChallenge`.
- */ function generatePkceMaterial() {
-    return _async_to_generator$12(function() {
-        var codeVerifier, codeChallenge;
-        return _ts_generator$12(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    codeVerifier = generatePkceCodeVerifier();
-                    return [
-                        4,
-                        generatePkceCodeChallenge(codeVerifier)
-                    ];
-                case 1:
-                    codeChallenge = _state.sent();
-                    return [
-                        2,
-                        {
-                            codeVerifier: codeVerifier,
-                            codeChallenge: codeChallenge
-                        }
-                    ];
-            }
-        });
-    })();
-}
-/**
- * Generates a random URL-safe state value for the OAuth state parameter.
- *
- * @returns A 32-character hex string derived from 16 random bytes.
- */ function generateOAuthState() {
-    var bytes = new Uint8Array(16);
-    crypto.getRandomValues(bytes);
-    return Array.from(bytes, function(b) {
-        return b.toString(16).padStart(2, '0');
-    }).join('');
-}
-function parseRedirectUrlOrThrow(trimmed) {
-    var url;
-    try {
-        // Native URL doesn't parse all urn: schemes — handle the urn:ietf paste case explicitly
-        url = trimmed.startsWith('urn:') ? new URL("https://placeholder.invalid?".concat(trimmed.split('?').slice(1).join('?'))) : new URL(trimmed);
-    } catch (unused) {
-        throw new CliError({
-            message: 'Could not parse redirect URL',
-            code: 'AUTH_REDIRECT_PARSE_FAILED'
-        });
-    }
-    return url;
-}
-function throwForUrlMissingCode(url) {
-    var errorParam = url.searchParams.get('error');
-    if (errorParam) {
-        var errorDescription = url.searchParams.get('error_description');
-        var descriptionSuffix = errorDescription ? " (".concat(errorDescription, ")") : '';
-        throw new CliError({
-            message: "Authorization server returned an error: ".concat(errorParam).concat(descriptionSuffix),
-            code: 'AUTH_PROVIDER_ERROR'
-        });
-    }
-    throw new CliError({
-        message: 'No `code` parameter found in the pasted URL.',
-        code: 'AUTH_NO_CODE'
-    });
-}
-function parseUrlRedirect(trimmed, expectedState) {
-    var _url_searchParams_get;
-    var url = parseRedirectUrlOrThrow(trimmed);
-    var code = url.searchParams.get('code');
-    if (!code) {
-        throwForUrlMissingCode(url);
-    }
-    var state = (_url_searchParams_get = url.searchParams.get('state')) !== null && _url_searchParams_get !== void 0 ? _url_searchParams_get : undefined;
-    if (expectedState && state !== expectedState) {
-        throw new CliError({
-            message: 'OAuth state mismatch — possible CSRF or stale flow.',
-            code: 'AUTH_STATE_MISMATCH'
-        });
+        var _input_scopes;
+        return buildAuthorizationUrl$1(_object_spread_props$p(_object_spread$F({}, input), {
+            scopes: (_input_scopes = input.scopes) !== null && _input_scopes !== void 0 ? _input_scopes : DEFAULT_CLI_OIDC_SCOPES
+        }));
+    } catch (e) {
+        throw oidcRelyingPartyErrorToCliError(e);
     }
-    return {
-        code: code,
-        state: state
-    };
 }
 /**
  * Parses an authorization code out of a pasted redirect URL or a bare code string.
  *
- * Validates the `state` parameter when an expected value is provided.
+ * Thin CLI wrapper over the shared {@link parseAuthorizationRedirect}: keeps the CLI's pasted-string
+ * input shape and re-wraps the shared {@link OidcRelyingPartyError} into the CLI's {@link CliError}
+ * (`AUTH_NO_CODE` / `AUTH_PROVIDER_ERROR` / `AUTH_REDIRECT_PARSE_FAILED` / `AUTH_STATE_MISMATCH`).
  *
  * @param input - The parse inputs.
  * @param input.pasted - The redirect URL or bare authorization code pasted by the user.
  * @param input.expectedState - Optional state value to assert against `state` when present in the URL.
  * @returns The {@link ParsedRedirect} containing `code` and (when present) `state`.
- * @throws {CliError} When `pasted` is empty, when the URL contains no `code` parameter, or when `expectedState` does not match the URL's `state`.
+ * @throws {CliError} When `pasted` is empty, contains no `code`, or the `state` does not match.
