@dereekb/dbx-cli 13.41.0 → 13.43.0

package/lint-cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli-lint-cache",
-  "version": "13.41.0",
+  "version": "13.43.0",
   "private": true,
   "type": "module",
   "devDependencies": {
@@ -8,7 +8,7 @@
     "eslint": "10.4.0"
   },
   "peerDependencies": {
-    "@dereekb/util": "13.41.0",
+    "@dereekb/util": "13.43.0",
     "yargs": "^18.0.0"
   }
 }

package/manifest-extract/index.esm.js

@@ -1,4 +1,4 @@
-import { Project, Node } from 'ts-morph';
+import { Project, Node, SyntaxKind } from 'ts-morph';
 import { parseFirestoreModelIdentityArgs, resolveExtendsName } from '@dereekb/dbx-cli';
 
 function _define_property$1(obj, key, value) {
@@ -702,6 +702,14 @@ var MCP_TOOL_NAME_SEGMENT_TAG = 'dbxModelMcpToolNameSegment';
 var MODEL_TYPE_VALUE_PATTERN = /^[a-z][A-Za-z0-9_$]*$/;
 var TOOL_NAME_SEGMENT_PATTERN = /^[A-Za-z][A-Za-z0-9_$]*$/;
 var IDENTITY_FN = 'firestoreModelIdentity';
+var SINGLE_ITEM_COLLECTION_FN = 'singleItemFirestoreCollection';
+var ROOT_SINGLE_ITEM_COLLECTION_FN = 'rootSingleItemFirestoreCollection';
+var SINGLE_ITEM_COLLECTION_FN_NAMES = [
+    SINGLE_ITEM_COLLECTION_FN,
+    ROOT_SINGLE_ITEM_COLLECTION_FN
+];
+var MODEL_IDENTITY_KEY = 'modelIdentity';
+var SINGLE_ITEM_IDENTIFIER_KEY = 'singleItemIdentifier';
 var CONVERTER_FN_NAMES = [
     'snapshotConverterFunctions',
     'firestoreSubObject',
@@ -736,13 +744,17 @@ var FIRESTORE_FIELD_KEY = 'firestoreField';
     var enums = readEnums(sourceFile);
     var modelGroups = readModelGroups(sourceFile);
     var serviceFactories = readServiceFactories(sourceFile);
+    var singleItemCollections = readSingleItemCollections(sourceFile);
+    var stringConstants = readStringConstants(sourceFile);
     return {
         identities: identities,
         interfaces: interfaces,
         converters: converters,
         enums: enums,
         modelGroups: modelGroups,
-        serviceFactories: serviceFactories
+        serviceFactories: serviceFactories,
+        singleItemCollections: singleItemCollections,
+        stringConstants: stringConstants
     };
 }
 function readIdentities(sourceFile) {
@@ -1080,6 +1092,140 @@ function readServiceFactoryModelType(jsDocs) {
     }
     return result;
 }
+/**
+ * Finds every `singleItemFirestoreCollection` / `rootSingleItemFirestoreCollection` call in the
+ * file. Unlike the other artifacts these are not top-level declarations — they sit inside the
+ * `<model>FirestoreCollectionFactory` function bodies — so this needs a full descendant walk,
+ * guarded on the raw text so files declaring no single-item collection skip it entirely.
+ *
+ * @param sourceFile - The parsed source file.
+ * @returns One entry per resolvable call, in source order.
+ */ function readSingleItemCollections(sourceFile) {
+    var out = [];
+    var text = sourceFile.getFullText();
+    if (SINGLE_ITEM_COLLECTION_FN_NAMES.some(function(name) {
+        return text.includes(name);
+    })) {
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var call = _step.value;
+                var fnName = readCalleeName(call);
+                if (fnName !== SINGLE_ITEM_COLLECTION_FN && fnName !== ROOT_SINGLE_ITEM_COLLECTION_FN) continue;
+                var entry = buildSingleItemCollection(call, fnName === ROOT_SINGLE_ITEM_COLLECTION_FN);
+                if (entry) out.push(entry);
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
+                }
+            } finally{
+                if (_didIteratorError) {
+                    throw _iteratorError;
+                }
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Resolves a call's function name for both the bare (`singleItemFirestoreCollection(...)`) and the
+ * method (`firestoreContext.singleItemFirestoreCollection(...)`) forms.
+ *
+ * @param call - The call expression.
+ * @returns The called function's name, or the verbatim callee text when it is neither shape.
+ */ function readCalleeName(call) {
+    var expression = call.getExpression();
+    return Node.isPropertyAccessExpression(expression) ? expression.getName() : expression.getText();
+}
+function buildSingleItemCollection(call, root) {
+    var result;
+    var args = call.getArguments();
+    if (args.length > 0) {
+        var config = args[0];
+        if (Node.isObjectLiteralExpression(config)) {
+            var identityNode = readPropertyValue(config, MODEL_IDENTITY_KEY);
+            if (identityNode && Node.isIdentifier(identityNode)) {
+                var identifierNode = readPropertyValue(config, SINGLE_ITEM_IDENTIFIER_KEY);
+                result = {
+                    identityConst: identityNode.getText(),
+                    root: root,
+                    documentId: readStringLiteralText(identifierNode),
+                    documentIdConstRef: identifierNode && Node.isIdentifier(identifierNode) ? identifierNode.getText() : undefined,
+                    explicitIdentifier: config.getProperty(SINGLE_ITEM_IDENTIFIER_KEY) !== undefined,
+                    line: call.getStartLineNumber()
+                };
+            }
+        }
+    }
+    return result;
+}
+function readStringConstants(sourceFile) {
+    var out = [];
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = sourceFile.getVariableStatements()[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var statement = _step.value;
+            if (!statement.isExported()) continue;
+            var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+            try {
+                for(var _iterator1 = statement.getDeclarations()[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                    var decl = _step1.value;
+                    var value = readStringLiteralText(decl.getInitializer());
+                    if (value !== undefined) {
+                        out.push({
+                            name: decl.getName(),
+                            value: value
+                        });
+                    }
+                }
+            } catch (err) {
+                _didIteratorError1 = true;
+                _iteratorError1 = err;
+            } finally{
+                try {
+                    if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                        _iterator1.return();
+                    }
+                } finally{
+                    if (_didIteratorError1) {
+                        throw _iteratorError1;
+                    }
+                }
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Reads a node's string-literal text, peeling any `as const` / `as Foo` assertion.
+ *
+ * @param node - The candidate node, or `undefined`.
+ * @returns The literal text, or `undefined` when the node is not a string literal.
+ */ function readStringLiteralText(node) {
+    var current = node;
+    while(current !== undefined && Node.isAsExpression(current)){
+        current = current.getExpression();
+    }
+    return current !== undefined && (Node.isStringLiteral(current) || Node.isNoSubstitutionTemplateLiteral(current)) ? current.getLiteralText() : undefined;
+}
 function readConverters(sourceFile) {
     var out = [];
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;

package/manifest-extract/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@dereekb/dbx-cli/manifest-extract",
-  "version": "13.41.0",
+  "version": "13.43.0",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
     "@dereekb/date": "13.15.0",
-    "@dereekb/dbx-cli": "13.41.0",
+    "@dereekb/dbx-cli": "13.43.0",
     "@dereekb/firebase": "13.15.0",
     "@dereekb/model": "13.15.0",
     "@dereekb/nestjs": "13.15.0",

package/manifest-extract/src/lib/extract-models.d.ts

@@ -2,8 +2,10 @@
  * Per-source-file walker that pulls Firestore-model metadata out of a `.ts`
  * file: identities, `@dbxModel`-tagged interfaces with their property JSDocs,
  * snapshot converters (top-level `snapshotConverterFunctions`,
- * `firestoreSubObject`, and `firestoreObjectArray` consts), enums, and
- * `@dbxModelGroup`-tagged collection containers.
+ * `firestoreSubObject`, and `firestoreObjectArray` consts), enums,
+ * `@dbxModelGroup`-tagged collection containers, single-item collection
+ * declarations (with the fixed document id they pin), and the exported
+ * string constants such an id may be declared as.
  *
  * Mirrors the per-file outputs of `dbx-components-mcp`'s `extractModels()`
  * but lives inside `@dereekb/dbx-cli/manifest-extract` so the `dbx-cli`

