@dereekb/dbx-cli 13.37.0 → 13.39.0

package/src/lib/firestore/firestore.read.d.ts

@@ -0,0 +1,180 @@
+import { type Maybe } from '@dereekb/util';
+import { type GetModelOverHttpResult, type GetMultipleModelsOverHttpResult } from '../api/call-model.client';
+import { type CliContext } from '../context/cli.context';
+import { type CliModelManifest } from '../manifest/types';
+import { type CliFirestoreModels } from './firestore.models';
+/**
+ * Transport selection for a read.
+ *
+ * - `auto` — go direct when the whole chain is present, fall back to the API on a CAPABILITY failure.
+ * - `firestore` / `api` — hard selections. They error rather than switching, so a script that means
+ *   "prove the direct path works" cannot silently pass on the API path instead.
+ */
+export type CliReadVia = 'auto' | 'firestore' | 'api';
+/**
+ * Every accepted `--via` value, for yargs `choices`.
+ */
+export declare const CLI_READ_VIA_VALUES: readonly CliReadVia[];
+/**
+ * Default `--via` value.
+ */
+export declare const DEFAULT_CLI_READ_VIA: CliReadVia;
+/**
+ * Coerces a raw `--via` argv value, rejecting anything outside {@link CLI_READ_VIA_VALUES}.
+ *
+ * yargs `choices` already rejects a bad value on the command line, but the same helper is reached
+ * from programmatic callers (and from `buildPerModelGetCommand`, whose argv is untyped), so the
+ * validation lives here rather than only in the builder.
+ *
+ * @param value - The raw argv value.
+ * @returns The coerced via value, defaulting to `auto` when absent.
+ * @throws {CliError} When the value is a non-empty string outside the accepted set.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function coerceCliReadVia(value: unknown): CliReadVia;
+/**
+ * Error code used when a read is refused because the model is server-only.
+ */
+export declare const MODEL_IS_SERVER_ONLY_CODE = "MODEL_IS_SERVER_ONLY";
+/**
+ * Refuses a read of a `@dbxModelServerOnly` model BEFORE any transport is chosen.
+ *
+ * The refusal is deliberately transport-independent: the model has no client read grant in
+ * `firestore.rules` at all, so the direct path would be rejected by the rules and the API path is
+ * refused by `ModelApiGetService`. Answering locally makes the reason legible (and free) instead of
+ * surfacing as a permission error from whichever transport happened to run.
+ *
+ * @param input - The manifest and the model type being read.
+ * @param input.manifest - The generated model manifest, when the CLI was wired with one.
+ * @param input.modelType - The model type being read.
+ * @throws {CliError} `MODEL_IS_SERVER_ONLY` when the manifest marks the model server-only.
+ */
+export declare function assertCliModelIsNotServerOnly(input: {
+    readonly manifest: Maybe<CliModelManifest>;
+    readonly modelType: string;
+}): void;
+/**
+ * Why {@link resolveCliReadSource} chose the source it chose.
+ */
+export type CliReadSourceReason = 
+/**
+ * `--via` named the source explicitly.
+ */
+'explicit'
+/**
+ * Under `auto`: the whole direct chain resolved.
+ */
+ | 'session-available'
+/**
+ * Under `auto`: the CLI has no `firestore` binding.
+ */
+ | 'no-firestore-binding'
+/**
+ * Under `auto`: the env carries no complete Firebase client config.
+ */
+ | 'firebase-config-incomplete'
+/**
+ * Under `auto`: the chain is wired but the session could not be opened.
+ */
+ | 'session-unavailable';
+/**
+ * The resolved transport for one read.
+ */
+export interface CliReadSource {
+    readonly source: 'firestore' | 'api';
+    readonly reason: CliReadSourceReason;
+    /**
+     * The `--via` value that produced this resolution, so `meta.via` can report what was asked for
+     * alongside what ran.
+     */
+    readonly via: CliReadVia;
+    /**
+     * The opened session-bound models view. Present only when {@link source} is `firestore`.
+     */
+    readonly models?: CliFirestoreModels;
+    /**
+     * Set when `auto` fell back: why the direct path was not usable, verbatim from the underlying error.
+     */
+    readonly fallbackError?: string;