  */ function parsePastedRedirect(input) {
-    var trimmed = input.pasted.trim();
-    if (!trimmed) {
-        throw new CliError({
-            message: 'No code or redirect URL was provided.',
-            code: 'AUTH_NO_CODE'
+    try {
+        return parseAuthorizationRedirect({
+            url: input.pasted,
+            expectedState: input.expectedState
         });
+    } catch (e) {
+        throw oidcRelyingPartyErrorToCliError(e);
     }
-    var isUrl = trimmed.startsWith('http://') || trimmed.startsWith('https://') || trimmed.startsWith('urn:');
-    return isUrl ? parseUrlRedirect(trimmed, input.expectedState) : {
-        code: trimmed
-    };
 }
 
 /**
@@ -59838,4 +59284,4 @@ function printPaginatedOutput(input) {
     })();
 }
 
-export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_HTTP_TIMEOUT_MS, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, ROUTE_MANIFEST_VERSION, ROUTE_MODEL_LIST_TAG, ROUTE_MODEL_TAG, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, applyEnvVarOverrides, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildOidcDiscoveryCandidates, buildPipesManifest, buildRouteManifest, buildRouteTree, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, clearDownstreamCatalogCache, collectClassPropertiesWithInheritance, computeRelativeSpecifiers, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCallModelCommand, createCli, createCliContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, detectDataHelpFormat, detectHelpMode, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractComponentRouteModelTags, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFile, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUrlParamKeys, extractUtilEntries, fetchSessionInfo, fetchUserInfo, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, flattenList, generateOAuthState, generatePkceMaterial, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverHttp, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, hasParamSegment, isCliEnvConfigComplete, isCliVerbose, isCoreTopic, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadPackageName, loadPipeManifests, loadPipeRegistry, loadRouteTree, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, matchUrlAgainstEntries, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeOutputConfig, normalizePathname, openStreamingDump, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseFirestoreModelIdentityArgs, parseGetArgs, parseGetManyArgs, parsePastedRedirect, parseRouteModelTag, parseScanArgs, pickFields, promptLine, readAllStdin, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderDecodedKey, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, requireCliContext, resolveActiveEnvName, resolveCliEnv, resolveCliEnvOrThrow, resolveCliModel, resolveComponentSourceFromSources, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveExtendsName, resolveModelArchetype, resolveOutputConfig, resolvePerModelGetKey, resolveRouteSources, revokeToken, runActionsScanCli, runCli, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, saveCliConfig, scanFactoryReferences, scoreCandidates, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, splitSegments, stripUrlQueryAndHash, toActionEntryInfo, toFilterEntryInfo, toFormFieldInfo, tracedFetch, tryMatchSegments, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler };
+export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_HTTP_TIMEOUT_MS, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, ROUTE_MANIFEST_VERSION, ROUTE_MODEL_LIST_TAG, ROUTE_MODEL_TAG, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, applyEnvVarOverrides, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildPipesManifest, buildRouteManifest, buildRouteTree, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, clearDownstreamCatalogCache, collectClassPropertiesWithInheritance, computeRelativeSpecifiers, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCallModelCommand, createCli, createCliContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, detectDataHelpFormat, detectHelpMode, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractComponentRouteModelTags, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFile, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUrlParamKeys, extractUtilEntries, fetchSessionInfo, fetchUserInfo, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, flattenList, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverHttp, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, hasParamSegment, isCliEnvConfigComplete, isCliVerbose, isCoreTopic, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadPackageName, loadPipeManifests, loadPipeRegistry, loadRouteTree, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, matchUrlAgainstEntries, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeOutputConfig, normalizePathname, oidcRelyingPartyErrorToCliError, openStreamingDump, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseFirestoreModelIdentityArgs, parseGetArgs, parseGetManyArgs, parsePastedRedirect, parseRouteModelTag, parseScanArgs, pickFields, promptLine, readAllStdin, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderDecodedKey, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, requireCliContext, resolveActiveEnvName, resolveCliEnv, resolveCliEnvOrThrow, resolveCliModel, resolveComponentSourceFromSources, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveExtendsName, resolveModelArchetype, resolveOutputConfig, resolvePerModelGetKey, resolveRouteSources, revokeToken, runActionsScanCli, runCli, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, saveCliConfig, scanFactoryReferences, scoreCandidates, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, splitSegments, stripUrlQueryAndHash, toActionEntryInfo, toFilterEntryInfo, toFormFieldInfo, tracedFetch, tryMatchSegments, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler };