@dereekb/dbx-cli 14.2.0 → 14.3.0

package/index.esm.js

@@ -7,11 +7,13 @@ import { Firestore, getFirestore, connectFirestoreEmulator } from 'firebase/fire
 import { getApps, initializeApp, deleteApp } from 'firebase/app';
 import { initializeAppCheck, CustomProvider } from 'firebase/app-check';
 import { signInWithCustomToken, getAuth, connectAuthEmulator } from 'firebase/auth';
-import { expirationDetails, performAsyncTasks, compareStrings, OidcRelyingPartyError, buildAuthorizationUrl as buildAuthorizationUrl$1, parseAuthorizationRedirect, noop, generateOAuthState, generatePkceMaterial, MS_IN_SECOND, isPlainObject as isPlainObject$1, MS_IN_HOUR, asArray, buildOidcDiscoveryCandidates, unique, AUTH_TOS_SIGNED_ROLE, AUTH_ONBOARDED_ROLE, AUTH_ADMIN_ROLE, AUTH_USER_ROLE } from '@dereekb/util';
+import { expirationDetails, performAsyncTasks, compareStrings, OidcRelyingPartyError, buildAuthorizationUrl as buildAuthorizationUrl$1, parseAuthorizationRedirect, noop, generateOAuthState, MS_IN_SECOND, generatePkceMaterial, isPlainObject as isPlainObject$1, MS_IN_HOUR, asArray, buildOidcDiscoveryCandidates, unique, AUTH_TOS_SIGNED_ROLE, AUTH_ONBOARDED_ROLE, AUTH_ADMIN_ROLE, AUTH_USER_ROLE } from '@dereekb/util';
 import { createMemoizedJsonFileAsyncKeyedValueCache, readJsonFile, writeJsonFile, DEFAULT_JSON_FILE_CACHE_MODE, removeFile } from '@dereekb/nestjs';
 import { durationDataToMilliseconds, parseDurationString } from '@dereekb/date';
 import { homedir } from 'node:os';
 import { discoverOidcMetadata as discoverOidcMetadata$1, exchangeAuthorizationCode as exchangeAuthorizationCode$1, refreshAccessToken as refreshAccessToken$1, revokeToken as revokeToken$1, fetchUserInfo as fetchUserInfo$1, fetchSessionInfo as fetchSessionInfo$1 } from '@dereekb/util/oidc';
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
 import { createInterface } from 'node:readline';
 import { chmod, writeFile, mkdir, readFile, glob, stat, readdir } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
@@ -36,7 +38,7 @@ function _assert_this_initialized(self) {
     if (self === void 0) throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
     return self;
 }
-function asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -47,16 +49,16 @@ function asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1t(fn) {
+function _async_to_generator$1u(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -115,7 +117,7 @@ function _inherits(subClass, superClass) {
     });
     if (superClass) _set_prototype_of(subClass, superClass);
 }
-function _instanceof$x(left, right) {
+function _instanceof$y(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -187,7 +189,7 @@ function _set_prototype_of(o, p) {
 function _to_consumable_array$_(arr) {
     return _array_without_holes$_(arr) || _iterable_to_array$_(arr) || _unsupported_iterable_to_array$1c(arr) || _non_iterable_spread$_();
 }
-function _ts_generator$1t(thisArg, body) {
+function _ts_generator$1u(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -407,10 +409,10 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
  * @param init - The RequestInit. Any existing `signal` is preserved; we only attach our own when no signal was supplied.
  * @returns The fetch Response.
  */ function tracedFetch(fetcher, input, init) {
-    return _async_to_generator$1t(function() {
+    return _async_to_generator$1u(function() {
         var _ref, fetchImpl, timeoutMs, method, url, controller, timeoutHandle, finalInit, // Don't let the abort timer itself keep the Node event loop (or a test worker) alive.
         _timeoutHandle_unref, localController, e;
-        return _ts_generator$1t(this, function(_state) {
+        return _ts_generator$1u(this, function(_state) {
             switch(_state.label){
                 case 0:
                     fetchImpl = fetcher !== null && fetcher !== void 0 ? fetcher : fetch;
@@ -418,7 +420,7 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
                     method = (_ref = init === null || init === void 0 ? void 0 : init.method) !== null && _ref !== void 0 ? _ref : 'GET';
                     if (typeof input === 'string') {
                         url = input;
-                    } else if (_instanceof$x(input, URL)) {
+                    } else if (_instanceof$y(input, URL)) {
                         url = input.toString();
                     } else {
                         url = input.url;
@@ -729,7 +731,7 @@ function stringifyEnvelope(value) {
     var result;
     if (mapped) {
         result = mapped;
-    } else if (_instanceof$x(error, CliError)) {
+    } else if (_instanceof$y(error, CliError)) {
         result = _object_spread$10({
             ok: false,
             error: sanitizeString(error.message),
@@ -737,7 +739,7 @@ function stringifyEnvelope(value) {
         }, error.suggestion ? {
             suggestion: error.suggestion
         } : {});
-    } else if (_instanceof$x(error, Error)) {
+    } else if (_instanceof$y(error, Error)) {
         result = {
             ok: false,
             error: sanitizeString(error.message),
@@ -761,7 +763,7 @@ function _array_like_to_array$1b(arr, len) {
 function _array_without_holes$Z(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$1b(arr);
 }
-function asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -772,16 +774,16 @@ function asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1s(fn) {
+function _async_to_generator$1t(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -842,7 +844,7 @@ function _object_spread_props$H(target, source) {
 function _to_consumable_array$Z(arr) {
     return _array_without_holes$Z(arr) || _iterable_to_array$Z(arr) || _unsupported_iterable_to_array$1b(arr) || _non_iterable_spread$Z();
 }
-function _ts_generator$1s(thisArg, body) {
+function _ts_generator$1t(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -966,9 +968,9 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The call envelope describing the API target, access token, model params, and optional fetch override.
  * @returns The parsed JSON response body cast to `R`.
  */ function callModelOverHttp(input) {
-    return _async_to_generator$1s(function() {
+    return _async_to_generator$1t(function() {
         var _input_params_call;
-        return _ts_generator$1s(this, function(_state) {
+        return _ts_generator$1t(this, function(_state) {
             return [
                 2,
                 requestJson({
@@ -996,8 +998,8 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The request envelope describing the API target, access token, model + key, and optional fetch override.
  * @returns The parsed `{ key, data }` envelope.
  */ function getModelOverHttp(input) {
-    return _async_to_generator$1s(function() {
-        return _ts_generator$1s(this, function(_state) {
+    return _async_to_generator$1t(function() {
+        return _ts_generator$1t(this, function(_state) {
             return [
                 2,
                 requestJson({
@@ -1025,8 +1027,8 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The request envelope describing the API target, access token, model, keys, and optional fetch override.
  * @returns The parsed `{ results, errors }` envelope.
  */ function getMultipleModelsOverHttp(input) {
-    return _async_to_generator$1s(function() {
-        return _ts_generator$1s(this, function(_state) {
+    return _async_to_generator$1t(function() {
+        return _ts_generator$1t(this, function(_state) {
             if (input.keys.length === 0) {
                 throw new CliError({
                     message: 'get-many requires at least one key.',
@@ -1064,9 +1066,9 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - Same shape as {@link GetMultipleModelsOverHttpInput} but without the 50-key cap.
  * @returns The merged `{ results, errors }` envelope across all chunks.
  */ function getMultipleModelsOverHttpChunked(input) {
-    return _async_to_generator$1s(function() {
+    return _async_to_generator$1t(function() {
         var chunks, i, mergedResults, mergedErrors, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, chunk, _mergedResults, _mergedErrors, batch, err;
-        return _ts_generator$1s(this, function(_state) {
+        return _ts_generator$1t(this, function(_state) {
             switch(_state.label){
                 case 0:
                     if (input.keys.length === 0) {
@@ -1154,9 +1156,9 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
     })();
 }
 function requestJson(input) {
-    return _async_to_generator$1s(function() {
+    return _async_to_generator$1t(function() {
         var hasJsonBody, init, res, _ref, ok, body, fallbackMessage;
-        return _ts_generator$1s(this, function(_state) {
+        return _ts_generator$1t(this, function(_state) {
             switch(_state.label){
                 case 0:
                     hasJsonBody = input.jsonBody !== undefined;
@@ -1199,9 +1201,9 @@ function requestJson(input) {
     })();
 }
 function readJsonResponse(res) {
-    return _async_to_generator$1s(function() {
+    return _async_to_generator$1t(function() {
         var text, body;
-        return _ts_generator$1s(this, function(_state) {
+        return _ts_generator$1t(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -1268,7 +1270,7 @@ function _define_property$$(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$w(left, right) {
+function _instanceof$x(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -1349,7 +1351,7 @@ function _object_spread_props$G(target, source) {
     var driverIdentifier = (_input_firestoreContext1 = input.firestoreContext) === null || _input_firestoreContext1 === void 0 ? void 0 : (_input_firestoreContext_drivers = _input_firestoreContext1.drivers) === null || _input_firestoreContext_drivers === void 0 ? void 0 : _input_firestoreContext_drivers.firestoreDriverIdentifier;
     var firestoreDriverIdentifier = typeof driverIdentifier === 'string' ? driverIdentifier : undefined;
     var firestorePresent = firestore != null;
-    var firestoreIsSdkInstance = _instanceof$w(firestore, Firestore);
+    var firestoreIsSdkInstance = _instanceof$x(firestore, Firestore);
     var firestoreConstructor = firestoreConstructorName(firestore);
     var modules = resolveCliFirestoreSdkModules();
     var sdkDuplicated = modules.sdkFromDbxCli.packageDir != null && modules.sdkFromDbxFirebase.packageDir != null && modules.sdkFromDbxCli.packageDir !== modules.sdkFromDbxFirebase.packageDir;
@@ -1429,7 +1431,7 @@ function _object_spread_props$G(target, source) {
  */ function cliFirestoreWiringError(input) {
     var error = input.error, operation = input.operation, modelType = input.modelType, collectionName = input.collectionName, parentKey = input.parentKey, firestoreContext = input.firestoreContext;
     var result;
-    if (_instanceof$w(error, CliError)) {
+    if (_instanceof$x(error, CliError)) {
         result = error;
     } else {
         var _cliFirestoreSdkIdentitySuggestion, _report_firestoreDriverIdentifier, _report_sdkFromDbxCli_version, _report_sdkFromDbxCli_packageDir;
@@ -1443,7 +1445,7 @@ function _object_spread_props$G(target, source) {
         var report = inspectCliFirestoreSdkIdentity({
             firestoreContext: firestoreContext
         });
-        var message = "Could not ".concat(operation, " (").concat(facts.join(', '), "): ").concat(_instanceof$w(error, Error) ? error.message : String(error));
+        var message = "Could not ".concat(operation, " (").concat(facts.join(', '), "): ").concat(_instanceof$x(error, Error) ? error.message : String(error));
         result = new CliError({
             message: message,
             code: report.ok ? FIRESTORE_COLLECTION_UNRESOLVABLE_CODE : FIRESTORE_SDK_INSTANCE_MISMATCH_CODE,
@@ -1480,7 +1482,7 @@ function _object_spread_props$G(target, source) {
         sdkFromDbxFirebase = resolveFirestoreSdkIdentity(createRequire(requireFromDbxCli.resolve('@dereekb/firebase')));
     } catch (e) {
         sdkFromDbxFirebase = {
-            error: _instanceof$w(e, Error) ? e.message : String(e)
+            error: _instanceof$x(e, Error) ? e.message : String(e)
         };
     }
     var firebaseVersion;
@@ -1518,7 +1520,7 @@ function _object_spread_props$G(target, source) {
         });
     } catch (e) {
         result = {
-            error: _instanceof$w(e, Error) ? e.message : String(e)
+            error: _instanceof$x(e, Error) ? e.message : String(e)
         };
     }
     return result;
@@ -1542,7 +1544,7 @@ function _array_like_to_array$1a(arr, len) {
 function _array_without_holes$Y(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$1a(arr);
 }
-function asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1553,16 +1555,16 @@ function asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1r(fn) {
+function _async_to_generator$1s(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -1579,7 +1581,7 @@ function _non_iterable_spread$Y() {
 function _to_consumable_array$Y(arr) {
     return _array_without_holes$Y(arr) || _iterable_to_array$Y(arr) || _unsupported_iterable_to_array$1a(arr) || _non_iterable_spread$Y();
 }
-function _ts_generator$1r(thisArg, body) {
+function _ts_generator$1s(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1728,9 +1730,9 @@ function _unsupported_iterable_to_array$1a(o, minLen) {
  * @returns The session-bound {@link CliFirestoreModels}.