+}
+/**
+ * Input for {@link resolveCliReadSource}.
+ */
+export interface ResolveCliReadSourceInput {
+    readonly context: CliContext;
+    readonly via: CliReadVia;
+    /**
+     * The model type being read. Checked against the manifest's `serverOnly` flag BEFORE any transport
+     * is considered.
+     */
+    readonly modelType: string;
+}
+/**
+ * Resolves which transport a read should use, opening the direct-Firestore session when that is the
+ * answer.
+ *
+ * Called from the read command handlers rather than from inside `CliContext.getModel`: `getModel` is
+ * a two-arg function with no room for `--via` without changing every call site including
+ * `buildTestCliContext`, and hiding a transport fallback inside the context would contradict the
+ * deliberate no-fallback doctrine `firestore.session.ts` and `createFirestoreSessionDoctorCheck`
+ * were built around — a failure there should be loud.
+ *
+ * @param input - The live context, the requested `--via`, and the model type.
+ * @returns The resolved source, carrying the opened models view when it is `firestore`.
+ * @throws {CliError} `MODEL_IS_SERVER_ONLY` for a server-only model, or the session's own error when `--via firestore` was demanded and the session could not open.
+ */
+export declare function resolveCliReadSource(input: ResolveCliReadSourceInput): Promise<CliReadSource>;
+/**
+ * Builds the `meta` block every read emits, so which transport ran is always observable.
+ *
+ * @param source - The resolved source.
+ * @returns The meta record for `outputResult`.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function cliReadResultMeta(source: CliReadSource): Record<string, unknown>;
+/**
+ * Reads one document directly from Firestore by model key.
+ *
+ * Returns the exact `GetModelOverHttpResult` envelope `GET /model/<type>/get` returns, so `--via`
+ * never changes the output shape.
+ *
+ * @param input - The read inputs.
+ * @param input.models - The session-bound models view.
+ * @param input.modelType - The model type to load through.
+ * @param input.key - The document key to read.
+ * @returns `{ key, data }`, with `data: null` when the document does not exist.
+ * @throws {CliError} When the key does not match the model's path shape.
+ */
+export declare function getModelOverFirestore<T = unknown>(input: {
+    readonly models: CliFirestoreModels;
+    readonly modelType: string;
+    readonly key: string;
+}): Promise<GetModelOverHttpResult<Maybe<T>>>;
+/**
+ * Batch-reads documents directly from Firestore by model key.
+ *
+ * Mirrors the API's `{ results, errors }` partition rather than failing the whole batch on one bad
+ * key: a rules refusal or a malformed key for one document lands in `errors` and the rest still come
+ * back, which is the behaviour `get-many` callers already handle.
+ *
+ * Reads are issued concurrently (each is an independent single-document fetch through the same
+ * session, so serializing them would make a batch as deep as it is wide) through a SLIDING WINDOW of
+ * {@link MAX_MODEL_ACCESS_MULTI_READ_KEYS} in-flight reads — the same width the API path chunks at,
+ * but without its barrier between chunks, so a slow document no longer stalls the reads behind it.
+ * The cap itself is load-bearing: `get-many -` reads its keys from stdin and is unbounded, so one
+ * unbounded `Promise.all` would open thousands of concurrent reads on a large input.
+ *
+ * @param input - The read inputs.
+ * @param input.models - The session-bound models view.
+ * @param input.modelType - The model type to load through.
+ * @param input.keys - The document keys to read.
+ * @returns `{ results, errors }`, key order preserved within each partition.
+ * @throws {CliError} `INVALID_ARGUMENT` when `modelType` is not a registered model.
+ */
+export declare function getMultipleModelsOverFirestore<T = unknown>(input: {
+    readonly models: CliFirestoreModels;
+    readonly modelType: string;
+    readonly keys: ReadonlyArray<string>;
+}): Promise<GetMultipleModelsOverHttpResult<Maybe<T>>>;

package/src/lib/firestore/firestore.session.d.ts

@@ -0,0 +1,97 @@
+import { type FirebaseApp } from 'firebase/app';
+import { type Auth } from 'firebase/auth';
+import { type Firestore } from 'firebase/firestore';
+import { type FirestoreContext } from '@dereekb/firebase';
+import { type CliFirestoreSession } from '../api/firestore-session.client';
+import { type CliEnvConfig } from '../config/env';
+import { type CliFirestoreSessionCacheStore } from '../config/firestore-session.cache';
+/**
+ * A live direct-Firestore session: the Firebase client objects the CLI signed in with, plus the
+ * `FirestoreContext` an app's collections factory consumes.
+ *
+ * The `firestoreContext` is built by `clientFirebaseFirestoreContextFactory`, the exact analogue of
+ * the server's `googleCloudFirestoreContextFactory` — both satisfy `FirestoreContextFactory` — so an
+ * app's `make<App>FirestoreCollections(context)` accepts it unchanged, and the CLI runs the SAME
+ * queries the Angular app runs, through the SAME security rules.
+ */
+export interface CliFirestoreSessionContext {
+    /**
+     * The credential bundle the API minted for this session.
+     */
+    readonly session: CliFirestoreSession;
+    /**
+     * True when {@link session} came from the on-disk session cache rather than a fresh
+     * `GET /session/firestore`. Surfaced for `doctor` and `--verbose`, not for control flow.
+     */
+    readonly fromCache: boolean;
+    readonly app: FirebaseApp;
+    readonly auth: Auth;
+    readonly firestore: Firestore;
+    readonly firestoreContext: FirestoreContext;
+}
+export interface CreateCliFirestoreSessionContextInput {
+    readonly cliName: string;
+    readonly envName: string;
+    readonly env: CliEnvConfig;
+    readonly accessToken: string;
+    /**
+     * Custom fetch implementation for tests.
+     */
+    readonly fetcher?: typeof fetch;
+    /**
+     * Optional on-disk session cache. When supplied, a live cached envelope for {@link envName} is
+     * reused instead of re-minting one, and a freshly minted envelope is written back.
+     */
+    readonly sessionCache?: CliFirestoreSessionCacheStore;
+    /**
+     * Skips the cache read for this call and re-mints, still writing the result back. Used by
+     * `doctor` and by a retry after a sign-in failure.
+     */
+    readonly refreshSession?: boolean;
+}
+/**
+ * Opens a direct Firestore connection as the authenticated CLI user.
+ *
+ * Steps, in a strict order:
+ *
+ * 0. When a `sessionCache` is supplied, reuse the env's cached credential envelope if it is still
+ *    live. Sessions are cached for up to an hour (see `CLI_FIRESTORE_SESSION_MAX_CACHE_MS`), which is
+ *    the ceiling the Firebase credentials themselves sit under. A hit skips step 1 only — the
+ *    Firebase app is per-process, so the sign-in in step 5 always runs.
+ * 1. `GET <apiBaseUrl>/session/firestore` for a custom token + App Check attestation.
+ * 2. `initializeApp` with the env's Firebase client config.
+ * 3. `initializeAppCheck` with a `CustomProvider` handing back the server-minted token. **This must
+ *    happen before any other Firebase call** — `dbx-firebase`'s provider documents the same
+ *    constraint: "App Check must be initialized before any Firebase request goes out, otherwise
+ *    requests are sent without an App Check token and are rejected in production." Skipped when the
+ *    env targets emulators (which do not verify attestations) or when the API minted no token.
+ * 4. `getAuth` / `getFirestore`, connecting each to its emulator when configured.
+ * 5. `signInWithCustomToken`. The user's stored custom claims land at the top level of the exchanged
+ *    ID token, so `request.auth.token.<claim>` reads in security rules behave exactly as in the app.
+ *
+ * There is deliberately NO fallback to the HTTP model API — a failure here throws so the operator
+ * sees it. `createFirestoreSessionDoctorCheck` is the diagnostic surface for why.
+ *
+ * @param input - The CLI name, env, access token, and optional session cache.
+ * @returns The live {@link CliFirestoreSessionContext}.
+ * @throws {CliError} When the env lacks Firebase client config, or any step of the handshake fails.
+ */
+export declare function createCliFirestoreSessionContext(input: CreateCliFirestoreSessionContextInput): Promise<CliFirestoreSessionContext>;
+/**
+ * Tears down a session opened by {@link createCliFirestoreSessionContext}.
+ *
+ * Required for the CLI to EXIT. A signed-in `Auth` and a live `Firestore` both hold open handles
+ * that keep the Node event loop alive indefinitely, so without this a command prints its result and
+ * then hangs forever — the process never returns to the shell. Nothing in the CLI is long-lived
+ * enough to want that: a session is opened for one invocation and is dead weight afterwards.
+ *
+ * `deleteApp` is the single call that covers it — it disposes every registered component, which for
+ * Firestore runs the same shutdown `terminate()` does, and for Auth stops the token-refresh timer.
+ *
+ * Deliberately tolerant: teardown runs in a `finally` after the command has already produced its
+ * output, so a failure here must not change the exit code or mask the real result. A session that
+ * was never opened is a no-op.
+ *
+ * @param session - The session context to close.
+ */
+export declare function closeCliFirestoreSessionContext(session: CliFirestoreSessionContext): Promise<void>;

package/src/lib/firestore/index.d.ts

@@ -0,0 +1,13 @@
+export * from './firestore-get.command';
+export * from './firestore-queries.command';
+export * from './firestore-query.command';
+export * from './firestore.accessor';
+export * from './firestore.collection';
+export * from './firestore.error';
+export * from './firestore.models';
+export * from './firestore.query';
+export * from './firestore.query-params';
+export * from './firestore.read';
+export * from './firestore.session';
+export * from './query-info-utils';
+export * from './query-registry';

package/src/lib/firestore/query-info-utils.d.ts

@@ -0,0 +1,48 @@
+import { type CliFirestoreQueryManifestEntry } from '../manifest/types';
+import { type CliFirestoreQueryRegistry } from './query-registry';
+/**
+ * Resolves a `firestore-queries <query>` / `firestore-query <query>` positional against the
+ * catalog, failing with the accepted slugs when it misses.
+ *
+ * @param registry - The query catalog.
+ * @param query - The slug or exported identifier supplied on the command line.
+ * @returns The matching entry.
+ * @throws {CliError} When nothing matches.
+ */
+export declare function resolveCliFirestoreQueryEntry(registry: CliFirestoreQueryRegistry, query: string): CliFirestoreQueryManifestEntry;
+/**
+ * Filters for {@link renderCliFirestoreQueryList}.
+ */
+export interface CliFirestoreQueryListFilter {
+    readonly model?: string;
+    readonly category?: string;
+    readonly tag?: string;
+}
+/**
+ * Applies the `--model` / `--category` / `--tag` filters to the catalog.
+ *
+ * @param registry - The query catalog.
+ * @param filter - The active filters.
+ * @returns The matching entries, in slug order.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function filterCliFirestoreQueries(registry: CliFirestoreQueryRegistry, filter: CliFirestoreQueryListFilter): readonly CliFirestoreQueryManifestEntry[];
+/**
+ * Renders the human-readable catalog table, grouped by model.
+ *
+ * @param entries - The (already filtered) entries to render.
+ * @returns The formatted table with a trailing newline.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function renderCliFirestoreQueryList(entries: readonly CliFirestoreQueryManifestEntry[]): string;
+/**
+ * Renders one catalog entry in full — signature, params, governance flags, and related slugs.
+ *
+ * @param entry - The entry to render.
+ * @returns The formatted detail block with a trailing newline.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function renderCliFirestoreQueryEntry(entry: CliFirestoreQueryManifestEntry): string;

package/src/lib/firestore/query-registry.d.ts

@@ -0,0 +1,32 @@
+import { type CliFirestoreQueryManifest, type CliFirestoreQueryManifestEntry } from '../manifest/types';
+/**
+ * A read API over the generated Firestore query catalog.
+ *
+ * Mirrors `ModelFirebaseIndexRegistry` (the build-time registry over the same tagged factories) so
+ * the runtime catalog and the tooling catalog read the same way.
+ */
+export interface CliFirestoreQueryRegistry {
+    readonly all: readonly CliFirestoreQueryManifestEntry[];
+    readonly collections: readonly string[];
+    readonly models: readonly string[];
+    readonly categories: readonly string[];
+    readonly tags: readonly string[];
+    /**
+     * Resolves by slug first, then by exported identifier — both spellings are accepted on the
+     * command line.
+     */
+    findBySlugOrName(query: string): CliFirestoreQueryManifestEntry | undefined;
+    findByModel(model: string): readonly CliFirestoreQueryManifestEntry[];
+    findByCollection(collection: string): readonly CliFirestoreQueryManifestEntry[];
+    findByCategory(category: string): readonly CliFirestoreQueryManifestEntry[];
+    findByTag(tag: string): readonly CliFirestoreQueryManifestEntry[];
+}
+/**
+ * Builds a {@link CliFirestoreQueryRegistry} over a generated manifest.
+ *
+ * @param manifest - The generated `<NS>_FIRESTORE_QUERY_MANIFEST`.
+ * @returns The read API.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function createCliFirestoreQueryRegistry(manifest: CliFirestoreQueryManifest): CliFirestoreQueryRegistry;

package/src/lib/index.d.ts

@@ -5,9 +5,12 @@ export * from './config';
 export * from './context';
 export * from './doctor';
 export * from './env';
+export * from './firestore';
 export * from './manifest';
 export * from './mcp-scan';
 export * from './middleware';
+export * from './scan-helpers/emit-generated-ts.js';
+export * from './scan-helpers/exported-from-package.js';
 export * from './scan-helpers/scan-io.js';
 export * from './scan-helpers/scan-extract-utils.js';
 export * from './scan-helpers/firestore-model-extract-utils.js';

package/src/lib/manifest/types.d.ts

@@ -1,3 +1,4 @@
+import type { FirestoreQueryConstraint } from '@dereekb/firebase';
 import type { Maybe } from '@dereekb/util';
 import { type Type } from 'arktype';
 /**
@@ -134,6 +135,14 @@ export interface CliModelManifestEntry {
      * `system` / `owner` / `admin-only` / `permissions`. Absent when the model interface omits the tag.
      */
     readonly read?: 'system' | 'owner' | 'admin-only' | 'permissions';
+    /**
+     * True when the model declared `@dbxModelServerOnly` — no client may read it, on any path.
+     *
+     * Mirrors `FirebaseModelServiceConfig.serverOnly` on the runtime side. Carried on the manifest so
+     * the CLI can refuse the read locally, before choosing a transport, instead of round-tripping to
+     * an API that will refuse it anyway.
+     */
+    readonly serverOnly?: boolean;
     /**
      * Resolved `@dbxModelServiceFactory <modelType>`-tagged export that implements this model.
      * Joined by `modelType` during model-manifest assembly. Absent when no factory was found
@@ -328,6 +337,13 @@ export interface McpManifestModelEntry {
      * build-time name validation so both compose the same names.
      */
     readonly mcpToolNameSegment?: string;
+    /**
+     * True when the model declared `@dbxModelServerOnly` — no client may read it, on any path.
+     *
+     * Surfaced in the MCP catalog so a tool consumer sees the refusal is structural (there is no
+     * client read grant in `firestore.rules` either) rather than a missing role it could be granted.
+     */
+    readonly serverOnly?: boolean;
 }
 /**
  * One auth claim entry in the pre-rendered MCP manifest JSON. Powers the
@@ -512,3 +528,104 @@ export declare function abbreviateMcpCallType(callType: string): string;
  * ```
  */
 export declare function buildDisambiguatedMcpToolName(modelSegment: string, callType: string, specifier?: Maybe<string>): string;
+/**
+ * Firestore query scope a catalog entry runs at, mirroring
+ * `@dbxModelFirebaseIndexScope`.
+ */
+export type CliFirestoreQueryScope = 'COLLECTION' | 'COLLECTION_GROUP';
+/**
+ * One documented positional parameter of a query factory.
+ *
+ * `type` is the source type TEXT as written in the factory's signature, not a
+ * runtime validator — the manifest is generated by reading the AST, and there
+ * is deliberately no validator layer behind it.
+ */
+export interface CliFirestoreQueryParam {
+    readonly name: string;
+    /**
+     * The parameter's source type text, e.g. `string`, `Maybe<Date>`,
+     * `PublishedGuestbookEntriesQueryParams`.
+     */
+    readonly type: string;
+    readonly description?: string;
+    /**
+     * True for `?` params AND params carrying an initializer — either way the
+     * factory can be called without supplying one.
+     */
+    readonly optional: boolean;
+}
+/**
+ * The callable shape a bound query factory exposes.
+ *
+ * Deliberately untyped in its arguments: the manifest binds factories with
+ * every positional shape the workspace's `*.query.ts` files use (zero-arg,
+ * single scalar, single params object, two positionals, ...).
+ */
+export type CliFirestoreQueryFactory = (...args: readonly any[]) => readonly FirestoreQueryConstraint[];
+/**
+ * One entry in the generated per-model Firestore query catalog.
+ *
+ * Produced by the `firestore-query-manifest` generator from the same
+ * `@dbxModelFirebaseIndex`-tagged factories that drive `firestore.indexes.json`,
+ * so the catalog and the emitted indexes can never disagree.
+ */
+export interface CliFirestoreQueryManifestEntry {
+    /**
+     * Kebab-case identifier used on the command line.
+     */
+    readonly slug: string;
+    /**
+     * The exported identifier of the factory.
+     */
+    readonly name: string;
+    /**
+     * The package the factory is exported from.
+     */
+    readonly module: string;
+    /**
+     * The factory's source file, relative to the source package.
+     */
+    readonly subpath: string;
+    /**
+     * PascalCase model name, from `@dbxModelFirebaseIndexModel`.
+     */
+    readonly model: string;
+    /**
+     * Short collection name — joins {@link CliModelManifestEntry.collectionPrefix}.
+     */
+    readonly collection: string;
+    readonly isNested: boolean;
+    readonly scope: CliFirestoreQueryScope;
+    /**
+     * The factory's full source signature, quoted back in argument errors.
+     */
+    readonly signature: string;
+    readonly params: readonly CliFirestoreQueryParam[];
+    readonly description?: string;
+    readonly category?: string;
+    readonly tags?: readonly string[];
+    readonly example?: string;
+    readonly relatedSlugs?: readonly string[];
+    /**
+     * Index-emission governance flags carried through from the extractor. None
+     * of them affect callability — they govern what lands in
+     * `firestore.indexes.json`.
+     */
+    readonly manual?: boolean;
+    readonly skip?: boolean;
+    readonly excluded?: boolean;
+    /**
+     * True for a factory that only delegates to others; invocable, but its own
+     * constraint sequence is empty by design. See {@link relatedSlugs}.
+     */
+    readonly dispatcher?: boolean;
+    /**
+     * Absent when the identifier is not exported from {@link module}'s barrel
+     * chain — the entry is listed but cannot be executed.
+     */
+    readonly factory?: CliFirestoreQueryFactory;
+}
+/**
+ * The generated per-model Firestore query catalog.
+ */
+export type CliFirestoreQueryManifest = readonly CliFirestoreQueryManifestEntry[];

package/src/lib/mcp-scan/manifest/dbx-docs-ui-examples-schema.d.ts

@@ -59,7 +59,7 @@ export type DbxDocsUiExampleUseEntry = typeof DbxDocsUiExampleUseEntry.infer;
  */
 export declare const DbxDocsUiExampleEntry: import("arktype/internal/variants/object.ts").ObjectType<{
     slug: string;
-    category: "action" | "list" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
+    category: "list" | "action" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
     summary: string;
     header: string;
     className: string;
@@ -103,7 +103,7 @@ export declare const DbxDocsUiExampleManifest: import("arktype/internal/variants
     generator: string;
     entries: {
         slug: string;
-        category: "action" | "list" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
+        category: "list" | "action" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
         summary: string;
         header: string;
         className: string;

package/src/lib/mcp-scan/manifest/model-snapshot-fields-schema.d.ts

@@ -56,7 +56,7 @@ export type ModelSnapshotFieldParamEntry = typeof ModelSnapshotFieldParamEntry.i
 export declare const ModelSnapshotFieldEntry: import("arktype/internal/variants/object.ts").ObjectType<{
     slug: string;
     name: string;
-    kind: "const" | "factory";
+    kind: "factory" | "const";
     category: string;
     module: string;
     subpath: string;
@@ -99,7 +99,7 @@ export declare const ModelSnapshotFieldManifest: import("arktype/internal/varian
     entries: {
         slug: string;
         name: string;
-        kind: "const" | "factory";
+        kind: "factory" | "const";
         category: string;
         module: string;
         subpath: string;

package/src/lib/mcp-scan/manifest/pipes-schema.d.ts

@@ -57,7 +57,7 @@ export type PipeArgEntry = typeof PipeArgEntry.infer;
  */
 export declare const PipeEntry: import("arktype/internal/variants/object.ts").ObjectType<{
     slug: string;
-    category: "date" | "value" | "misc" | "async";
+    category: "value" | "date" | "misc" | "async";
     pipeName: string;
     className: string;
     module: string;
@@ -98,7 +98,7 @@ export declare const PipeManifest: import("arktype/internal/variants/object.ts")
     generator: string;
     entries: {
         slug: string;
-        category: "date" | "value" | "misc" | "async";
+        category: "value" | "date" | "misc" | "async";
         pipeName: string;
         className: string;
         module: string;

package/src/lib/mcp-scan/manifest/ui-components-schema.d.ts

@@ -67,7 +67,7 @@ export type UiComponentOutputEntry = typeof UiComponentOutputEntry.infer;
  */
 export declare const UiComponentEntry: import("arktype/internal/variants/object.ts").ObjectType<{
     slug: string;
-    category: "action" | "list" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
+    category: "list" | "action" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
     kind: "pipe" | "component" | "directive" | "service";
     selector: string;
     className: string;
@@ -116,7 +116,7 @@ export declare const UiComponentManifest: import("arktype/internal/variants/obje
     generator: string;
     entries: {
         slug: string;
-        category: "action" | "list" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
+        category: "list" | "action" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
         kind: "pipe" | "component" | "directive" | "service";
         selector: string;
         className: string;

package/src/lib/mcp-scan/manifest/utils-schema.d.ts

@@ -51,7 +51,7 @@ export type UtilParamEntry = typeof UtilParamEntry.infer;
 export declare const UtilEntry: import("arktype/internal/variants/object.ts").ObjectType<{
     slug: string;
     name: string;
-    kind: "function" | "class" | "const" | "factory";
+    kind: "function" | "factory" | "class" | "const";
     category: string;
     module: string;
     subpath: string;
@@ -93,7 +93,7 @@ export declare const UtilManifest: import("arktype/internal/variants/object.ts")
     entries: {
         slug: string;
         name: string;
-        kind: "function" | "class" | "const" | "factory";
+        kind: "function" | "factory" | "class" | "const";
         category: string;
         module: string;
         subpath: string;

package/src/lib/mcp-scan/scan/dbx-docs-ui-examples-extract.d.ts

@@ -134,7 +134,7 @@ export declare function extractDbxDocsUiExampleEntries(input: ExtractDbxDocsUiEx
  */
 export declare const ExtractedDbxDocsUiExampleEntrySchema: import("arktype/internal/variants/object.ts").ObjectType<{
     slug: string;
-    category: "action" | "list" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
+    category: "list" | "action" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
     summary: string;
     header: string;
     className: string;

package/src/lib/mcp-scan/scan/extract-models/types.d.ts

@@ -81,6 +81,11 @@ export interface ExtractedInterfaceTags {
     readonly dbxModelOrganizationalGroupRoot: boolean;
     readonly dbxModelCompositeKey?: ExtractedCompositeKeyTag;
     readonly dbxModelRead?: DbxModelReadLevel;
+    /**
+     * True when the interface carries `@dbxModelServerOnly` — no client read grant exists in
+     * `firestore.rules`, and the model API must refuse the read too.
+     */
+    readonly dbxModelServerOnly?: boolean;
 }
 /**
  * One `export interface` declaration. The `tags` flags drive model

package/src/lib/mcp-scan/scan/ui-components-extract.d.ts

@@ -95,7 +95,7 @@ export declare function extractUiEntries(input: ExtractUiEntriesInput): ExtractU
  */
 export declare const ExtractedUiEntrySchema: import("arktype/internal/variants/object.ts").ObjectType<{
     slug: string;
-    category: "action" | "list" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
+    category: "list" | "action" | "screen" | "text" | "layout" | "button" | "card" | "feedback" | "overlay" | "navigation" | "router" | "misc";
     kind: "pipe" | "component" | "directive" | "service";
     selector: string;
     className: string;