package/manifest-extract/src/lib/types.d.ts

@@ -279,6 +279,20 @@ export interface ModelExtraction {
      * manifest can surface the implementing factory alongside each model.
      */
     readonly serviceFactories: readonly ModelExtractionServiceFactory[];
+    /**
+     * `singleItemFirestoreCollection(...)` / `rootSingleItemFirestoreCollection(...)` calls found
+     * anywhere in this file (they live inside collection-factory function bodies, not at the top
+     * level). The orchestrator joins these onto matching model entries by `identityConst` so the
+     * runtime manifest can publish each singleton model's fixed document id.
+     */
+    readonly singleItemCollections: readonly ModelExtractionSingleItemCollection[];
+    /**
+     * Exported `const <NAME> = '<literal>'` string constants declared in this file. Aggregated by
+     * the orchestrator into a cross-file registry so a
+     * {@link ModelExtractionSingleItemCollection.documentIdConstRef} declared in a sibling file
+     * still resolves.
+     */
+    readonly stringConstants: readonly ModelExtractionStringConstant[];
 }
 /**
  * One `@dbxModelServiceFactory <modelType>`-tagged variable export.
@@ -294,3 +308,54 @@ export interface ModelExtractionServiceFactory {
      */
     readonly exportName: string;
 }
+/**
+ * One `firestoreContext.singleItemFirestoreCollection({ ... })` or
+ * `firestoreContext.rootSingleItemFirestoreCollection({ ... })` call — the declaration that a
+ * model's collection holds exactly one document, at a fixed id.
+ *
+ * The id is what a caller needs to build a document key and what the manifest could not express
+ * before: it defaults to `DEFAULT_SINGLE_ITEM_FIRESTORE_COLLECTION_DOCUMENT_IDENTIFIER` (`'0'`)
+ * but is frequently overridden, so `'/0'` cannot be inferred.
+ */
+export interface ModelExtractionSingleItemCollection {
+    /**
+     * Identity const named by the call's `modelIdentity` property (e.g.
+     * `billingGroupInvoiceSummaryIdentity`) — the join key back to the model entry.
+     */
+    readonly identityConst: string;
+    /**
+     * `true` for the `rootSingleItemFirestoreCollection` variant (a root collection holding one
+     * document), `false` for the `singleItemFirestoreCollection` subcollection variant.
+     */
+    readonly root: boolean;
+    /**
+     * Document id when `singleItemIdentifier` is a string literal. `undefined` when the property is
+     * absent, names a const (see {@link documentIdConstRef}), or is an unresolvable expression.
+     */
+    readonly documentId: string | undefined;
+    /**
+     * Const name when `singleItemIdentifier` is an identifier reference (e.g.
+     * `BILLING_GROUP_SUMMARY_BILLING_SINGLE_IDENTIFIER`), resolved by the orchestrator against the
+     * cross-file string-constant registry.
+     */
+    readonly documentIdConstRef: string | undefined;
+    /**
+     * `true` when the config object declares a `singleItemIdentifier` property at all. `false` means
+     * the runtime default applies; `true` with neither {@link documentId} nor
+     * {@link documentIdConstRef} means the value is an expression the walker could not read, and the
+     * id is genuinely unknown rather than defaulted.
+     */
+    readonly explicitIdentifier: boolean;
+    /**
+     * Source-line number of the call (1-based) for diagnostics.
+     */
+    readonly line: number;
+}
+/**
+ * One exported `const <NAME> = '<literal>'` string constant, captured so cross-file
+ * `singleItemIdentifier: SOME_CONST` references resolve without type-checker access.
+ */
+export interface ModelExtractionStringConstant {
+    readonly name: string;
+    readonly value: string;
+}

package/model-test/index.esm.js

@@ -438,31 +438,6 @@ function toPosix(p) {
     return p.split(sep).join('/');
 }
 
-function _array_like_to_array$6(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_without_holes$6(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
-}
-function _iterable_to_array$6(iter) {
-    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
-}
-function _non_iterable_spread$6() {
-    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _to_consumable_array$6(arr) {
-    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$6();
-}
-function _unsupported_iterable_to_array$6(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
-}
 var SPEC_FILE_VIRTUAL_PATH = '__spec__/spec.ts';
 var FIXTURE_CONTEXT_SUFFIX = 'Context';
 var FIXTURE_FACTORY_SUFFIX = 'ContextFactory';
@@ -670,7 +645,7 @@ function isItName(name) {
             }
         }
     }
-    return _to_consumable_array$6(seen);
+    return Array.from(seen);
 }
 /**
  * `true` when the import specifier points at the conventional fixture module
@@ -730,7 +705,7 @@ function sharedPrefix(a, b) {
     return s;
 }
 function dedupedSorted(names) {
-    return _to_consumable_array$6(new Set(names)).sort(function(a, b) {
+    return Array.from(new Set(names)).sort(function(a, b) {
         return a.localeCompare(b);
     });
 }
@@ -1294,31 +1269,6 @@ var KNOWN_NON_MODEL_FIXTURE_FAMILIES = [
     });
 }
 
-function _array_like_to_array$5(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_without_holes$5(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
-}
-function _iterable_to_array$5(iter) {
-    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
-}
-function _non_iterable_spread$5() {
-    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _to_consumable_array$5(arr) {
-    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$5();
-}
-function _unsupported_iterable_to_array$5(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
-}
 var FIXTURE_SUFFIX = 'TestContextFixture';
 var INSTANCE_SUFFIX = 'TestContextInstance';
 var PARAMS_SUFFIX = 'TestContextParams';
@@ -2239,7 +2189,7 @@ function readFactoryArgInfo(args) {
             }
         }
     }
-    var list = _to_consumable_array$5(all);
+    var list = Array.from(all);
     list.sort(function(a, b) {
         var _ref, _fixtures_get, _ref1, _fixtures_get1;
         var _this, _this1;
@@ -2388,7 +2338,7 @@ function readFactoryArgInfo(args) {
             }
         }
     }
-    var list = _to_consumable_array$5(out);
+    var list = Array.from(out);
     list.sort(function(a, b) {
         return a.localeCompare(b);
     });

package/model-test/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dereekb/dbx-cli/model-test",
-  "version": "13.41.0",
+  "version": "13.43.0",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/util": "13.41.0",
+    "@dereekb/util": "13.43.0",
     "ts-morph": "^21.0.0"
   },
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli",
-  "version": "13.41.0",
+  "version": "13.43.0",
   "type": "module",
   "sideEffects": false,
   "bin": {
@@ -66,11 +66,11 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/date": "13.41.0",
-    "@dereekb/firebase": "13.41.0",
-    "@dereekb/model": "13.41.0",
-    "@dereekb/nestjs": "13.41.0",
-    "@dereekb/util": "13.41.0",
+    "@dereekb/date": "13.43.0",
+    "@dereekb/firebase": "13.43.0",
+    "@dereekb/model": "13.43.0",
+    "@dereekb/nestjs": "13.43.0",
+    "@dereekb/util": "13.43.0",
     "@nestjs/common": "^11.1.19",
     "arktype": "^2.2.0",
     "firebase": "^12.12.1",

package/route/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@dereekb/dbx-cli/route",
-  "version": "13.41.0",
+  "version": "13.43.0",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/date": "13.41.0",
-    "@dereekb/dbx-cli": "13.41.0",
-    "@dereekb/firebase": "13.41.0",
-    "@dereekb/model": "13.41.0",
-    "@dereekb/nestjs": "13.41.0",
-    "@dereekb/util": "13.41.0"
+    "@dereekb/date": "13.43.0",
+    "@dereekb/dbx-cli": "13.43.0",
+    "@dereekb/firebase": "13.43.0",
+    "@dereekb/model": "13.43.0",
+    "@dereekb/nestjs": "13.43.0",
+    "@dereekb/util": "13.43.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/src/lib/doctor/build-drift.check.d.ts

@@ -0,0 +1,21 @@
+import { type InspectCliBuildDriftInput } from '../runner/build-stamp';
+import { type DoctorCheck } from './doctor.command.factory';
+/**
+ * Name reported by the check {@link createCliBuildDriftDoctorCheck} builds.
+ */
+export declare const BUILD_DRIFT_DOCTOR_CHECK_NAME = "cli-build-not-stale";
+/**
+ * Builds the doctor check that compares the running artifact against the `@dereekb/*` tree resolved
+ * at run time.
+ *
+ * Runs FIRST in the default check list, ahead of every network hop, because a stale artifact
+ * invalidates the answers those hops give: they exercise the framework that is loaded now, not the
+ * one the bundle was compiled against, so a green `token-refresh-round-trip` next to a red read is
+ * exactly the misleading report this check exists to pre-empt.
+ *
+ * @param input - Optional overrides forwarded to {@link inspectCliBuildDrift}; apps normally pass only
+ *   `manifestGeneratorVersion`.
+ * @returns The {@link DoctorCheck}.
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function createCliBuildDriftDoctorCheck(input?: InspectCliBuildDriftInput): DoctorCheck;

package/src/lib/doctor/doctor.command.factory.d.ts

@@ -16,11 +16,24 @@ export interface DoctorCheckResult {
 }
 export type DoctorCheck = (input: DoctorCheckInput) => Promise<DoctorCheckResult>;
 /**
- * Built-in checks: config file present, active env resolved, OIDC discovery, token refresh, API reachability.
+ * Input for {@link defaultDoctorChecks}.
+ */
+export interface DefaultDoctorChecksInput {
+    /**
+     * The `@dereekb/dbx-cli` version that emitted the app's generated manifests
+     * (`<NAMESPACE>_STAMP.generatorVersion`). Forwarded to the build-drift check so a manifest produced
+     * by a different generator than the one running it is flagged.
+     */
+    readonly manifestGeneratorVersion?: Maybe<string>;
+}
+/**
+ * Built-in checks: build not stale, config file present, active env resolved, OIDC discovery, token
+ * refresh, API reachability.
  *
+ * @param input - Optional configuration for the built-in checks.
  * @returns The default {@link DoctorCheck} list, in execution order.
  */
-export declare function defaultDoctorChecks(): DoctorCheck[];
+export declare function defaultDoctorChecks(input?: DefaultDoctorChecksInput): DoctorCheck[];
 export interface CreateDoctorCommandInput {
     readonly cliName: string;
     /**
@@ -32,6 +45,11 @@ export interface CreateDoctorCommandInput {
      * doctor can run against an env that only stores overrides on top of a registered default.
      */
     readonly defaultEnvs?: readonly CliEnvDefault[];
+    /**
+     * The generator version stamped into the app's generated manifests, forwarded to the built-in
+     * build-drift check.
+     */
+    readonly manifestGeneratorVersion?: Maybe<string>;
 }
 /**
  * Composable doctor command.
@@ -43,6 +61,7 @@ export interface CreateDoctorCommandInput {
  * @param input.cliName - The CLI's binary name.
  * @param input.checks - Additional checks to append after the default check list.
  * @param input.defaultEnvs - Built-in env presets merged underneath the user's stored env when names match.
+ * @param input.manifestGeneratorVersion - The generator version stamped into the app's generated manifests.
  * @returns A yargs `CommandModule` exposing the `doctor` command.
  * @__NO_SIDE_EFFECTS__
  */

package/src/lib/doctor/firestore-session.check.d.ts

@@ -120,7 +120,13 @@ export declare function buildFirestoreSessionDoctorReadRouting(input: {
  * 3. `GET /session/firestore` is reachable and mints a custom token (+ an App Check token when the
  *    API is configured with a web `appId`);
  * 4. `signInWithCustomToken` succeeds against the configured project;
- * 5. the app-supplied {@link FirestoreSessionDoctorProbe} performs one rules-protected read.
+ * 5. the session's Firestore handle is one the loaded client SDK accepts (`inspectCliFirestoreSdkIdentity`),
+ *    reported as `stage: 'firestore-sdk-identity'`. Sits between the sign-in and the read because it
+ *    is the hop whose failure otherwise MASQUERADES as the read's: the handshake returns a uid, and
+ *    the read then dies on the SDK's `Expected first argument to collection() to be …` — a message
+ *    that names neither the model nor the handle, and sends the operator to rules and App Check
+ *    instead of to a duplicated SDK or a stale artifact;
+ * 6. the app-supplied {@link FirestoreSessionDoctorProbe} performs one rules-protected read.
  *
  * Doctor checks run PRE-AUTH — `DoctorCheckInput` is only `{ cliName, envName, env, config }`, with no
  * token and no `CliContext` — so this loads credentials itself via `buildCliPaths` +

package/src/lib/doctor/index.d.ts

@@ -1,2 +1,3 @@
+export * from './build-drift.check';
 export * from './doctor.command.factory';
 export * from './firestore-session.check';