  * @throws {CliError} When the CLI was not configured with a `firestore` binding, or the session cannot be opened.
  */ function requireCliFirestoreModels(context) {
-    return _async_to_generator$1r(function() {
+    return _async_to_generator$1s(function() {
         var getFirestoreModels;
-        return _ts_generator$1r(this, function(_state) {
+        return _ts_generator$1s(this, function(_state) {
             getFirestoreModels = context.getFirestoreModels;
             if (!getFirestoreModels) {
                 throw new CliError({
@@ -1891,7 +1893,7 @@ function tryReadCollectionIdentity(binding, collections, modelType) {
     return result;
 }
 
-function asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1902,22 +1904,22 @@ function asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1q(fn) {
+function _async_to_generator$1r(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1q(thisArg, body) {
+function _ts_generator$1r(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2037,9 +2039,9 @@ function _type_of$6(obj) {
  * @returns The parsed {@link CliFirestoreSession}.
  * @throws {CliError} When the endpoint answers non-2xx or returns an unusable body.
  */ function fetchFirestoreSession(input) {
-    return _async_to_generator$1q(function() {
+    return _async_to_generator$1r(function() {
         var url, res, text, body, session;
-        return _ts_generator$1q(this, function(_state) {
+        return _ts_generator$1r(this, function(_state) {
             switch(_state.label){
                 case 0:
                     url = "".concat(trimSlash(input.apiBaseUrl)).concat(FIRESTORE_SESSION_API_PATH);
@@ -2176,7 +2178,12 @@ function _object_spread_props$F(target, source) {
 /**
  * The default redirect URI used by the CLI.
  *
- * Opens up to nothing in the browser so the user can copy/paste the resulting token url back into the CLI.
+ * The `0` port is a placeholder, not a bindable port: the redirect resolves to nothing in the
+ * browser and the user copy/pastes the resulting URL back into the CLI.
+ *
+ * To have `auth login` capture the redirect automatically instead, configure a redirect URI with a
+ * concrete loopback port (e.g. `http://127.0.0.1:8976/callback`) and register that exact URI with
+ * the OAuth client — `auth login` binds it and reads the code straight out of the browser redirect.
  */ var DEFAULT_CLI_REDIRECT_URI = 'http://127.0.0.1:0/callback';
 /**
  * The generic OIDC scopes a `--service-token` login adds to the requested set.
@@ -2264,15 +2271,16 @@ function _object_spread_props$F(target, source) {
     var d = input.defaultEnv;
     var result;
     if (e || d) {
-        var _ref, _nonEmpty, _ref1, _nonEmpty1, _nonEmpty2, _nonEmpty3, _nonEmpty4, _nonEmpty5, _nonEmpty6;
+        var _ref, _nonEmpty, _ref1, _nonEmpty1, _nonEmpty2, _nonEmpty3, _nonEmpty4, _nonEmpty5, _nonEmpty6, _nonEmpty7;
         result = {
             apiBaseUrl: (_ref = (_nonEmpty = nonEmpty(e === null || e === void 0 ? void 0 : e.apiBaseUrl)) !== null && _nonEmpty !== void 0 ? _nonEmpty : nonEmpty(d === null || d === void 0 ? void 0 : d.apiBaseUrl)) !== null && _ref !== void 0 ? _ref : '',
             oidcIssuer: (_ref1 = (_nonEmpty1 = nonEmpty(e === null || e === void 0 ? void 0 : e.oidcIssuer)) !== null && _nonEmpty1 !== void 0 ? _nonEmpty1 : nonEmpty(d === null || d === void 0 ? void 0 : d.oidcIssuer)) !== null && _ref1 !== void 0 ? _ref1 : '',
             appClientUrl: (_nonEmpty2 = nonEmpty(e === null || e === void 0 ? void 0 : e.appClientUrl)) !== null && _nonEmpty2 !== void 0 ? _nonEmpty2 : nonEmpty(d === null || d === void 0 ? void 0 : d.appClientUrl),
             clientId: (_nonEmpty3 = nonEmpty(e === null || e === void 0 ? void 0 : e.clientId)) !== null && _nonEmpty3 !== void 0 ? _nonEmpty3 : nonEmpty(d === null || d === void 0 ? void 0 : d.clientId),
             clientSecret: (_nonEmpty4 = nonEmpty(e === null || e === void 0 ? void 0 : e.clientSecret)) !== null && _nonEmpty4 !== void 0 ? _nonEmpty4 : nonEmpty(d === null || d === void 0 ? void 0 : d.clientSecret),
-            redirectUri: (_nonEmpty5 = nonEmpty(e === null || e === void 0 ? void 0 : e.redirectUri)) !== null && _nonEmpty5 !== void 0 ? _nonEmpty5 : nonEmpty(d === null || d === void 0 ? void 0 : d.redirectUri),
-            scopes: (_nonEmpty6 = nonEmpty(e === null || e === void 0 ? void 0 : e.scopes)) !== null && _nonEmpty6 !== void 0 ? _nonEmpty6 : nonEmpty(d === null || d === void 0 ? void 0 : d.scopes),
+            tokenEndpointAuthMethod: (_nonEmpty5 = nonEmpty(e === null || e === void 0 ? void 0 : e.tokenEndpointAuthMethod)) !== null && _nonEmpty5 !== void 0 ? _nonEmpty5 : nonEmpty(d === null || d === void 0 ? void 0 : d.tokenEndpointAuthMethod),
+            redirectUri: (_nonEmpty6 = nonEmpty(e === null || e === void 0 ? void 0 : e.redirectUri)) !== null && _nonEmpty6 !== void 0 ? _nonEmpty6 : nonEmpty(d === null || d === void 0 ? void 0 : d.redirectUri),
+            scopes: (_nonEmpty7 = nonEmpty(e === null || e === void 0 ? void 0 : e.scopes)) !== null && _nonEmpty7 !== void 0 ? _nonEmpty7 : nonEmpty(d === null || d === void 0 ? void 0 : d.scopes),
             firebase: mergeCliFirebaseConfig(e === null || e === void 0 ? void 0 : e.firebase, d === null || d === void 0 ? void 0 : d.firebase)
         };
     }
@@ -2418,10 +2426,15 @@ function parsePort(value) {
 /**
  * Returns true when the env has the minimum fields needed to attempt an OAuth login or token refresh.
  *
+ * `clientSecret` is NOT among them. A CLI is a public client in the usual case
+ * (`token_endpoint_auth_method: 'none'`), authenticating with PKCE rather than a secret, so requiring
+ * one here would report a correctly-configured public env as incomplete — and send the caller back to
+ * `auth setup` to supply a credential the provider would then reject.
+ *
  * @param env - The env config to check.
- * @returns `true` when `apiBaseUrl`, `oidcIssuer`, `clientId`, `clientSecret`, and `redirectUri` are all present and non-empty.
+ * @returns `true` when `apiBaseUrl`, `oidcIssuer`, `clientId`, and `redirectUri` are all present and non-empty.
  */ function isCliEnvConfigComplete(env) {
-    return Boolean((env === null || env === void 0 ? void 0 : env.apiBaseUrl) && (env === null || env === void 0 ? void 0 : env.oidcIssuer) && (env === null || env === void 0 ? void 0 : env.clientId) && (env === null || env === void 0 ? void 0 : env.clientSecret) && (env === null || env === void 0 ? void 0 : env.redirectUri));
+    return Boolean((env === null || env === void 0 ? void 0 : env.apiBaseUrl) && (env === null || env === void 0 ? void 0 : env.oidcIssuer) && (env === null || env === void 0 ? void 0 : env.clientId) && (env === null || env === void 0 ? void 0 : env.redirectUri));
 }
 /**
  * Reads an OAuth token entry from environment variables, for non-interactive server consumption.
@@ -2519,7 +2532,7 @@ function parsePort(value) {
     }).hasExpired();
 }
 
-function asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2530,16 +2543,16 @@ function asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1p(fn) {
+function _async_to_generator$1q(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -2556,7 +2569,7 @@ function _define_property$Z(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$v(left, right) {
+function _instanceof$w(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -2595,7 +2608,7 @@ function _object_spread_props$E(target, source) {
     }
     return target;
 }
-function _ts_generator$1p(thisArg, body) {
+function _ts_generator$1q(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2736,9 +2749,9 @@ function _ts_generator$1p(thisArg, body) {
  * @returns The live {@link CliFirestoreSessionContext}.
  * @throws {CliError} When the env lacks Firebase client config, or any step of the handshake fails.
  */ function createCliFirestoreSessionContext(input) {
-    return _async_to_generator$1p(function() {
+    return _async_to_generator$1q(function() {
         var _ref, _getApps_find, _firebase_emulators, _firebase_emulators1, _firebase_emulators2, cliName, envName, env, accessToken, fetcher, sessionCache, _input_refreshSession, refreshSession, firebase, cached, _tmp, liveCached, fromCache, session, _tmp1, appName, app, useEmulators, appCheckToken, expireTimeMillis, emulatorHost, auth, firestore, e;
-        return _ts_generator$1p(this, function(_state) {
+        return _ts_generator$1q(this, function(_state) {
             switch(_state.label){
                 case 0:
                     cliName = input.cliName, envName = input.envName, env = input.env, accessToken = input.accessToken, fetcher = input.fetcher, sessionCache = input.sessionCache, _input_refreshSession = input.refreshSession, refreshSession = _input_refreshSession === void 0 ? false : _input_refreshSession;
@@ -2831,8 +2844,8 @@ function _ts_generator$1p(thisArg, body) {
                         initializeAppCheck(app, {
                             provider: new CustomProvider({
                                 getToken: function getToken() {
-                                    return _async_to_generator$1p(function() {
-                                        return _ts_generator$1p(this, function(_state) {
+                                    return _async_to_generator$1q(function() {
+                                        return _ts_generator$1q(this, function(_state) {
                                             return [
                                                 2,
                                                 {
@@ -2897,7 +2910,7 @@ function _ts_generator$1p(thisArg, body) {
                     ];
                 case 13:
                     throw new CliError({
-                        message: "Failed to sign in with the minted custom token: ".concat(_instanceof$v(e, Error) ? e.message : String(e)),
+                        message: "Failed to sign in with the minted custom token: ".concat(_instanceof$w(e, Error) ? e.message : String(e)),
                         code: 'AUTH_UNAUTHORIZED',
                         suggestion: 'Verify the env `firebase.projectId`/`firebase.apiKey` match the project the API mints tokens for.'
                     });
@@ -2934,8 +2947,8 @@ function _ts_generator$1p(thisArg, body) {
  *
  * @param session - The session context to close.
  */ function closeCliFirestoreSessionContext(session) {
-    return _async_to_generator$1p(function() {
-        return _ts_generator$1p(this, function(_state) {
+    return _async_to_generator$1q(function() {
+        return _ts_generator$1q(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -2956,8 +2969,8 @@ function _ts_generator$1p(thisArg, body) {
  *
  * @param app - The app to delete.
  */ function closeCliFirebaseApp(app) {
-    return _async_to_generator$1p(function() {
-        return _ts_generator$1p(this, function(_state) {
+    return _async_to_generator$1q(function() {
+        return _ts_generator$1q(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -3015,9 +3028,9 @@ function _ts_generator$1p(thisArg, body) {
  *   consumers in the same process are left alone.
  * @returns Resolves once every matching app has been deleted.
  */ function closeAllCliFirebaseApps(input) {
-    return _async_to_generator$1p(function() {
+    return _async_to_generator$1q(function() {
         var prefix, apps;
-        return _ts_generator$1p(this, function(_state) {
+        return _ts_generator$1q(this, function(_state) {
             switch(_state.label){
                 case 0:
                     // every env this process opened a session for, which is normally exactly one
@@ -3090,7 +3103,7 @@ function _ts_generator$1p(thisArg, body) {
     };
 }
 
-function asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3101,22 +3114,22 @@ function asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1o(fn) {
+function _async_to_generator$1p(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1o(thisArg, body) {
+function _ts_generator$1p(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3228,9 +3241,9 @@ function _ts_generator$1o(thisArg, body) {
  * @returns The opened (and memoized) direct-Firestore session.
  * @throws {CliError} When the context does not support direct-Firestore sessions.
  */ function requireCliFirestoreSession(context) {
-    return _async_to_generator$1o(function() {
+    return _async_to_generator$1p(function() {
         var getFirestoreSession;
-        return _ts_generator$1o(this, function(_state) {
+        return _ts_generator$1p(this, function(_state) {
             getFirestoreSession = context.getFirestoreSession;
             if (!getFirestoreSession) {
                 throw new CliError({
@@ -3257,8 +3270,8 @@ function _ts_generator$1o(thisArg, body) {
  * @returns The client `FirestoreContext` an app's collections factory consumes.
  * @throws {CliError} When the context does not support direct-Firestore sessions.
  */ function requireCliFirestoreContext(context) {
-    return _async_to_generator$1o(function() {
-        return _ts_generator$1o(this, function(_state) {
+    return _async_to_generator$1p(function() {
+        return _ts_generator$1p(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -3355,9 +3368,9 @@ var getCliContext = _cliContextSlot.get;
         return getFirestoreModelsForBinding(firestore);
     };
     function closeFirestoreSession() {
-        return _async_to_generator$1o(function() {
+        return _async_to_generator$1p(function() {
             var opened, session;
-            return _ts_generator$1o(this, function(_state) {
+            return _ts_generator$1p(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         opened = firestoreSession;
@@ -3436,7 +3449,7 @@ var getCliContext = _cliContextSlot.get;
     };
 }
 
-function asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3447,22 +3460,22 @@ function asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1n(fn) {
+function _async_to_generator$1o(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1n(thisArg, body) {
+function _ts_generator$1o(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3575,9 +3588,9 @@ function _ts_generator$1n(thisArg, body) {
  */ function wrapCommandHandler(handler) {
     var exitCode = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : CLI_EXIT_CODE_HANDLER;
     return function(argv) {
-        return _async_to_generator$1n(function() {
+        return _async_to_generator$1o(function() {
             var e;
-            return _ts_generator$1n(this, function(_state) {
+            return _ts_generator$1o(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         _state.trys.push([
@@ -3638,7 +3651,7 @@ function _ts_generator$1n(thisArg, body) {
     };
 }
 
-function asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3649,22 +3662,22 @@ function asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1m(fn) {
+function _async_to_generator$1n(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1m(thisArg, body) {
+function _ts_generator$1n(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3784,9 +3797,9 @@ function _ts_generator$1m(thisArg, body) {
             return spec.helpEpilogue ? built.epilogue(spec.helpEpilogue) : built;
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1m(function() {
+            return _async_to_generator$1n(function() {
                 var context, result;
-                return _ts_generator$1m(this, function(_state) {
+                return _ts_generator$1n(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             context = requireCliContext();
@@ -4010,7 +4023,7 @@ function _array_with_holes$o(arr) {
 function _array_without_holes$X(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$18(arr);
 }
-function asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4021,16 +4034,16 @@ function asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1l(fn) {
+function _async_to_generator$1m(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -4121,7 +4134,7 @@ function _sliced_to_array$o(arr, i) {
 function _to_consumable_array$X(arr) {
     return _array_without_holes$X(arr) || _iterable_to_array$X(arr) || _unsupported_iterable_to_array$18(arr) || _non_iterable_spread$X();
 }
-function _ts_generator$1l(thisArg, body) {
+function _ts_generator$1m(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4253,9 +4266,9 @@ function _defaultBuildRequestData(params, state, limit) {
     return base;
 }
 function _runItemTasks(input) {
-    return _async_to_generator$1l(function() {
+    return _async_to_generator$1m(function() {
         var context, items, keys, pageIndex, iterateItem, itemPerformTasksConfig, maxParallelPerPage, indexed, taskConfig, performResult;
-        return _ts_generator$1l(this, function(_state) {
+        return _ts_generator$1m(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, items = input.items, keys = input.keys, pageIndex = input.pageIndex, iterateItem = input.iterateItem, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -4300,9 +4313,9 @@ function _runItemTasks(input) {
     })();
 }
 function _processPage(input) {
-    return _async_to_generator$1l(function() {
+    return _async_to_generator$1m(function() {
         var context, raw, pageIndex, responseAdapter, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, items, keys, nextCursorDocumentKey, hasMore, itemResults, _tmp, pageResult, _tmp1, output;
-        return _ts_generator$1l(this, function(_state) {
+        return _ts_generator$1m(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, raw = input.raw, pageIndex = input.pageIndex, responseAdapter = input.responseAdapter, iterateItem = input.iterateItem, iteratePage = input.iteratePage, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -4442,9 +4455,9 @@ function _evaluateLoopExit(input) {
  * });
  * ```
  */ function iterateDbxCliCallModel(config) {
-    return _async_to_generator$1l(function() {
+    return _async_to_generator$1m(function() {
         var context, modelType, call, specifier, params, _config_buildRequestData, buildRequestData, _config_responseAdapter, responseAdapter, limitPerPage, totalItemsLimit, maxPages, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, _config_collectItems, collectItems, _config_collectItemResults, collectItemResults, _config_collectPageResults, collectPageResults, allItems, allItemResults, allPageResults, pageIndex, totalItems, cursorDocumentKey, hitLimit, keepGoing, collectItemsForPage, collectItemResultsForPage, collectPageResultsForPage, effectiveLimit, data, raw, pageOutcome, _allItems, _allItemResults, exit, result;
-        return _ts_generator$1l(this, function(_state) {
+        return _ts_generator$1m(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = config.context, modelType = config.modelType, call = config.call, specifier = config.specifier, params = config.params, _config_buildRequestData = config.buildRequestData, buildRequestData = _config_buildRequestData === void 0 ? _defaultBuildRequestData : _config_buildRequestData, _config_responseAdapter = config.responseAdapter, responseAdapter = _config_responseAdapter === void 0 ? _defaultResponseAdapter : _config_responseAdapter, limitPerPage = config.limitPerPage, totalItemsLimit = config.totalItemsLimit, maxPages = config.maxPages, iterateItem = config.iterateItem, iteratePage = config.iteratePage, itemPerformTasksConfig = config.itemPerformTasksConfig, maxParallelPerPage = config.maxParallelPerPage, _config_collectItems = config.collectItems, collectItems = _config_collectItems === void 0 ? true : _config_collectItems, _config_collectItemResults = config.collectItemResults, collectItemResults = _config_collectItemResults === void 0 ? iterateItem != null : _config_collectItemResults, _config_collectPageResults = config.collectPageResults, collectPageResults = _config_collectPageResults === void 0 ? iteratePage != null : _config_collectPageResults;
@@ -4545,7 +4558,7 @@ function _evaluateLoopExit(input) {
     })();
 }
 
-function asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4556,16 +4569,16 @@ function asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1k(fn) {
+function _async_to_generator$1l(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -4615,7 +4628,7 @@ function _object_spread_props$C(target, source) {
     }
     return target;
 }
-function _ts_generator$1k(thisArg, body) {
+function _ts_generator$1l(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4731,9 +4744,9 @@ function _ts_generator$1k(thisArg, body) {
             return spec.builder ? spec.builder(yargs) : yargs;
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1k(function() {
+            return _async_to_generator$1l(function() {
                 var context, data, params, result;
-                return _ts_generator$1k(this, function(_state) {
+                return _ts_generator$1l(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             context = requireCliContext();
@@ -4918,7 +4931,7 @@ function AsyncFromSyncIterator$4(s) {
         }
     }, new AsyncFromSyncIterator$4(s);
 }
-function asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4929,22 +4942,22 @@ function asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1j(fn) {
+function _async_to_generator$1k(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1j(thisArg, body) {
+function _ts_generator$1k(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5107,9 +5120,9 @@ function _ts_generator$1j(thisArg, body) {
  * @returns The UTF-8 decoded stdin contents.
  * @throws {CliError} When stdin is a TTY, with `code: 'STDIN_NOT_PIPED'`.
  */ function readAllStdin() {
-    return _async_to_generator$1j(function() {
+    return _async_to_generator$1k(function() {
         var chunks, _iteratorAbruptCompletion, _didIteratorError, _iteratorError, _iterator, _step, _value, chunk, err;
-        return _ts_generator$1j(this, function(_state) {
+        return _ts_generator$1k(this, function(_state) {
             switch(_state.label){
                 case 0:
                     if (process.stdin.isTTY) {
@@ -5213,9 +5226,9 @@ function _ts_generator$1j(thisArg, body) {
  *
  * @returns The tokens parsed from stdin.
  */ function readStdinTokens() {
-    return _async_to_generator$1j(function() {
+    return _async_to_generator$1k(function() {
         var raw;
-        return _ts_generator$1j(this, function(_state) {
+        return _ts_generator$1k(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -5235,7 +5248,7 @@ function _ts_generator$1j(thisArg, body) {
     })();
 }
 
-function asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -5246,16 +5259,16 @@ function asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1i(fn) {
+function _async_to_generator$1j(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -5272,7 +5285,7 @@ function _define_property$W(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$u(left, right) {
+function _instanceof$v(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -5311,7 +5324,7 @@ function _object_spread_props$B(target, source) {
     }
     return target;
 }
-function _ts_generator$1i(thisArg, body) {
+function _ts_generator$1j(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5422,9 +5435,9 @@ function _ts_generator$1i(thisArg, body) {
         return withCallModelArgs(yargs);
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$1i(function() {
+        return _async_to_generator$1j(function() {
             var context, data, rawData, _tmp, params, result;
-            return _ts_generator$1i(this, function(_state) {
+            return _ts_generator$1j(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -5459,7 +5472,7 @@ function _ts_generator$1i(thisArg, body) {
                                 data = JSON.parse(rawData);
                             } catch (e) {
                                 throw new CliError({
-                                    message: "--data must be valid JSON: ".concat(_instanceof$u(e, Error) ? e.message : String(e)),
+                                    message: "--data must be valid JSON: ".concat(_instanceof$v(e, Error) ? e.message : String(e)),
                                     code: 'INVALID_DATA_JSON'
                                 });
                             }
@@ -5496,7 +5509,7 @@ function _array_like_to_array$17(arr, len) {
 function _array_with_holes$n(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _instanceof$t(left, right) {
+function _instanceof$u(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -5684,7 +5697,7 @@ function isPlainObject(value) {
     var result;
     if (value === null || (typeof value === "undefined" ? "undefined" : _type_of$5(value)) !== 'object') {
         result = false;
-    } else if (Array.isArray(value) || _instanceof$t(value, Date)) {
+    } else if (Array.isArray(value) || _instanceof$u(value, Date)) {
         result = false;
     } else {
         // Objects from JSON.parse have Object.prototype as their proto. Anything
@@ -6142,7 +6155,7 @@ function _array_with_holes$l(arr) {
 function _array_without_holes$U(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$14(arr);
 }
-function asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -6153,16 +6166,16 @@ function asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1h(fn) {
+function _async_to_generator$1i(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -6179,7 +6192,7 @@ function _define_property$V(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$s(left, right) {
+function _instanceof$t(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -6241,7 +6254,7 @@ function _sliced_to_array$l(arr, i) {
 function _to_consumable_array$U(arr) {
     return _array_without_holes$U(arr) || _iterable_to_array$U(arr) || _unsupported_iterable_to_array$14(arr) || _non_iterable_spread$U();
 }
-function _ts_generator$1h(thisArg, body) {
+function _ts_generator$1i(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -6443,9 +6456,9 @@ function _unsupported_iterable_to_array$14(o, minLen) {
  * @returns The resolved source, carrying the opened models view when it is `firestore`.
  * @throws {CliError} `MODEL_IS_SERVER_ONLY` for a server-only model, or the session's own error when `--via firestore` was demanded and the session could not open.
  */ function resolveCliReadSource(input) {
-    return _async_to_generator$1h(function() {
+    return _async_to_generator$1i(function() {
         var context, via, modelType, result, _tmp;
-        return _ts_generator$1h(this, function(_state) {
+        return _ts_generator$1i(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, via = input.via, modelType = input.modelType;
@@ -6542,9 +6555,9 @@ function _unsupported_iterable_to_array$14(o, minLen) {
  * @param via - The requested via, carried onto the result.
  * @returns The resolved source.
  */ function resolveAutoReadSource(context, via) {
-    return _async_to_generator$1h(function() {
+    return _async_to_generator$1i(function() {
         var result, _tmp, e, code, message;
-        return _ts_generator$1h(this, function(_state) {
+        return _ts_generator$1i(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -6570,8 +6583,8 @@ function _unsupported_iterable_to_array$14(o, minLen) {
                     ];
                 case 2:
                     e = _state.sent();
-                    code = _instanceof$s(e, CliError) ? e.code : undefined;
-                    message = _instanceof$s(e, Error) ? e.message : String(e);
+                    code = _instanceof$t(e, CliError) ? e.code : undefined;
+                    message = _instanceof$t(e, Error) ? e.message : String(e);
                     if (code != null && CAPABILITY_FAILURE_CODES.has(code)) {
                         verboseLog("read: --via auto → api (direct-Firestore session unavailable: ".concat(code, " ").concat(message, ")"));
                         result = {
@@ -6597,9 +6610,9 @@ function _unsupported_iterable_to_array$14(o, minLen) {
     })();
 }
 function requireModels(context) {
-    return _async_to_generator$1h(function() {
+    return _async_to_generator$1i(function() {
         var getFirestoreModels;
-        return _ts_generator$1h(this, function(_state) {
+        return _ts_generator$1i(this, function(_state) {
             getFirestoreModels = context.getFirestoreModels;
             if (getFirestoreModels == null) {
                 throw new CliError({
@@ -6647,9 +6660,9 @@ function requireModels(context) {
  * @returns `{ key, data }`, with `data: null` when the document does not exist.
  * @throws {CliError} When the key does not match the model's path shape.
  */ function getModelOverFirestore(input) {
-    return _async_to_generator$1h(function() {
+    return _async_to_generator$1i(function() {
         var models, modelType, key, service, data, _ref, e;
-        return _ts_generator$1h(this, function(_state) {
+        return _ts_generator$1i(this, function(_state) {
             switch(_state.label){
                 case 0:
                     models = input.models, modelType = input.modelType, key = input.key;
@@ -6708,9 +6721,9 @@ function requireModels(context) {
  * @returns `{ results, errors }`, key order preserved within each partition.
  * @throws {CliError} `INVALID_ARGUMENT` when `modelType` is not a registered model.
  */ function getMultipleModelsOverFirestore(input) {
-    return _async_to_generator$1h(function() {
+    return _async_to_generator$1i(function() {
         var models, modelType, keys, service, taskResult;
-        return _ts_generator$1h(this, function(_state) {
+        return _ts_generator$1i(this, function(_state) {
             switch(_state.label){
                 case 0:
                     models = input.models, modelType = input.modelType, keys = input.keys;
@@ -6722,8 +6735,8 @@ function requireModels(context) {
                         4,
                         performAsyncTasks(_to_consumable_array$U(keys), function(key) {
                             var _ref;
-                            return _async_to_generator$1h(function() {
-                                return _ts_generator$1h(this, function(_state) {
+                            return _async_to_generator$1i(function() {
+                                return _ts_generator$1i(this, function(_state) {
                                     switch(_state.label){
                                         case 0:
                                             return [
@@ -6785,7 +6798,7 @@ function requireModels(context) {
     return _object_spread$U({
         key: key,
         error: mapped.message
-    }, _instanceof$s(mapped, CliError) ? {
+    }, _instanceof$t(mapped, CliError) ? {
         code: mapped.code
     } : {});
 }
@@ -6802,19 +6815,19 @@ function requireModels(context) {
  * @returns A `CliError` for a key-shape mismatch, otherwise the original error.
  */ function asKeyShapeError(error, modelType, key) {
     var result;
-    if (_instanceof$s(error, Error) && /unexpected key\/path/i.test(error.message)) {
+    if (_instanceof$t(error, Error) && /unexpected key\/path/i.test(error.message)) {
         result = new CliError({
             message: 'Key "'.concat(key, '" does not match the path shape for model "').concat(modelType, '": ').concat(error.message),
             code: 'INVALID_ARGUMENT',
             suggestion: 'Nested models need their full parent path, e.g. "gb/<guestbookId>/gbe/<entryId>".'
         });
     } else {
-        result = _instanceof$s(error, Error) ? error : new Error(String(error));
+        result = _instanceof$t(error, Error) ? error : new Error(String(error));
     }
     return result;
 }
 
-function asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -6825,22 +6838,22 @@ function asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1g(fn) {
+function _async_to_generator$1h(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1g(thisArg, body) {
+function _ts_generator$1h(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -6993,9 +7006,9 @@ function _ts_generator$1g(thisArg, body) {
         }));
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$1g(function() {
+        return _async_to_generator$1h(function() {
             var context, _parseGetArgs, modelType, key, resolved, result, _tmp;
-            return _ts_generator$1g(this, function(_state) {
+            return _ts_generator$1h(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -7052,7 +7065,7 @@ function _ts_generator$1g(thisArg, body) {
     })
 };
 
-function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7063,22 +7076,22 @@ function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1f(fn) {
+function _async_to_generator$1g(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1f(thisArg, body) {
+function _ts_generator$1g(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7214,9 +7227,9 @@ function _ts_generator$1f(thisArg, body) {
         }).epilogue(CLI_READ_VIA_EPILOGUE);
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$1f(function() {
+        return _async_to_generator$1g(function() {
             var context, firstArg, rest, resolvedFirst, resolvedRest, stdinKeys, _parseGetManyArgs, modelType, keys, resolved, result, _tmp;
-            return _ts_generator$1f(this, function(_state) {
+            return _ts_generator$1g(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -7291,7 +7304,7 @@ function _ts_generator$1f(thisArg, body) {
     })
 };
 
-function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7302,16 +7315,16 @@ function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1e(fn) {
+function _async_to_generator$1f(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -7343,7 +7356,7 @@ function _object_spread$T(target) {
     }
     return target;
 }
-function _ts_generator$1e(thisArg, body) {
+function _ts_generator$1f(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7502,9 +7515,9 @@ function _ts_generator$1e(thisArg, body) {
  * @param input.updates - The partial {@link CliConfig} to merge on top of the existing on-disk config.
  * @returns The merged {@link CliConfig} that was just written.
  */ function mergeCliConfig(input) {
-    return _async_to_generator$1e(function() {
+    return _async_to_generator$1f(function() {
         var _ref, _input_updates_activeEnv, existing, merged;
-        return _ts_generator$1e(this, function(_state) {
+        return _ts_generator$1f(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -7629,7 +7642,7 @@ function mergeOutputCommandsConfig(existing, updates) {
     return result;
 }
 
-function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7640,22 +7653,22 @@ function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1d(fn) {
+function _async_to_generator$1e(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1d(thisArg, body) {
+function _ts_generator$1e(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7782,9 +7795,9 @@ function _ts_generator$1d(thisArg, body) {
  * @param input - Resolution inputs.
  * @returns The resolved env triple.
  */ function resolveCliEnv(input) {
-    return _async_to_generator$1d(function() {
+    return _async_to_generator$1e(function() {
         var _ref, _input_envVarName, _ref1, _input_flagEnv, _config_envs, _findCliEnvDefault, config, envVarName, envName, stored, defaultEnv, merged, env;
-        return _ts_generator$1d(this, function(_state) {
+        return _ts_generator$1e(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -7823,9 +7836,9 @@ function _ts_generator$1d(thisArg, body) {
     })();
 }
 function resolveCliEnvOrThrow(input) {
-    return _async_to_generator$1d(function() {
+    return _async_to_generator$1e(function() {
         var _ref, config, envName, env;
-        return _ts_generator$1d(this, function(_state) {
+        return _ts_generator$1e(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -7924,7 +7937,7 @@ function resolveCliEnvOrThrow(input) {
     }).hasExpired();
 }
 
-function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7935,16 +7948,16 @@ function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1c(fn) {
+function _async_to_generator$1d(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -7961,7 +7974,7 @@ function _define_property$T(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$r(left, right) {
+function _instanceof$s(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -8000,7 +8013,7 @@ function _object_spread_props$A(target, source) {
     }
     return target;
 }
-function _ts_generator$1c(thisArg, body) {
+function _ts_generator$1d(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -8155,7 +8168,7 @@ var cliOidcFetch = function cliOidcFetch(input, init) {
  * @returns A {@link CliError} for relying-party errors, otherwise the original value.
  */ function oidcRelyingPartyErrorToCliError(error) {
     var result = error;
-    if (_instanceof$r(error, OidcRelyingPartyError)) {
+    if (_instanceof$s(error, OidcRelyingPartyError)) {
         var mapped = OIDC_ERROR_CODE_MAP[error.code];
         result = new CliError(_object_spread$S({
             message: error.message,
@@ -8167,9 +8180,9 @@ var cliOidcFetch = function cliOidcFetch(input, init) {
     return result;
 }
 function withCliErrors(fn) {
-    return _async_to_generator$1c(function() {
+    return _async_to_generator$1d(function() {
         var e;
-        return _ts_generator$1c(this, function(_state) {
+        return _ts_generator$1d(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -8360,6 +8373,450 @@ function _object_spread_props$z(target, source) {
     }
 }
 
+function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
+}
+function _async_to_generator$1c(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _instanceof$r(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else return left instanceof right;
+}
+function _ts_generator$1c(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Hostnames RFC 8252 §7.3 treats as the loopback interface, and the exact set `oidc-provider`
+ * recognizes as a loopback redirect host.
+ *
+ * `[::1]` carries its brackets because that is what `URL.hostname` returns for an IPv6 literal —
+ * the brackets are stripped again before the address is handed to `server.listen`.
+ */ var LOOPBACK_REDIRECT_HOSTNAMES = [
+    '127.0.0.1',
+    'localhost',
+    '[::1]'
+];
+/**
+ * The loopback port the CLI suggests when the configured redirect URI has no bindable port.
+ *
+ * Deliberately outside the 9900-9910 block the Firebase emulators occupy, so a suggested redirect
+ * URI never collides with a running emulator.
+ */ var SUGGESTED_CLI_LOOPBACK_REDIRECT_PORT = 8976;
+/**
+ * Error code raised when the loopback listener cannot bind the redirect URI's port (e.g. the port
+ * is already in use, or is privileged).
+ */ var LOOPBACK_REDIRECT_LISTEN_FAILED_ERROR_CODE = 'AUTH_REDIRECT_LISTEN_FAILED';
+/**
+ * Error code raised when no redirect reached the loopback listener within the allotted time.
+ */ var LOOPBACK_REDIRECT_TIMEOUT_ERROR_CODE = 'AUTH_REDIRECT_TIMEOUT';
+/**
+ * Decomposes a redirect URI into a {@link LoopbackRedirectTarget} when the CLI can bind a local
+ * listener for it.
+ *
+ * A target is only produced for an `http:` loopback URI carrying a concrete, non-zero port. The
+ * conventional `http://127.0.0.1:0/callback` placeholder is deliberately NOT capturable: binding an
+ * ephemeral port would mean sending a `redirect_uri` that differs from the registered one, which
+ * every OAuth provider rejects unless the client is registered as a native app (where loopback
+ * ports are compared port-insensitively).
+ *
+ * @param input - The parse inputs.
+ * @param input.redirectUri - The configured redirect URI.
+ * @param input.port - Optional port override applied to the parsed URI.
+ * @returns The bindable target, or `undefined` when the URI cannot be captured locally.
+ * @__NO_SIDE_EFFECTS__
+ */ function parseLoopbackRedirectUri(input) {
+    var result;
+    if (input.redirectUri) {
+        var parsed;
+        try {
+            parsed = new URL(input.redirectUri);
+        } catch (unused) {
+            // A non-URL redirect (e.g. the `urn:ietf:wg:oauth:2.0:oob` out-of-band URN) is a valid
+            // configuration — it just has nothing to bind.
+            parsed = undefined;
+        }
+        if ((parsed === null || parsed === void 0 ? void 0 : parsed.protocol) === 'http:' && LOOPBACK_REDIRECT_HOSTNAMES.includes(parsed.hostname)) {
+            var _input_port;
+            var port = (_input_port = input.port) !== null && _input_port !== void 0 ? _input_port : Number(parsed.port);
+            if (Number.isInteger(port) && port > 0) {
+                parsed.port = String(port);
+                result = {
+                    redirectUri: parsed.toString(),
+                    hostname: parsed.hostname,
+                    port: port,
+                    pathname: parsed.pathname
+                };
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Renders the single page the browser lands on after the provider redirects back.
+ *
+ * @param input - The page inputs.
+ * @param input.title - The heading + document title.
+ * @param input.message - The body line under the heading.
+ * @returns A self-contained HTML document.
+ * @__NO_SIDE_EFFECTS__
+ */ function renderLoopbackRedirectPage(input) {
+    // Both values are CLI-authored or provider-supplied error text, so they are escaped rather than
+    // interpolated raw — an `error_description` is attacker-influenceable in the general case.
+    var escape = function escape(value) {
+        return value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+    };
+    var title = escape(input.title);
+    var message = escape(input.message);
+    return '<!doctype html><html lang="en"><head><meta charset="utf-8"><title>'.concat(title, "</title><style>body{font-family:system-ui,-apple-system,sans-serif;margin:0;display:flex;min-height:100vh;align-items:center;justify-content:center;background:#101418;color:#e8eaed}main{text-align:center;padding:2rem}h1{font-size:1.25rem;font-weight:600;margin:0 0 .5rem}p{margin:0;opacity:.75}</style></head><body><main><h1>").concat(title, "</h1><p>").concat(message, "</p></main></body></html>");
+}
+/**
+ * Binds a local HTTP listener to a loopback redirect URI so the authorization code can be read
+ * straight out of the browser redirect instead of being pasted back by hand.
+ *
+ * The listener answers exactly one path — the redirect URI's own — and serves a short "you can close
+ * this tab" page. Everything else is answered `404`, which is what keeps the browser's automatic
+ * `/favicon.ico` request from being mistaken for the redirect.
+ *
+ * @param input - The capture inputs.
+ * @param input.target - The bindable target, from {@link parseLoopbackRedirectUri}.
+ * @param input.successMessage - Optional override for the browser success page's body line.
+ * @returns The started {@link LoopbackRedirectCapture}.
+ * @throws {CliError} `AUTH_REDIRECT_LISTEN_FAILED` when the port cannot be bound.
+ */ function startLoopbackRedirectCapture(input) {
+    return _async_to_generator$1c(function() {
+        var target, sockets, resolveRedirect, redirect, handleRequest, hostnames, bindings, servers, close;
+        return _ts_generator$1c(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    target = input.target;
+                    sockets = new Set();
+                    resolveRedirect = noop;
+                    redirect = new Promise(function(resolve) {
+                        resolveRedirect = resolve;
+                    });
+                    handleRequest = function handleRequest(req, res) {
+                        var requestUrl;
+                        try {
+                            var _req_url;
+                            requestUrl = new URL((_req_url = req.url) !== null && _req_url !== void 0 ? _req_url : '/', target.redirectUri);
+                        } catch (unused) {
+                            requestUrl = undefined;
+                        }
+                        if ((requestUrl === null || requestUrl === void 0 ? void 0 : requestUrl.pathname) === target.pathname) {
+                            var _requestUrl_searchParams_get, _input_successMessage;
+                            var error = requestUrl.searchParams.get('error');
+                            var page = error ? renderLoopbackRedirectPage({
+                                title: 'Sign-in failed',
+                                message: (_requestUrl_searchParams_get = requestUrl.searchParams.get('error_description')) !== null && _requestUrl_searchParams_get !== void 0 ? _requestUrl_searchParams_get : error
+                            }) : renderLoopbackRedirectPage({
+                                title: 'Signed in',
+                                message: (_input_successMessage = input.successMessage) !== null && _input_successMessage !== void 0 ? _input_successMessage : 'You can close this tab and return to your terminal.'
+                            });
+                            res.writeHead(error ? 400 : 200, {
+                                'content-type': 'text/html; charset=utf-8',
+                                connection: 'close'
+                            });
+                            res.end(page);
+                            resolveRedirect(requestUrl.toString());
+                        } else {
+                            res.writeHead(404, {
+                                'content-type': 'text/plain; charset=utf-8',
+                                connection: 'close'
+                            });
+                            res.end('Not found.');
+                        }
+                    };
+                    // `localhost` is bound on BOTH loopback families rather than on whatever the resolver happens to
+                    // return first. Node binds a single address, and browsers pick their own — a listener that landed
+                    // only on `::1` refuses the connection whenever the browser reaches for `127.0.0.1`.
+                    // An explicit literal is bound as written; `URL.hostname` brackets an IPv6 literal, and
+                    // `server.listen` wants the bare address.
+                    hostnames = target.hostname === 'localhost' ? [
+                        '::1',
+                        '127.0.0.1'
+                    ] : [
+                        target.hostname.replaceAll(/^\[|\]$/g, '')
+                    ];
+                    return [
+                        4,
+                        Promise.all(hostnames.map(function(hostname) {
+                            return new Promise(function(resolveBinding) {
+                                var server = createServer(handleRequest);
+                                var onListenError = function onListenError(e) {
+                                    resolveBinding(new CliError({
+                                        message: "Could not bind the loopback redirect listener on ".concat(hostname, ":").concat(target.port, " (").concat(e.message, ")."),
+                                        code: LOOPBACK_REDIRECT_LISTEN_FAILED_ERROR_CODE
+                                    }));
+                                };
+                                server.once('error', onListenError);
+                                server.on('connection', function(socket) {
+                                    sockets.add(socket);
+                                    socket.once('close', function() {
+                                        return sockets.delete(socket);
+                                    });
+                                });
+                                server.listen(target.port, hostname, function() {
+                                    server.removeListener('error', onListenError);
+                                    // Past bind, a socket-level error (a browser hanging up mid-response) must not take the
+                                    // CLI down — the flow either already has its code or falls through to the paste prompt.
+                                    server.on('error', noop);
+                                    resolveBinding(server);
+                                });
+                            });
+                        }))
+                    ];
+                case 1:
+                    bindings = _state.sent();
+                    servers = bindings.filter(function(x) {
+                        return !_instanceof$r(x, CliError);
+                    });
+                    if (servers.length === 0) {
+                        // Both families failing is one failure to report; the first is the representative one.
+                        throw bindings[0];
+                    }
+                    close = function close() {
+                        return new Promise(function(resolveClose) {
+                            sockets.forEach(function(socket) {
+                                return socket.destroy();
+                            });
+                            sockets.clear();
+                            void Promise.all(servers.map(function(server) {
+                                return new Promise(function(resolveServer) {
+                                    return server.close(function() {
+                                        return resolveServer();
+                                    });
+                                });
+                            })).then(function() {
+                                return resolveClose();
+                            });
+                        });
+                    };
+                    return [
+                        2,
+                        {
+                            redirectUri: target.redirectUri,
+                            port: target.port,
+                            waitForRedirect: function waitForRedirect(timeoutMs) {
+                                var result;
+                                if (timeoutMs != null && timeoutMs > 0) {
+                                    result = new Promise(function(resolveWait, rejectWait) {
+                                        var // A caller that races this against another source (the paste prompt) abandons the loser
+                                        // mid-flight — a still-ref'd timer would then hold the CLI open for the rest of the
+                                        // timeout after the command was otherwise done.
+                                        _timer_unref;
+                                        var timer = setTimeout(function() {
+                                            rejectWait(new CliError({
+                                                message: "Timed out after ".concat(timeoutMs, "ms waiting for the browser redirect to ").concat(target.redirectUri, "."),
+                                                code: LOOPBACK_REDIRECT_TIMEOUT_ERROR_CODE
+                                            }));
+                                        }, timeoutMs);
+                                        (_timer_unref = timer.unref) === null || _timer_unref === void 0 ? void 0 : _timer_unref.call(timer);
+                                        redirect.then(function(url) {
+                                            clearTimeout(timer);
+                                            resolveWait(url);
+                                        }, rejectWait);
+                                    });
+                                } else {
+                                    result = redirect;
+                                }
+                                return result;
+                            },
+                            close: close
+                        }
+                    ];
+            }
+        });
+    })();
+}
+
+/**
+ * Opens a URL in the user's default browser.
+ *
+ * Shells out to the platform's URL handler (`open` on macOS, `start` on Windows, `xdg-open`
+ * elsewhere) rather than taking a dependency for what is a single spawn. The child is detached with
+ * its stdio ignored, so the browser neither holds the CLI's event loop open nor interleaves output
+ * into the CLI's own stdout/stderr.
+ *
+ * Never throws or rejects: a headless machine with no handler registered is an ordinary outcome, and
+ * the caller falls back to the printed URL.
+ *
+ * @param input - The open inputs.
+ * @param input.url - The URL to open.
+ * @returns `true` when the handler process was spawned, `false` when it could not be.
+ */ function openUrlInBrowser(input) {
+    var url = input.url;
+    var command;
+    var args;
+    var windowsVerbatimArguments = false;
+    switch(process.platform){
+        case 'darwin':
+            command = 'open';
+            args = [
+                url
+            ];
+            break;
+        case 'win32':
+            // `start` is a cmd builtin whose first quoted argument is the window title, hence the empty
+            // `""`. `windowsVerbatimArguments` suppresses Node's own quoting so the `^`-escaped `&`
+            // separating the OAuth query params survives — unescaped, cmd reads it as a command separator
+            // and truncates the authorization URL at the first parameter.
+            command = 'cmd.exe';
+            args = [
+                '/s',
+                '/c',
+                'start',
+                '""',
+                '/b',
+                url.replaceAll('&', '^&')
+            ];
+            windowsVerbatimArguments = true;
+            break;
+        default:
+            command = 'xdg-open';
+            args = [
+                url
+            ];
+            break;
+    }
+    return new Promise(function(resolve) {
+        try {
+            var child = spawn(command, args, {
+                detached: true,
+                stdio: 'ignore',
+                windowsVerbatimArguments: windowsVerbatimArguments
+            });
+            child.once('error', function() {
+                return resolve(false);
+            });
+            child.once('spawn', function() {
+                child.unref();
+                resolve(true);
+            });
+        } catch (unused) {
+            resolve(false);
+        }
+    });
+}
+
 /**
  * Error code thrown by {@link promptLine} when the user cancels a masked prompt with Ctrl-C.
  *
@@ -8377,17 +8834,18 @@ var KEY_DEL = ''; // DEL
  * pasted redirect URL.
  *
  * Rejects with a {@link CliError} (`code: 'PROMPT_CANCELLED'`) when the user presses Ctrl-C
- * during a masked prompt, instead of forcibly terminating the process.
+ * during a masked prompt, or when `signal` aborts, instead of forcibly terminating the process.
  *
  * @param input - The prompt inputs.
  * @param input.question - The prompt text written to stdout (or stderr when masking).
  * @param input.mask - When `true`, characters are echoed as `*` and Ctrl-C cancels the prompt.
+ * @param input.signal - Optional signal that cancels the prompt and releases stdin.
  * @returns The line entered by the user (without the trailing newline).
  */ function promptLine(input) {
     var result;
     if (input.mask) {
         result = new Promise(function(resolve, reject) {
-            var _process_stdin_setRawMode, _process_stdin;
+            var _input_signal, _process_stdin_setRawMode, _process_stdin;
             var stdout = process.stdout;
             stdout.write(input.question);
             var buffer = '';
@@ -8443,6 +8901,20 @@ var KEY_DEL = ''; // DEL
                     }
                 }
             };
+            var onAbort = function onAbort() {
+                var _process_stdin_setRawMode, _process_stdin;
+                stdout.write('\n');
+                process.stdin.removeListener('data', onData);
+                (_process_stdin_setRawMode = (_process_stdin = process.stdin).setRawMode) === null || _process_stdin_setRawMode === void 0 ? void 0 : _process_stdin_setRawMode.call(_process_stdin, false);
+                process.stdin.pause();
+                reject(new CliError({
+                    message: 'Prompt cancelled.',
+                    code: PROMPT_CANCELLED_ERROR_CODE
+                }));
+            };
+            (_input_signal = input.signal) === null || _input_signal === void 0 ? void 0 : _input_signal.addEventListener('abort', onAbort, {
+                once: true
+            });
             (_process_stdin_setRawMode = (_process_stdin = process.stdin).setRawMode) === null || _process_stdin_setRawMode === void 0 ? void 0 : _process_stdin_setRawMode.call(_process_stdin, true);
             process.stdin.resume();
             process.stdin.on('data', onData);
@@ -8453,11 +8925,30 @@ var KEY_DEL = ''; // DEL
             output: process.stdout,
             terminal: false
         });
-        result = new Promise(function(resolve) {
-            rl.question(input.question, function(answer) {
+        result = new Promise(function(resolve, reject) {
+            var signal = input.signal;
+            var onAbort = function onAbort() {
                 rl.close();
-                resolve(answer);
-            });
+                // `rl.close()` detaches the interface but leaves the stream flowing, which keeps the CLI's
+                // event loop alive after the racing source already produced the answer.
+                process.stdin.pause();
+                reject(new CliError({
+                    message: 'Prompt cancelled.',
+                    code: PROMPT_CANCELLED_ERROR_CODE
+                }));
+            };
+            if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
+                onAbort();
+            } else {
+                signal === null || signal === void 0 ? void 0 : signal.addEventListener('abort', onAbort, {
+                    once: true
+                });
+                rl.question(input.question, function(answer) {
+                    signal === null || signal === void 0 ? void 0 : signal.removeEventListener('abort', onAbort);
+                    rl.close();
+                    resolve(answer);
+                });
+            }
         });
     }
     return result;
@@ -8632,6 +9123,13 @@ function _ts_generator$1b(thisArg, body) {
         };
     }
 }
+/**
+ * Default time `auth login` waits for the browser redirect to reach the loopback listener before
+ * falling back to the paste prompt.
+ *
+ * Long enough to cover a first-time sign-in (account picker, password manager, MFA, consent screen),
+ * since the fallback costs the user the whole flow again.
+ */ var DEFAULT_AUTH_LOGIN_LISTEN_FOR = '5m';
 function resolveAuthSetupPrompt(input) {
     return _async_to_generator$1b(function() {
         var argvValue, existingValue, prompt, mask, result, answer;
@@ -8646,19 +9144,33 @@ function resolveAuthSetupPrompt(input) {
                     result = argvValue;
                     return [
                         3,
-                        4
+                        5
                     ];
                 case 1:
-                    if (!existingValue) return [
+                    if (!(argvValue === '')) return [
                         3,
                         2
                     ];
-                    result = existingValue;
+                    // An EXPLICIT empty flag clears the stored value. Distinguished from an absent flag — which is
+                    // `undefined` and falls through to the existing value — because the two mean opposite things:
+                    // `--client-secret ''` is how a confidential client is converted to a public one, and treating
+                    // it as "not supplied" silently keeps the old secret, which the provider then rejects.
+                    result = undefined;
                     return [
                         3,
-                        4
+                        5
                     ];
                 case 2:
+                    if (!existingValue) return [
+                        3,
+                        3
+                    ];
+                    result = existingValue;
+                    return [
+                        3,
+                        5
+                    ];
+                case 3:
                     return [
                         4,
                         promptLine({
@@ -8666,11 +9178,11 @@ function resolveAuthSetupPrompt(input) {
                             mask: mask
                         })
                     ];
-                case 3:
+                case 4:
                     answer = _state.sent().trim();
                     result = answer.length > 0 ? answer : existingValue;
-                    _state.label = 4;
-                case 4:
+                    _state.label = 5;
+                case 5:
                     return [
                         2,
                         result
@@ -8852,7 +9364,15 @@ function resolveAuthSetupPrompt(input) {
                 describe: 'OAuth client ID registered with the target app'
             }).option('client-secret', {
                 type: 'string',
-                describe: 'OAuth client secret'
+                describe: "OAuth client secret; omit for a public (PKCE) client, or pass '' to clear a stored one"
+            }).option('token-endpoint-auth-method', {
+                type: 'string',
+                choices: [
+                    'none',
+                    'client_secret_post',
+                    'client_secret_basic'
+                ],
+                describe: "The OAuth client's registered token_endpoint_auth_method; 'none' marks a public (PKCE) client and skips the client-secret prompt"
             }).option('redirect-uri', {
                 type: 'string',
                 describe: 'OAuth redirect URI registered with the OAuth client'
@@ -8867,7 +9387,7 @@ function resolveAuthSetupPrompt(input) {
         },
         handler: wrapCommandHandler(function(argv) {
             return _async_to_generator$1b(function() {
-                var _ref, _ref1, _argv_env, _ref2, _ref3, _argv_appClientUrl, _ref4, _ref5, _argv_scopes, _config_envs, _findCliEnvDefault, config, envName, stored, defaultEnv, existing, apiBaseUrl, oidcIssuer, appClientUrl, clientId, clientSecret, redirectUri, scopes, nextEnv, merged;
+                var _ref, _ref1, _argv_env, _ref2, _ref3, _argv_appClientUrl, _argv_tokenEndpointAuthMethod, _ref4, _ref5, _argv_scopes, _config_envs, _findCliEnvDefault, config, envName, stored, defaultEnv, existing, apiBaseUrl, oidcIssuer, appClientUrl, clientId, tokenEndpointAuthMethod, publicClient, clientSecret, _tmp, redirectUri, scopes, nextEnv, merged;
                 return _ts_generator$1b(this, function(_state) {
                     switch(_state.label){
                         case 0:
@@ -8926,6 +9446,22 @@ function resolveAuthSetupPrompt(input) {
                             ];
                         case 4:
                             clientId = _state.sent();
+                            tokenEndpointAuthMethod = (_argv_tokenEndpointAuthMethod = argv.tokenEndpointAuthMethod) !== null && _argv_tokenEndpointAuthMethod !== void 0 ? _argv_tokenEndpointAuthMethod : existing === null || existing === void 0 ? void 0 : existing.tokenEndpointAuthMethod;
+                            // A public client has no secret to ask for, so a KNOWN `none` skips the prompt entirely rather
+                            // than asking and accepting an empty answer. Any other value — including an unknown one — keeps
+                            // the prompt, since "no secret configured yet" and "never has a secret" are indistinguishable
+                            // without this field.
+                            publicClient = tokenEndpointAuthMethod === 'none';
+                            if (!publicClient) return [
+                                3,
+                                5
+                            ];
+                            _tmp = undefined;
+                            return [
+                                3,
+                                7
+                            ];
+                        case 5:
                             return [
                                 4,
                                 resolveAuthSetupPrompt({
@@ -8935,8 +9471,11 @@ function resolveAuthSetupPrompt(input) {
                                     mask: true
                                 })
                             ];
-                        case 5:
-                            clientSecret = _state.sent();
+                        case 6:
+                            _tmp = _state.sent();
+                            _state.label = 7;
+                        case 7:
+                            clientSecret = _tmp;
                             return [
                                 4,
                                 resolveAuthSetupPrompt({
@@ -8945,12 +9484,16 @@ function resolveAuthSetupPrompt(input) {
                                     prompt: "Redirect URI [".concat((_ref5 = existing === null || existing === void 0 ? void 0 : existing.redirectUri) !== null && _ref5 !== void 0 ? _ref5 : DEFAULT_CLI_REDIRECT_URI, "]: ")
                                 })
                             ];
-                        case 6:
+                        case 8:
                             redirectUri = (_ref4 = _state.sent()) !== null && _ref4 !== void 0 ? _ref4 : DEFAULT_CLI_REDIRECT_URI;
                             scopes = (_argv_scopes = argv.scopes) !== null && _argv_scopes !== void 0 ? _argv_scopes : existing === null || existing === void 0 ? void 0 : existing.scopes;
-                            if (!apiBaseUrl || !oidcIssuer || !clientId || !clientSecret) {
+                            // `clientSecret` is deliberately NOT required: a CLI is a public client in the usual case
+                            // (`token_endpoint_auth_method: 'none'`), authenticating with PKCE instead of a secret. The
+                            // protocol layer already omits an absent secret from the token request, so requiring one here
+                            // was the only thing making a public client unconfigurable.
+                            if (!apiBaseUrl || !oidcIssuer || !clientId) {
                                 throw new CliError({
-                                    message: 'apiBaseUrl, oidcIssuer, clientId, and clientSecret are all required.',
+                                    message: 'apiBaseUrl, oidcIssuer, and clientId are all required.',
                                     code: 'AUTH_SETUP_INCOMPLETE'
                                 });
                             }
@@ -8958,9 +9501,12 @@ function resolveAuthSetupPrompt(input) {
                                 apiBaseUrl: apiBaseUrl,
                                 oidcIssuer: oidcIssuer,
                                 clientId: clientId,
-                                clientSecret: clientSecret,
                                 redirectUri: redirectUri
-                            }, appClientUrl ? {
+                            }, clientSecret ? {
+                                clientSecret: clientSecret
+                            } : {}, tokenEndpointAuthMethod ? {
+                                tokenEndpointAuthMethod: tokenEndpointAuthMethod
+                            } : {}, appClientUrl ? {
                                 appClientUrl: appClientUrl
                             } : {}, scopes ? {
                                 scopes: scopes
@@ -8977,7 +9523,7 @@ function resolveAuthSetupPrompt(input) {
                                     } : {})
                                 })
                             ];
-                        case 7:
+                        case 9:
                             merged = _state.sent();
                             outputResult({
                                 saved: true,
@@ -9000,8 +9546,19 @@ function resolveAuthSetupPrompt(input) {
         builder: function builder(yargs) {
             return withEnv(yargs).option('open', {
                 type: 'boolean',
-                default: false,
-                describe: 'Print the auth URL only (does not auto-open a browser)'
+                default: true,
+                describe: 'Open the authorization URL in the default browser. Use --no-open to print it only.'
+            }).option('listen', {
+                type: 'boolean',
+                default: true,
+                describe: 'Bind the loopback redirect URI and read the authorization code straight out of the browser redirect. Use --no-listen to always paste it back by hand.'
+            }).option('listen-for', {
+                type: 'string',
+                default: DEFAULT_AUTH_LOGIN_LISTEN_FOR,
+                describe: "How long to wait for the browser redirect before falling back to the paste prompt (e.g. 5m, 90s). Defaults to ".concat(DEFAULT_AUTH_LOGIN_LISTEN_FOR, ".")
+            }).option('redirect-port', {
+                type: 'number',
+                describe: 'Bind the loopback listener on this port instead of the one in the configured redirect URI. The resulting redirect URI must also be registered with the OAuth client.'
             }).option('code', {
                 type: 'string',
                 describe: 'Skip the prompt and pass the redirect URL or bare code directly'
@@ -9021,7 +9578,7 @@ function resolveAuthSetupPrompt(input) {
         },
         handler: wrapCommandHandler(function(argv) {
             return _async_to_generator$1b(function() {
-                var _argv_code, _tokenResponse_expires_in, _ref, _ref1, envName, env, meta, _ref2, codeVerifier, codeChallenge, state, requestedScopes, requestedSessionTtlSeconds, ms, url, pasted, _tmp, code, tokenResponse, expiresAt, sessionInfo, sessionExpiresAt, rotationDisabled, entry, sessionSummary;
+                var _argv_listenFor, _ref, _tokenResponse_expires_in, _ref1, _ref2, envName, env, meta, _ref3, codeVerifier, codeChallenge, state, requestedScopes, requestedSessionTtlSeconds, ms, listenForMs, suppliedCode, shouldListen, loopbackTarget, capture, e, suggestedRedirectUri, redirectUri, url, _tmp, pasted, controller, prompt, redirected, e1, code, tokenResponse, expiresAt, sessionInfo, sessionExpiresAt, rotationDisabled, entry, sessionSummary;
                 return _ts_generator$1b(this, function(_state) {
                     switch(_state.label){
                         case 0:
@@ -9037,7 +9594,7 @@ function resolveAuthSetupPrompt(input) {
                                 })
                             ];
                         case 1:
-                            _ref1 = _state.sent(), envName = _ref1.envName, env = _ref1.env;
+                            _ref2 = _state.sent(), envName = _ref2.envName, env = _ref2.env;
                             return [
                                 4,
                                 discoverOidcMetadata({
@@ -9052,7 +9609,7 @@ function resolveAuthSetupPrompt(input) {
                                 generatePkceMaterial()
                             ];
                         case 3:
-                            _ref2 = _state.sent(), codeVerifier = _ref2.codeVerifier, codeChallenge = _ref2.codeChallenge;
+                            _ref3 = _state.sent(), codeVerifier = _ref3.codeVerifier, codeChallenge = _ref3.codeChallenge;
                             state = generateOAuthState();
                             requestedScopes = argv.readOnlyScopes ? filterReadOnlyModelScopes(env.scopes) : env.scopes;
                             if (argv.serviceToken) {
@@ -9071,42 +9628,214 @@ function resolveAuthSetupPrompt(input) {
                                 }
                                 requestedSessionTtlSeconds = Math.floor(ms / MS_IN_SECOND);
                             }
+                            listenForMs = durationDataToMilliseconds(parseDurationString((_argv_listenFor = argv.listenFor) !== null && _argv_listenFor !== void 0 ? _argv_listenFor : DEFAULT_AUTH_LOGIN_LISTEN_FOR));
+                            if (listenForMs <= 0) {
+                                throw new CliError({
+                                    message: '--listen-for: invalid duration "'.concat(argv.listenFor, '". Use formats like "5m", "90s", or mixed units like "1h30m".'),
+                                    code: 'AUTH_LISTEN_FOR_INVALID'
+                                });
+                            }
+                            // The loopback listener is started BEFORE the authorization URL is built: the port it binds is
+                            // part of the `redirect_uri` the provider echoes back, so it has to be settled first.
+                            suppliedCode = argv.code;
+                            shouldListen = suppliedCode == null && argv.listen !== false;
+                            loopbackTarget = shouldListen ? parseLoopbackRedirectUri({
+                                redirectUri: env.redirectUri,
+                                port: argv.redirectPort
+                            }) : undefined;
+                            if (!loopbackTarget) return [
+                                3,
+                                8
+                            ];
+                            _state.label = 4;
+                        case 4:
+                            _state.trys.push([
+                                4,
+                                6,
+                                ,
+                                7
+                            ]);
+                            return [
+                                4,
+                                startLoopbackRedirectCapture({
+                                    target: loopbackTarget
+                                })
+                            ];
+                        case 5:
+                            capture = _state.sent();
+                            return [
+                                3,
+                                7
+                            ];
+                        case 6:
+                            e = _state.sent();
+                            // A port that is already in use is not worth failing the whole login over — the paste
+                            // flow is still there, and it is what the CLI did unconditionally before.
+                            process.stderr.write("".concat(e.message, " Falling back to pasting the redirect URL.\n"));
+                            return [
+                                3,
+                                7
+                            ];
+                        case 7:
+                            return [
+                                3,
+                                9
+                            ];
+                        case 8:
+                            if (shouldListen) {
+                                suggestedRedirectUri = "http://127.0.0.1:".concat(SUGGESTED_CLI_LOOPBACK_REDIRECT_PORT, "/callback");
+                                process.stderr.write('Redirect capture is unavailable: "'.concat(env.redirectUri, '" has no loopback port to bind.\n  To capture the redirect automatically, register ').concat(suggestedRedirectUri, " with the OAuth client, then run:\n    ").concat(cliName, " auth setup --env ").concat(envName, " --redirect-uri ").concat(suggestedRedirectUri, "\n"));
+                            }
+                            _state.label = 9;
+                        case 9:
+                            // Identical to the configured redirect URI unless `--redirect-port` moved it, and it is what
+                            // the token exchange must echo back — a mismatch there is rejected as `invalid_grant`.
+                            redirectUri = (_ref = capture === null || capture === void 0 ? void 0 : capture.redirectUri) !== null && _ref !== void 0 ? _ref : env.redirectUri;
                             url = buildAuthorizationUrl({
                                 authorizationEndpoint: meta.authorization_endpoint,
                                 oidcIssuer: env.oidcIssuer,
                                 apiBaseUrl: env.apiBaseUrl,
                                 appClientUrl: env.appClientUrl,
                                 clientId: env.clientId,
-                                redirectUri: env.redirectUri,
+                                redirectUri: redirectUri,
                                 scopes: requestedScopes,
                                 state: state,
                                 codeChallenge: codeChallenge,
                                 requestedSessionTtlSeconds: requestedSessionTtlSeconds
                             });
-                            // The CLI never opens a browser itself — it prints the URL and reads the redirect back.
-                            // Emit the URL through a clearly-prefixed stderr line so JSON stdout stays parseable.
+                            // Printed even when the browser opens: it is the fallback whenever the launch fails, and the
+                            // record of what was opened. Emitted on stderr so JSON stdout stays parseable.
                             process.stderr.write("Authorization URL:\n  ".concat(url, "\n"));
-                            if (!((_argv_code = argv.code) !== null && _argv_code !== void 0)) return [
+                            _tmp = suppliedCode == null && argv.open !== false;
+                            if (!_tmp) return [
                                 3,
-                                4
+                                11
+                            ];
+                            return [
+                                4,
+                                openUrlInBrowser({
+                                    url: url
+                                })
+                            ];
+                        case 10:
+                            _tmp = !_state.sent();
+                            _state.label = 11;
+                        case 11:
+                            if (_tmp) {
+                                process.stderr.write('Could not open a browser automatically — open the URL above by hand.\n');
+                            }
+                            _state.label = 12;
+                        case 12:
+                            _state.trys.push([
+                                12,
+                                ,
+                                23,
+                                25
+                            ]);
+                            if (!(suppliedCode != null)) return [
+                                3,
+                                13
                             ];
-                            _tmp = _argv_code;
+                            pasted = suppliedCode;
                             return [
                                 3,
-                                6
+                                22
                             ];
-                        case 4:
+                        case 13:
+                            if (!capture) return [
+                                3,
+                                20
+                            ];
+                            // The hint goes to stderr and the prompt itself is rendered empty, so the readline prompt
+                            // never lands on stdout alongside the JSON envelope.
+                            process.stderr.write("Waiting for the redirect to ".concat(capture.redirectUri, " ... (or paste the redirect URL here)\n"));
+                            // Both sources run at once. The listener is the happy path, and the prompt is the way out
+                            // when the browser cannot reach this process's loopback interface at all (an SSH session,
+                            // a container) — without it that case would just sit here until the listener timed out.
+                            controller = new AbortController();
+                            prompt = promptLine({
+                                question: '',
+                                signal: controller.signal
+                            });
+                            redirected = capture.waitForRedirect(listenForMs);
+                            // Whichever source loses is abandoned mid-flight; its rejection is expected, not unhandled.
+                            prompt.catch(noop);
+                            redirected.catch(noop);
+                            _state.label = 14;
+                        case 14:
+                            _state.trys.push([
+                                14,
+                                16,
+                                18,
+                                19
+                            ]);
+                            return [
+                                4,
+                                Promise.race([
+                                    redirected,
+                                    prompt
+                                ])
+                            ];
+                        case 15:
+                            pasted = _state.sent();
+                            return [
+                                3,
+                                19
+                            ];
+                        case 16:
+                            e1 = _state.sent();
+                            // Only the listener's timeout reaches here — the prompt is still open, so keep waiting on it.
+                            process.stderr.write("".concat(e1.message, "\n"));
+                            return [
+                                4,
+                                prompt
+                            ];
+                        case 17:
+                            pasted = _state.sent();
+                            return [
+                                3,
+                                19
+                            ];
+                        case 18:
+                            // Released only once a winner is settled. Aborting from inside the redirect's own `then`
+                            // instead would reject the prompt a microtask BEFORE the redirect resolved, and the race
+                            // would hand back that rejection rather than the code it just captured.
+                            controller.abort();
+                            return [
+                                7
+                            ];
+                        case 19:
+                            return [
+                                3,
+                                22
+                            ];
+                        case 20:
                             return [
                                 4,
                                 promptLine({
                                     question: 'Paste redirect URL or code: '
                                 })
                             ];
-                        case 5:
-                            _tmp = _state.sent();
-                            _state.label = 6;
-                        case 6:
-                            pasted = _tmp;
+                        case 21:
+                            pasted = _state.sent();
+                            _state.label = 22;
+                        case 22:
+                            return [
+                                3,
+                                25
+                            ];
+                        case 23:
+                            // Unconditional: a listener left bound keeps the process alive well past the command.
+                            return [
+                                4,
+                                capture === null || capture === void 0 ? void 0 : capture.close()
+                            ];
+                        case 24:
+                            _state.sent();
+                            return [
+                                7
+                            ];
+                        case 25:
                             code = parsePastedRedirect({
                                 pasted: pasted,
                                 expectedState: state
@@ -9117,12 +9846,12 @@ function resolveAuthSetupPrompt(input) {
                                     tokenEndpoint: meta.token_endpoint,
                                     clientId: env.clientId,
                                     clientSecret: env.clientSecret,
-                                    redirectUri: env.redirectUri,
+                                    redirectUri: redirectUri,
                                     code: code,
                                     codeVerifier: codeVerifier
                                 })
                             ];
-                        case 7:
+                        case 26:
                             tokenResponse = _state.sent();
                             expiresAt = Date.now() + ((_tokenResponse_expires_in = tokenResponse.expires_in) !== null && _tokenResponse_expires_in !== void 0 ? _tokenResponse_expires_in : 0) * 1000;
                             return [
@@ -9132,9 +9861,9 @@ function resolveAuthSetupPrompt(input) {
                                     accessToken: tokenResponse.access_token
                                 })
                             ];
-                        case 8:
+                        case 27:
                             sessionInfo = _state.sent();
-                            sessionExpiresAt = (_ref = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.expiresAt) !== null && _ref !== void 0 ? _ref : undefined;
+                            sessionExpiresAt = (_ref1 = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.expiresAt) !== null && _ref1 !== void 0 ? _ref1 : undefined;
                             rotationDisabled = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.rotationDisabled;
                             entry = _object_spread$Q({
                                 accessToken: tokenResponse.access_token,
@@ -9152,7 +9881,7 @@ function resolveAuthSetupPrompt(input) {
                                 4,
                                 tokens.set(envName, entry)
                             ];
-                        case 9:
+                        case 28:
                             _state.sent();
                             sessionSummary = describeSessionLifetime({
                                 sessionExpiresAt: sessionExpiresAt,
@@ -9216,7 +9945,7 @@ function resolveAuthSetupPrompt(input) {
                             ];
                         case 2:
                             entry = _state.sent();
-                            if (!(argv.revoke && (entry === null || entry === void 0 ? void 0 : entry.refreshToken) && env.clientId && env.clientSecret)) return [
+                            if (!(argv.revoke && (entry === null || entry === void 0 ? void 0 : entry.refreshToken) && env.clientId)) return [
                                 3,
                                 8
                             ];
@@ -12550,7 +13279,7 @@ function _unsupported_iterable_to_array$$(o, minLen) {
                 return _ts_generator$17(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            if (!(!envName || !(env === null || env === void 0 ? void 0 : env.clientId) || !(env === null || env === void 0 ? void 0 : env.clientSecret))) return [
+                            if (!(!envName || !(env === null || env === void 0 ? void 0 : env.clientId))) return [
                                 3,
                                 1
                             ];
@@ -13754,7 +14483,7 @@ function runFirestoreSessionProbe(input) {
                         7
                     ];
                 case 2:
-                    if (!((entry === null || entry === void 0 ? void 0 : entry.refreshToken) && env.clientId && env.clientSecret)) return [
+                    if (!((entry === null || entry === void 0 ? void 0 : entry.refreshToken) && env.clientId)) return [
                         3,
                         7
                     ];
@@ -69078,4 +69807,4 @@ function printPaginatedOutput(input) {
     })();
 }
 
-export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILD_DRIFT_DOCTOR_CHECK_NAME, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER, CLI_DATA_CACHE_CYCLE_ERROR_CODE, CLI_DATA_CACHE_FINGERPRINT_LENGTH, CLI_DATA_CACHE_GLOBAL_OPTION_NAMES, CLI_DATA_CACHE_INDEX_FILE_NAME, CLI_DATA_CACHE_SCHEMA_VERSION, CLI_DATA_CACHE_UNSUPPORTED_VALUE_ERROR_CODE, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CLI_FIRESTORE_QUERY_DATASET_PREFIX, CLI_FIRESTORE_QUERY_DATASET_VERSION, CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS, CLI_FIRESTORE_SESSION_MAX_CACHE_MS, CLI_FRAMEWORK_PACKAGE_PREFIX, CLI_READ_VIA_EPILOGUE, CLI_READ_VIA_VALUES, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_CODEC, DEFAULT_CLI_DATA_CACHE_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_MAX_AGE_HOURS, DEFAULT_CLI_DATA_CACHE_OPTIONS, DEFAULT_CLI_FIREBASE_EMULATOR_HOST, DEFAULT_CLI_HTTP_TIMEOUT_MS, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_READ_VIA, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FIRESTORE_GET_COMMAND_NAME, DEFAULT_FIRESTORE_QUERIES_COMMAND_NAME, DEFAULT_FIRESTORE_QUERY_COMMAND_NAME, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DISABLED_CLI_DATA_CACHE_OPTIONS, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FIRESTORE_COLLECTION_UNRESOLVABLE_CODE, FIRESTORE_QUERY_PARENT_REQUIRED_CODE, FIRESTORE_QUERY_UNAVAILABLE_CODE, FIRESTORE_SDK_IDENTITY_STAGE, FIRESTORE_SDK_INSTANCE_MISMATCH_CODE, FIRESTORE_SESSION_API_PATH, FIRESTORE_SESSION_DOCTOR_CHECK_NAME, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_IS_SERVER_ONLY_CODE, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, ROUTE_MANIFEST_VERSION, ROUTE_MODEL_LIST_TAG, ROUTE_MODEL_TAG, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, STDIN_NOT_PIPED_ERROR_CODE, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, appendCliErrorMapper, applyEnvVarOverrides, assertCliFirestoreQueryCanRun, assertCliFirestoreQueryParentKey, assertCliModelIsNotServerOnly, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildFirestoreGetCommand, buildFirestoreQueriesCommand, buildFirestoreQueryCommand, buildFirestoreSessionDoctorReadRouting, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildPipesManifest, buildRouteManifest, buildRouteTree, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, canonicalCliCacheJson, checkCliDataCacheArgv, clearDownstreamCatalogCache, cliBuildDriftDescription, cliCacheFingerprint, cliDataCacheKey, cliDataCacheMeta, cliDataCacheOptions, cliDataCachePathSegment, cliFirebaseAppName, cliFirebaseEmulatorsInUse, cliFirestoreAccessorFactory, cliFirestoreBinding, cliFirestoreCollectionForQuery, cliFirestoreErrorMapper, cliFirestoreQueryConstraints, cliFirestoreQueryMode, cliFirestoreQueryModeForRules, cliFirestoreSdkIdentitySuggestion, cliFirestoreSessionEntryExpiresAt, cliFirestoreWiringError, cliLifecycleRunner, cliReadResultMeta, closeAllCliFirebaseApps, closeCliFirestoreSessionContext, coerceCliReadVia, collectClassPropertiesWithInheritance, computeRelativeSpecifiers, configureCliDataCacheOptions, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCacheCommand, createCallModelCommand, createCli, createCliBuildDriftDoctorCheck, createCliContext, createCliDataCache, createCliFirestoreModels, createCliFirestoreQueryRegistry, createCliFirestoreSessionCacheStore, createCliFirestoreSessionContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createFirestoreSessionDoctorCheck, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, describeCliFirestoreQueryMode, detectDataHelpFormat, detectHelpMode, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractComponentRouteModelTags, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFile, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUrlParamKeys, extractUtilEntries, fetchFirestoreSession, fetchSessionInfo, fetchUserInfo, filterCliFirestoreQueries, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, flattenList, formatGeneratedTs, fromCliCacheJson, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverFirestore, getModelOverHttp, getMultipleModelsOverFirestore, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, hasParamSegment, indentLines$1 as indentLines, inspectCliBuildDrift, inspectCliFirestoreSdkIdentity, isCliEnvConfigComplete, isCliFirebaseConfigComplete, isCliFirestoreQueryInvocable, isCliFirestoreSessionExpired, isCliVerbose, isCoreTopic, isEntryExpired, isExportedFromPackage, isStdinPositionalSentinel, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadOrBuildCliCachedData, loadPackageName, loadPipeManifests, loadPipeRegistry, loadRouteTree, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, matchUrlAgainstEntries, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeCliFirebaseConfig, mergeOutputConfig, normalizeCliCacheFilter, normalizePathname, oidcRelyingPartyErrorToCliError, openStreamingDump, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseFirestoreModelIdentityArgs, parseGetArgs, parseGetManyArgs, parsePastedRedirect, parseRouteModelTag, parseScanArgs, pickFields, promptLine, readAllStdin, readCliArtifactPackage, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderCliFirestoreQueryEntry, renderCliFirestoreQueryList, renderDecodedKey, renderGroupedImportLines, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, renderTable, requireCliContext, requireCliFirestoreContext, requireCliFirestoreModels, requireCliFirestoreSession, resolveActiveEnvName, resolveCliDataCacheOptions, resolveCliEnv, resolveCliEnvOrThrow, resolveCliFirestoreQueryArgs, resolveCliFirestoreQueryEntry, resolveCliModel, resolveCliReadSource, resolveComponentSourceFromSources, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveExtendsName, resolveModelArchetype, resolveOutputConfig, resolveOxfmtConfig, resolvePerModelGetKey, resolveRouteSources, revokeToken, runActionsScanCli, runCli, runCliFirestoreQuery, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, saveCliConfig, scanFactoryReferences, scoreCandidates, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliRawArgv, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, splitSegments, stripUrlQueryAndHash, toActionEntryInfo, toCliCacheJson, toFilterEntryInfo, toFormFieldInfo, tracedFetch, truncate, tryMatchSegments, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler, writeGeneratedTsFile };
+export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILD_DRIFT_DOCTOR_CHECK_NAME, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER, CLI_DATA_CACHE_CYCLE_ERROR_CODE, CLI_DATA_CACHE_FINGERPRINT_LENGTH, CLI_DATA_CACHE_GLOBAL_OPTION_NAMES, CLI_DATA_CACHE_INDEX_FILE_NAME, CLI_DATA_CACHE_SCHEMA_VERSION, CLI_DATA_CACHE_UNSUPPORTED_VALUE_ERROR_CODE, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CLI_FIRESTORE_QUERY_DATASET_PREFIX, CLI_FIRESTORE_QUERY_DATASET_VERSION, CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS, CLI_FIRESTORE_SESSION_MAX_CACHE_MS, CLI_FRAMEWORK_PACKAGE_PREFIX, CLI_READ_VIA_EPILOGUE, CLI_READ_VIA_VALUES, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_CODEC, DEFAULT_CLI_DATA_CACHE_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_MAX_AGE_HOURS, DEFAULT_CLI_DATA_CACHE_OPTIONS, DEFAULT_CLI_FIREBASE_EMULATOR_HOST, DEFAULT_CLI_HTTP_TIMEOUT_MS, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_READ_VIA, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FIRESTORE_GET_COMMAND_NAME, DEFAULT_FIRESTORE_QUERIES_COMMAND_NAME, DEFAULT_FIRESTORE_QUERY_COMMAND_NAME, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DISABLED_CLI_DATA_CACHE_OPTIONS, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FIRESTORE_COLLECTION_UNRESOLVABLE_CODE, FIRESTORE_QUERY_PARENT_REQUIRED_CODE, FIRESTORE_QUERY_UNAVAILABLE_CODE, FIRESTORE_SDK_IDENTITY_STAGE, FIRESTORE_SDK_INSTANCE_MISMATCH_CODE, FIRESTORE_SESSION_API_PATH, FIRESTORE_SESSION_DOCTOR_CHECK_NAME, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, LOOPBACK_REDIRECT_HOSTNAMES, LOOPBACK_REDIRECT_LISTEN_FAILED_ERROR_CODE, LOOPBACK_REDIRECT_TIMEOUT_ERROR_CODE, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_IS_SERVER_ONLY_CODE, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, ROUTE_MANIFEST_VERSION, ROUTE_MODEL_LIST_TAG, ROUTE_MODEL_TAG, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, STDIN_NOT_PIPED_ERROR_CODE, SUGGESTED_CLI_LOOPBACK_REDIRECT_PORT, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, appendCliErrorMapper, applyEnvVarOverrides, assertCliFirestoreQueryCanRun, assertCliFirestoreQueryParentKey, assertCliModelIsNotServerOnly, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildFirestoreGetCommand, buildFirestoreQueriesCommand, buildFirestoreQueryCommand, buildFirestoreSessionDoctorReadRouting, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildPipesManifest, buildRouteManifest, buildRouteTree, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, canonicalCliCacheJson, checkCliDataCacheArgv, clearDownstreamCatalogCache, cliBuildDriftDescription, cliCacheFingerprint, cliDataCacheKey, cliDataCacheMeta, cliDataCacheOptions, cliDataCachePathSegment, cliFirebaseAppName, cliFirebaseEmulatorsInUse, cliFirestoreAccessorFactory, cliFirestoreBinding, cliFirestoreCollectionForQuery, cliFirestoreErrorMapper, cliFirestoreQueryConstraints, cliFirestoreQueryMode, cliFirestoreQueryModeForRules, cliFirestoreSdkIdentitySuggestion, cliFirestoreSessionEntryExpiresAt, cliFirestoreWiringError, cliLifecycleRunner, cliReadResultMeta, closeAllCliFirebaseApps, closeCliFirestoreSessionContext, coerceCliReadVia, collectClassPropertiesWithInheritance, computeRelativeSpecifiers, configureCliDataCacheOptions, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCacheCommand, createCallModelCommand, createCli, createCliBuildDriftDoctorCheck, createCliContext, createCliDataCache, createCliFirestoreModels, createCliFirestoreQueryRegistry, createCliFirestoreSessionCacheStore, createCliFirestoreSessionContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createFirestoreSessionDoctorCheck, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, describeCliFirestoreQueryMode, detectDataHelpFormat, detectHelpMode, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractComponentRouteModelTags, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFile, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUrlParamKeys, extractUtilEntries, fetchFirestoreSession, fetchSessionInfo, fetchUserInfo, filterCliFirestoreQueries, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, flattenList, formatGeneratedTs, fromCliCacheJson, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverFirestore, getModelOverHttp, getMultipleModelsOverFirestore, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, hasParamSegment, indentLines$1 as indentLines, inspectCliBuildDrift, inspectCliFirestoreSdkIdentity, isCliEnvConfigComplete, isCliFirebaseConfigComplete, isCliFirestoreQueryInvocable, isCliFirestoreSessionExpired, isCliVerbose, isCoreTopic, isEntryExpired, isExportedFromPackage, isStdinPositionalSentinel, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadOrBuildCliCachedData, loadPackageName, loadPipeManifests, loadPipeRegistry, loadRouteTree, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, matchUrlAgainstEntries, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeCliFirebaseConfig, mergeOutputConfig, normalizeCliCacheFilter, normalizePathname, oidcRelyingPartyErrorToCliError, openStreamingDump, openUrlInBrowser, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseFirestoreModelIdentityArgs, parseGetArgs, parseGetManyArgs, parseLoopbackRedirectUri, parsePastedRedirect, parseRouteModelTag, parseScanArgs, pickFields, promptLine, readAllStdin, readCliArtifactPackage, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderCliFirestoreQueryEntry, renderCliFirestoreQueryList, renderDecodedKey, renderGroupedImportLines, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, renderTable, requireCliContext, requireCliFirestoreContext, requireCliFirestoreModels, requireCliFirestoreSession, resolveActiveEnvName, resolveCliDataCacheOptions, resolveCliEnv, resolveCliEnvOrThrow, resolveCliFirestoreQueryArgs, resolveCliFirestoreQueryEntry, resolveCliModel, resolveCliReadSource, resolveComponentSourceFromSources, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveExtendsName, resolveModelArchetype, resolveOutputConfig, resolveOxfmtConfig, resolvePerModelGetKey, resolveRouteSources, revokeToken, runActionsScanCli, runCli, runCliFirestoreQuery, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, saveCliConfig, scanFactoryReferences, scoreCandidates, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliRawArgv, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, splitSegments, startLoopbackRedirectCapture, stripUrlQueryAndHash, toActionEntryInfo, toCliCacheJson, toFilterEntryInfo, toFormFieldInfo, tracedFetch, truncate, tryMatchSegments, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler, writeGeneratedTsFile };