@dereekb/dbx-cli 14.2.0 → 14.4.0

package/index.esm.js

@@ -1,17 +1,17 @@
 import { existsSync, mkdirSync, writeFileSync, readFileSync, statSync, appendFileSync } from 'node:fs';
 import { join, dirname, resolve, sep, basename, relative, posix, isAbsolute, parse } from 'node:path';
-import { clientFirebaseFirestoreContextFactory, makeFirestoreCollectionGroup, addOrReplaceLimitInConstraints, CALL_MODEL_OIDC_SCOPES, CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, CALL_MODEL_OIDC_SCOPE_PREFIX, STORAGE_FILE_UPLOAD_USER_ROLE } from '@dereekb/firebase';
+import { makeFirestoreCollectionGroup, addOrReplaceLimitInConstraints, CALL_MODEL_OIDC_SCOPES, CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, CALL_MODEL_OIDC_SCOPE_PREFIX, STORAGE_FILE_UPLOAD_USER_ROLE } from '@dereekb/firebase';
 export { CALL_MODEL_APP_FUNCTION_KEY } from '@dereekb/firebase';
 import { createRequire } from 'node:module';
-import { Firestore, getFirestore, connectFirestoreEmulator } from 'firebase/firestore';
-import { getApps, initializeApp, deleteApp } from 'firebase/app';
-import { initializeAppCheck, CustomProvider } from 'firebase/app-check';
-import { signInWithCustomToken, getAuth, connectAuthEmulator } from 'firebase/auth';
-import { expirationDetails, performAsyncTasks, compareStrings, OidcRelyingPartyError, buildAuthorizationUrl as buildAuthorizationUrl$1, parseAuthorizationRedirect, noop, generateOAuthState, generatePkceMaterial, MS_IN_SECOND, isPlainObject as isPlainObject$1, MS_IN_HOUR, asArray, buildOidcDiscoveryCandidates, unique, AUTH_TOS_SIGNED_ROLE, AUTH_ONBOARDED_ROLE, AUTH_ADMIN_ROLE, AUTH_USER_ROLE } from '@dereekb/util';
-import { createMemoizedJsonFileAsyncKeyedValueCache, readJsonFile, writeJsonFile, DEFAULT_JSON_FILE_CACHE_MODE, removeFile } from '@dereekb/nestjs';
+import { CLIENT_FIRESTORE_DRIVER_IDENTIFIER, firebaseClientFirestoreIdentitySuggestion, inspectFirebaseClientFirestoreIdentity, fetchFirestoreSession as fetchFirestoreSession$1, DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST, firebaseClientEmulatorsInUse, isFirebaseClientConfigComplete, openFirebaseUserSession, closeFirebaseUserSession, closeFirebaseUserSessionApps, FIRESTORE_SESSION_EXPIRY_BUFFER_MS, FIRESTORE_SESSION_MAX_CACHE_MS, firestoreSessionEntryExpiresAt, isFirestoreSessionExpired } from '@dereekb/oauth-resource/firebase';
+export { FIRESTORE_SESSION_API_PATH } from '@dereekb/oauth-resource/firebase';
+import { performAsyncTasks, compareStrings, expirationDetails, OidcRelyingPartyError, buildAuthorizationUrl as buildAuthorizationUrl$1, parseAuthorizationRedirect, noop, generateOAuthState, MS_IN_SECOND, generatePkceMaterial, isPlainObject as isPlainObject$1, MS_IN_HOUR, asArray, buildOidcDiscoveryCandidates, unique, AUTH_TOS_SIGNED_ROLE, AUTH_ONBOARDED_ROLE, AUTH_ADMIN_ROLE, AUTH_USER_ROLE } from '@dereekb/util';
 import { durationDataToMilliseconds, parseDurationString } from '@dereekb/date';
+import { readJsonFile, writeJsonFile, createMemoizedJsonFileAsyncKeyedValueCache, DEFAULT_JSON_FILE_CACHE_MODE, removeFile } from '@dereekb/nestjs';
 import { homedir } from 'node:os';
 import { discoverOidcMetadata as discoverOidcMetadata$1, exchangeAuthorizationCode as exchangeAuthorizationCode$1, refreshAccessToken as refreshAccessToken$1, revokeToken as revokeToken$1, fetchUserInfo as fetchUserInfo$1, fetchSessionInfo as fetchSessionInfo$1 } from '@dereekb/util/oidc';
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
 import { createInterface } from 'node:readline';
 import { chmod, writeFile, mkdir, readFile, glob, stat, readdir } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
@@ -36,7 +36,7 @@ function _assert_this_initialized(self) {
     if (self === void 0) throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
     return self;
 }
-function asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -47,16 +47,16 @@ function asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1t(fn) {
+function _async_to_generator$1u(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -155,7 +155,7 @@ function _object_spread$10(target) {
     }
     return target;
 }
-function ownKeys$I(object, enumerableOnly) {
+function ownKeys$H(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -163,18 +163,18 @@ function ownKeys$I(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$I(target, source) {
+function _object_spread_props$H(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$I(Object(source)).forEach(function(key) {
+        ownKeys$H(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
 function _possible_constructor_return(self, call) {
-    if (call && (_type_of$8(call) === "object" || typeof call === "function")) return call;
+    if (call && (_type_of$7(call) === "object" || typeof call === "function")) return call;
     return _assert_this_initialized(self);
 }
 function _set_prototype_of(o, p) {
@@ -187,7 +187,7 @@ function _set_prototype_of(o, p) {
 function _to_consumable_array$_(arr) {
     return _array_without_holes$_(arr) || _iterable_to_array$_(arr) || _unsupported_iterable_to_array$1c(arr) || _non_iterable_spread$_();
 }
-function _ts_generator$1t(thisArg, body) {
+function _ts_generator$1u(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -286,7 +286,7 @@ function _ts_generator$1t(thisArg, body) {
         };
     }
 }
-function _type_of$8(obj) {
+function _type_of$7(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
@@ -407,10 +407,10 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
  * @param init - The RequestInit. Any existing `signal` is preserved; we only attach our own when no signal was supplied.
  * @returns The fetch Response.
  */ function tracedFetch(fetcher, input, init) {
-    return _async_to_generator$1t(function() {
+    return _async_to_generator$1u(function() {
         var _ref, fetchImpl, timeoutMs, method, url, controller, timeoutHandle, finalInit, // Don't let the abort timer itself keep the Node event loop (or a test worker) alive.
         _timeoutHandle_unref, localController, e;
-        return _ts_generator$1t(this, function(_state) {
+        return _ts_generator$1u(this, function(_state) {
             switch(_state.label){
                 case 0:
                     fetchImpl = fetcher !== null && fetcher !== void 0 ? fetcher : fetch;
@@ -432,7 +432,7 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
                             return localController.abort();
                         }, timeoutMs);
                         (_timeoutHandle_unref = timeoutHandle.unref) === null || _timeoutHandle_unref === void 0 ? void 0 : _timeoutHandle_unref.call(timeoutHandle);
-                        finalInit = _object_spread_props$I(_object_spread$10({}, init), {
+                        finalInit = _object_spread_props$H(_object_spread$10({}, init), {
                             signal: localController.signal
                         });
                     }
@@ -619,7 +619,7 @@ function dumpResponse(data, meta) {
         result = data.map(function(item) {
             return pickFromObject(item, fields);
         });
-    } else if (data != null && (typeof data === "undefined" ? "undefined" : _type_of$8(data)) === 'object') {
+    } else if (data != null && (typeof data === "undefined" ? "undefined" : _type_of$7(data)) === 'object') {
         result = pickFromObject(data, fields);
     } else {
         result = data;
@@ -628,7 +628,7 @@ function dumpResponse(data, meta) {
 }
 function pickFromObject(obj, fields) {
     var result;
-    if (obj == null || (typeof obj === "undefined" ? "undefined" : _type_of$8(obj)) !== 'object') {
+    if (obj == null || (typeof obj === "undefined" ? "undefined" : _type_of$7(obj)) !== 'object') {
         result = obj;
     } else {
         var picked = {};
@@ -761,7 +761,7 @@ function _array_like_to_array$1b(arr, len) {
 function _array_without_holes$Z(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$1b(arr);
 }
-function asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -772,16 +772,16 @@ function asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1s(fn) {
+function _async_to_generator$1t(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -821,7 +821,7 @@ function _object_spread$$(target) {
     }
     return target;
 }
-function ownKeys$H(object, enumerableOnly) {
+function ownKeys$G(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -829,11 +829,11 @@ function ownKeys$H(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$H(target, source) {
+function _object_spread_props$G(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$H(Object(source)).forEach(function(key) {
+        ownKeys$G(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -842,7 +842,7 @@ function _object_spread_props$H(target, source) {
 function _to_consumable_array$Z(arr) {
     return _array_without_holes$Z(arr) || _iterable_to_array$Z(arr) || _unsupported_iterable_to_array$1b(arr) || _non_iterable_spread$Z();
 }
-function _ts_generator$1s(thisArg, body) {
+function _ts_generator$1t(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -941,7 +941,7 @@ function _ts_generator$1s(thisArg, body) {
         };
     }
 }
-function _type_of$7(obj) {
+function _type_of$6(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
@@ -966,14 +966,14 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The call envelope describing the API target, access token, model params, and optional fetch override.
  * @returns The parsed JSON response body cast to `R`.
  */ function callModelOverHttp(input) {
-    return _async_to_generator$1s(function() {
+    return _async_to_generator$1t(function() {
         var _input_params_call;
-        return _ts_generator$1s(this, function(_state) {
+        return _ts_generator$1t(this, function(_state) {
             return [
                 2,
                 requestJson({
                     method: 'POST',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl)).concat(CALL_MODEL_API_PATH),
+                    url: "".concat(trimSlash(input.apiBaseUrl)).concat(CALL_MODEL_API_PATH),
                     accessToken: input.accessToken,
                     jsonBody: input.params,
                     fetcher: input.fetcher,
@@ -996,13 +996,13 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The request envelope describing the API target, access token, model + key, and optional fetch override.
  * @returns The parsed `{ key, data }` envelope.
  */ function getModelOverHttp(input) {
-    return _async_to_generator$1s(function() {
-        return _ts_generator$1s(this, function(_state) {
+    return _async_to_generator$1t(function() {
+        return _ts_generator$1t(this, function(_state) {
             return [
                 2,
                 requestJson({
                     method: 'GET',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get?key=").concat(encodeURIComponent(input.key)),
+                    url: "".concat(trimSlash(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get?key=").concat(encodeURIComponent(input.key)),
                     accessToken: input.accessToken,
                     fetcher: input.fetcher,
                     errorPrefix: "get ".concat(input.modelType, "/").concat(input.key, " failed")
@@ -1025,8 +1025,8 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The request envelope describing the API target, access token, model, keys, and optional fetch override.
  * @returns The parsed `{ results, errors }` envelope.
  */ function getMultipleModelsOverHttp(input) {
-    return _async_to_generator$1s(function() {
-        return _ts_generator$1s(this, function(_state) {
+    return _async_to_generator$1t(function() {
+        return _ts_generator$1t(this, function(_state) {
             if (input.keys.length === 0) {
                 throw new CliError({
                     message: 'get-many requires at least one key.',
@@ -1043,7 +1043,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                 2,
                 requestJson({
                     method: 'POST',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get"),
+                    url: "".concat(trimSlash(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get"),
                     accessToken: input.accessToken,
                     jsonBody: {
                         keys: input.keys
@@ -1064,9 +1064,9 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - Same shape as {@link GetMultipleModelsOverHttpInput} but without the 50-key cap.
  * @returns The merged `{ results, errors }` envelope across all chunks.
  */ function getMultipleModelsOverHttpChunked(input) {
-    return _async_to_generator$1s(function() {
+    return _async_to_generator$1t(function() {
         var chunks, i, mergedResults, mergedErrors, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, chunk, _mergedResults, _mergedErrors, batch, err;
-        return _ts_generator$1s(this, function(_state) {
+        return _ts_generator$1t(this, function(_state) {
             switch(_state.label){
                 case 0:
                     if (input.keys.length === 0) {
@@ -1100,7 +1100,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                     chunk = _step.value;
                     return [
                         4,
-                        getMultipleModelsOverHttp(_object_spread_props$H(_object_spread$$({}, input), {
+                        getMultipleModelsOverHttp(_object_spread_props$G(_object_spread$$({}, input), {
                             keys: chunk
                         }))
                     ];
@@ -1154,9 +1154,9 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
     })();
 }
 function requestJson(input) {
-    return _async_to_generator$1s(function() {
+    return _async_to_generator$1t(function() {
         var hasJsonBody, init, res, _ref, ok, body, fallbackMessage;
-        return _ts_generator$1s(this, function(_state) {
+        return _ts_generator$1t(this, function(_state) {
             switch(_state.label){
                 case 0:
                     hasJsonBody = input.jsonBody !== undefined;
@@ -1185,8 +1185,8 @@ function requestJson(input) {
                     _ref = _state.sent(), ok = _ref.ok, body = _ref.body, fallbackMessage = _ref.fallbackMessage;
                     if (!ok) {
                         throw new CliError({
-                            message: "".concat(input.errorPrefix, ": ").concat(extractMessage$1(body, fallbackMessage, res)),
-                            code: codeForStatus$1(res.status),
+                            message: "".concat(input.errorPrefix, ": ").concat(extractMessage(body, fallbackMessage, res)),
+                            code: codeForStatus(res.status),
                             suggestion: res.status === 401 || res.status === 403 ? 'Run `<cli> auth login` to refresh credentials.' : undefined
                         });
                     }
@@ -1199,9 +1199,9 @@ function requestJson(input) {
     })();
 }
 function readJsonResponse(res) {
-    return _async_to_generator$1s(function() {
+    return _async_to_generator$1t(function() {
         var text, body;
-        return _ts_generator$1s(this, function(_state) {
+        return _ts_generator$1t(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -1229,12 +1229,12 @@ function readJsonResponse(res) {
         });
     })();
 }
-function extractMessage$1(body, fallback, res) {
-    var bodyMessage = (typeof body === "undefined" ? "undefined" : _type_of$7(body)) === 'object' && body && 'message' in body ? body.message : undefined;
+function extractMessage(body, fallback, res) {
+    var bodyMessage = (typeof body === "undefined" ? "undefined" : _type_of$6(body)) === 'object' && body && 'message' in body ? body.message : undefined;
     var messageString = typeof bodyMessage === 'string' ? bodyMessage : undefined;
     return messageString !== null && messageString !== void 0 ? messageString : fallback || "".concat(res.status, " ").concat(res.statusText);
 }
-function codeForStatus$1(status) {
+function codeForStatus(status) {
     var result;
     if (status === 401) {
         result = 'AUTH_UNAUTHORIZED';
@@ -1253,68 +1253,20 @@ function codeForStatus$1(status) {
     }
     return result;
 }
-function trimSlash$1(url) {
+function trimSlash(url) {
     return url.endsWith('/') ? url.slice(0, -1) : url;
 }
 
-function _define_property$$(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else obj[key] = value;
-    return obj;
-}
 function _instanceof$w(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
     } else return left instanceof right;
 }
-function _object_spread$_(target) {
-    for(var i = 1; i < arguments.length; i++){
-        var source = arguments[i] != null ? arguments[i] : {};
-        var ownKeys = Object.keys(source);
-        if (typeof Object.getOwnPropertySymbols === "function") {
-            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
-            }));
-        }
-        ownKeys.forEach(function(key) {
-            _define_property$$(target, key, source[key]);
-        });
-    }
-    return target;
-}
-function ownKeys$G(object, enumerableOnly) {
-    var keys = Object.keys(object);
-    if (Object.getOwnPropertySymbols) {
-        var symbols = Object.getOwnPropertySymbols(object);
-        keys.push.apply(keys, symbols);
-    }
-    return keys;
-}
-function _object_spread_props$G(target, source) {
-    source = source != null ? source : {};
-    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
-    else {
-        ownKeys$G(Object(source)).forEach(function(key) {
-            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
-        });
-    }
-    return target;
-}
 /**
- * The `drivers.firestoreDriverIdentifier` a client-SDK `FirestoreContext` reports.
- *
- * `clientFirebaseFirestoreContextFactory` stamps this; the server's
- * `googleCloudFirestoreContextFactory` stamps `@google-cloud/firestore` instead. Comparing against
- * it is how {@link inspectCliFirestoreSdkIdentity} tells an admin-SDK context handed to the CLI apart
- * from a genuinely broken client one.
- */ var CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER = '@firebase/firestore';
+ * The `drivers.firestoreDriverIdentifier` a client-SDK `FirestoreContext` reports. See
+ * {@link CLIENT_FIRESTORE_DRIVER_IDENTIFIER}.
+ */ var CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER = CLIENT_FIRESTORE_DRIVER_IDENTIFIER;
 /**
  * The doctor `detail.stage` reported when the session's Firestore handle is not a usable client-SDK
  * `Firestore`.
@@ -1326,54 +1278,43 @@ function _object_spread_props$G(target, source) {
  * `CliError` code for a Firestore handle the client SDK does not recognize as its own.
  */ var FIRESTORE_SDK_INSTANCE_MISMATCH_CODE = 'FIRESTORE_SDK_INSTANCE_MISMATCH';
 /**
- * Checks that a session's Firestore handle is one THIS copy of the client SDK will accept, and
- * reports where every consumer resolved the SDK from.
+ * `CliError` code for a collection/document reference the SDK refused to build for a reason the
+ * wiring identity check cannot explain — a bad `--parent`, or an app collection whose own
+ * construction is broken.
+ */ var FIRESTORE_COLLECTION_UNRESOLVABLE_CODE = 'FIRESTORE_COLLECTION_UNRESOLVABLE';
+/**
+ * The CLI's name in the SDK-identity report and its suggestions.
+ */ var CLI_FIRESTORE_IDENTITY_CONSUMER_NAME = '@dereekb/dbx-cli';
+/**
+ * This package's own module-resolution root.
  *
- * Exists because `collection()` refuses any non-`Firestore` first argument with one message —
- * `Expected first argument to collection() to be a CollectionReference, a DocumentReference or
- * FirebaseFirestore` — that names neither the model, nor the collection, nor which of the three
- * distinct causes ({@link CliFirestoreSdkIdentityProblem}) produced it. Every downstream CLI built on
- * `@dereekb/dbx-cli` shares that hazard, so the diagnosis belongs here rather than in an app.
+ * The duplicated-SDK hypothesis is exactly "do `@dereekb/dbx-cli` and `@dereekb/firebase` see the
+ * same copy of `@firebase/firestore`", so the resolution has to start from HERE — resolving from
+ * `@dereekb/oauth-resource/firebase` would answer a different question.
+ */ var cliRequire = createRequire(import.meta.url);
+/**
+ * The CLI's operator-facing remediation for each problem, replacing the package-level default.
  *
- * The `instanceof` test is the load-bearing one and it is deliberately NOT structural: an identity
- * check across the package boundary is the only thing that can detect a duplicated
- * `@firebase/firestore`, which is exactly what a structural check would hide. (Contrast
- * `firestore.error.ts`, which narrows a thrown `FirebaseError` structurally — there the goal is to
- * classify an error even when copies differ, so the tradeoff runs the other way.)
+ * Each names a step an operator of a `@dereekb/dbx-cli`-built CLI can actually take.
+ */ var CLI_FIRESTORE_SDK_IDENTITY_SUGGESTIONS = {
+    'no-firestore-handle': 'The session produced no Firestore handle, so every collection reference built from it fails. This is a wiring fault, not a rules or App Check fault — re-run with `--verbose` to see the handshake, and verify the CLI resolves ONE `@dereekb/firebase`.',
+    'foreign-firestore-instance': "The session's handle is not an instance of the loaded SDK's `Firestore`, and only one copy of `@firebase/firestore` is installed. The likeliest cause is a STALE CLI artifact running against a newer `@dereekb/*` in `node_modules` — rebuild the CLI, then re-run `doctor`."
+};
+/**
+ * Checks that a session's Firestore handle is one the loaded client SDK will accept, and reports
+ * where every consumer resolved the SDK from.
+ *
+ * The CLI wrapper over {@link inspectFirebaseClientFirestoreIdentity}: it supplies this package's own
+ * `require` as the resolution root and names the CLI in the report, so `doctor`'s output is unchanged
+ * by the move of the inspection core into `@dereekb/oauth-resource/firebase`.
  *
  * @param input - The session's `firestoreContext`, when one was built.
  * @returns The provenance + brand-check report.
  */ function inspectCliFirestoreSdkIdentity(input) {
-    var _input_firestoreContext, _input_firestoreContext_drivers, _input_firestoreContext1;
-    var firestore = (_input_firestoreContext = input.firestoreContext) === null || _input_firestoreContext === void 0 ? void 0 : _input_firestoreContext.firestore;
-    var driverIdentifier = (_input_firestoreContext1 = input.firestoreContext) === null || _input_firestoreContext1 === void 0 ? void 0 : (_input_firestoreContext_drivers = _input_firestoreContext1.drivers) === null || _input_firestoreContext_drivers === void 0 ? void 0 : _input_firestoreContext_drivers.firestoreDriverIdentifier;
-    var firestoreDriverIdentifier = typeof driverIdentifier === 'string' ? driverIdentifier : undefined;
-    var firestorePresent = firestore != null;
-    var firestoreIsSdkInstance = _instanceof$w(firestore, Firestore);
-    var firestoreConstructor = firestoreConstructorName(firestore);
-    var modules = resolveCliFirestoreSdkModules();
-    var sdkDuplicated = modules.sdkFromDbxCli.packageDir != null && modules.sdkFromDbxFirebase.packageDir != null && modules.sdkFromDbxCli.packageDir !== modules.sdkFromDbxFirebase.packageDir;
-    var problem;
-    if (!firestorePresent) {
-        problem = 'no-firestore-handle';
-    } else if (firestoreDriverIdentifier != null && firestoreDriverIdentifier !== CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER) {
-        problem = 'unexpected-driver';
-    } else if (!firestoreIsSdkInstance) {
-        problem = sdkDuplicated ? 'duplicated-firestore-sdk' : 'foreign-firestore-instance';
-    }
-    return _object_spread_props$G(_object_spread$_(_object_spread_props$G(_object_spread$_({
-        ok: problem == null
-    }, problem == null ? {} : {
-        problem: problem
-    }), {
-        firestorePresent: firestorePresent,
-        firestoreIsSdkInstance: firestoreIsSdkInstance
-    }), firestoreConstructor == null ? {} : {
-        firestoreConstructor: firestoreConstructor
-    }, firestoreDriverIdentifier == null ? {} : {
-        firestoreDriverIdentifier: firestoreDriverIdentifier
-    }, modules), {
-        sdkDuplicated: sdkDuplicated
+    return inspectFirebaseClientFirestoreIdentity({
+        firestoreContext: input.firestoreContext,
+        consumerRequire: cliRequire,
+        consumerName: CLI_FIRESTORE_IDENTITY_CONSUMER_NAME
     });
 }
 /**
@@ -1388,32 +1329,8 @@ function _object_spread_props$G(target, source) {
  *
  * @__NO_SIDE_EFFECTS__
  */ function cliFirestoreSdkIdentitySuggestion(report) {
-    var result;
-    switch(report.problem){
-        case 'no-firestore-handle':
-            result = 'The session produced no Firestore handle, so every collection reference built from it fails. This is a wiring fault, not a rules or App Check fault — re-run with `--verbose` to see the handshake, and verify the CLI resolves ONE `@dereekb/firebase`.';
-            break;
-        case 'unexpected-driver':
-            result = 'The `FirestoreContext` reports driver "'.concat(report.firestoreDriverIdentifier, '", not "').concat(CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER, "\". An admin-SDK context reached the client-SDK read path — build the CLI's context with `clientFirebaseFirestoreContextFactory`, not `googleCloudFirestoreContextFactory`.");
-            break;
-        case 'duplicated-firestore-sdk':
-            result = "Two copies of `@firebase/firestore` are loaded — `@dereekb/dbx-cli` resolves ".concat(report.sdkFromDbxCli.packageDir, ", `@dereekb/firebase` resolves ").concat(report.sdkFromDbxFirebase.packageDir, " — so the handle one minted fails the other's brand check. Dedupe the install (`npm ls @firebase/firestore`) and rebuild the CLI.");
-            break;
-        case 'foreign-firestore-instance':
-            var _report_firestoreConstructor;
-            result = "The session's handle (`".concat((_report_firestoreConstructor = report.firestoreConstructor) !== null && _report_firestoreConstructor !== void 0 ? _report_firestoreConstructor : 'unknown', "`) is not an instance of the loaded SDK's `Firestore`, and only one copy of `@firebase/firestore` is installed. The likeliest cause is a STALE CLI artifact running against a newer `@dereekb/*` in `node_modules` — rebuild the CLI, then re-run `doctor`.");
-            break;
-        default:
-            result = undefined;
-            break;
-    }
-    return result;
+    return firebaseClientFirestoreIdentitySuggestion(report, CLI_FIRESTORE_SDK_IDENTITY_SUGGESTIONS, CLI_FIRESTORE_IDENTITY_CONSUMER_NAME);
 }
-/**
- * `CliError` code for a collection/document reference the SDK refused to build for a reason the
- * wiring identity check cannot explain — a bad `--parent`, or an app collection whose own
- * construction is broken.
- */ var FIRESTORE_COLLECTION_UNRESOLVABLE_CODE = 'FIRESTORE_COLLECTION_UNRESOLVABLE';
 /**
  * Re-raises a reference-construction failure as a `CliError` that names WHAT was being built and, when
  * the SDK handle is at fault, WHY.
@@ -1432,7 +1349,7 @@ function _object_spread_props$G(target, source) {
     if (_instanceof$w(error, CliError)) {
         result = error;
     } else {
-        var _cliFirestoreSdkIdentitySuggestion, _report_firestoreDriverIdentifier, _report_sdkFromDbxCli_version, _report_sdkFromDbxCli_packageDir;
+        var _cliFirestoreSdkIdentitySuggestion, _report_firestoreDriverIdentifier, _report_sdkFromConsumer_version, _report_sdkFromConsumer_packageDir;
         var facts = [
             modelType == null ? undefined : 'model "'.concat(modelType, '"'),
             collectionName == null ? undefined : 'collection "'.concat(collectionName, '"'),
@@ -1447,92 +1364,11 @@ function _object_spread_props$G(target, source) {
         result = new CliError({
             message: message,
             code: report.ok ? FIRESTORE_COLLECTION_UNRESOLVABLE_CODE : FIRESTORE_SDK_INSTANCE_MISMATCH_CODE,
-            suggestion: (_cliFirestoreSdkIdentitySuggestion = cliFirestoreSdkIdentitySuggestion(report)) !== null && _cliFirestoreSdkIdentitySuggestion !== void 0 ? _cliFirestoreSdkIdentitySuggestion : 'The Firestore handle itself checked out (driver "'.concat((_report_firestoreDriverIdentifier = report.firestoreDriverIdentifier) !== null && _report_firestoreDriverIdentifier !== void 0 ? _report_firestoreDriverIdentifier : 'unknown', '", @firebase/firestore ').concat((_report_sdkFromDbxCli_version = report.sdkFromDbxCli.version) !== null && _report_sdkFromDbxCli_version !== void 0 ? _report_sdkFromDbxCli_version : 'unknown', " at ").concat((_report_sdkFromDbxCli_packageDir = report.sdkFromDbxCli.packageDir) !== null && _report_sdkFromDbxCli_packageDir !== void 0 ? _report_sdkFromDbxCli_packageDir : 'unknown', "), so the rejected argument is the path, not the SDK. Check the --parent key and the app's collection factory for this model.")
+            suggestion: (_cliFirestoreSdkIdentitySuggestion = cliFirestoreSdkIdentitySuggestion(report)) !== null && _cliFirestoreSdkIdentitySuggestion !== void 0 ? _cliFirestoreSdkIdentitySuggestion : 'The Firestore handle itself checked out (driver "'.concat((_report_firestoreDriverIdentifier = report.firestoreDriverIdentifier) !== null && _report_firestoreDriverIdentifier !== void 0 ? _report_firestoreDriverIdentifier : 'unknown', '", @firebase/firestore ').concat((_report_sdkFromConsumer_version = report.sdkFromConsumer.version) !== null && _report_sdkFromConsumer_version !== void 0 ? _report_sdkFromConsumer_version : 'unknown', " at ").concat((_report_sdkFromConsumer_packageDir = report.sdkFromConsumer.packageDir) !== null && _report_sdkFromConsumer_packageDir !== void 0 ? _report_sdkFromConsumer_packageDir : 'unknown', "), so the rejected argument is the path, not the SDK. Check the --parent key and the app's collection factory for this model.")
         });
     }
     return result;
 }
-/**
- * The handle's constructor name, when it has one.
- *
- * @param firestore - The candidate handle.
- * @returns The constructor name, or `undefined`.
- */ function firestoreConstructorName(firestore) {
-    var _firestore_constructor;
-    var name = firestore == null ? undefined : (_firestore_constructor = firestore.constructor) === null || _firestore_constructor === void 0 ? void 0 : _firestore_constructor.name;
-    return typeof name === 'string' ? name : undefined;
-}
-/**
- * Resolves `@firebase/firestore` from both this package and `@dereekb/firebase`, plus the `firebase`
- * umbrella version.
- *
- * `createRequire` rather than `import.meta.resolve` because the resolution has to be performed
- * relative to ANOTHER package's location (`@dereekb/firebase`'s entry file) to answer the question
- * that matters — whether the two consumers see the same copy.
- *
- * @returns The two module identities and the umbrella version, each degrading to an `error` field
- *   rather than throwing: this runs inside a diagnostic, and a failed resolution is itself a finding.
- */ function resolveCliFirestoreSdkModules() {
-    var requireFromDbxCli = createRequire(import.meta.url);
-    var sdkFromDbxCli = resolveFirestoreSdkIdentity(requireFromDbxCli);
-    var sdkFromDbxFirebase;
-    try {
-        sdkFromDbxFirebase = resolveFirestoreSdkIdentity(createRequire(requireFromDbxCli.resolve('@dereekb/firebase')));
-    } catch (e) {
-        sdkFromDbxFirebase = {
-            error: _instanceof$w(e, Error) ? e.message : String(e)
-        };
-    }
-    var firebaseVersion;
-    try {
-        firebaseVersion = readPackageVersion(requireFromDbxCli, 'firebase/package.json');
-    } catch (unused) {
-        // the umbrella version is context for the report, not a finding on its own
-        firebaseVersion = undefined;
-    }
-    return _object_spread$_({
-        sdkFromDbxCli: sdkFromDbxCli,
-        sdkFromDbxFirebase: sdkFromDbxFirebase
-    }, firebaseVersion == null ? {} : {
-        firebaseVersion: firebaseVersion
-    });
-}
-/**
- * Resolves `@firebase/firestore`'s package directory + version through one `require`.
- *
- * Resolves `package.json` rather than the package entry because the entry differs per export
- * condition (`index.node.cjs.js` vs `index.node.mjs`), which would report two copies where there is
- * one. The `package.json` path is condition-independent, so its directory is a stable identity.
- *
- * @param resolver - The `require` to resolve through.
- * @returns The module identity, with `error` set when resolution failed.
- */ function resolveFirestoreSdkIdentity(resolver) {
-    var result;
-    try {
-        var packageJsonPath = resolver.resolve('@firebase/firestore/package.json');
-        var version = readPackageVersion(resolver, '@firebase/firestore/package.json');
-        result = _object_spread$_({
-            packageDir: dirname(packageJsonPath)
-        }, version == null ? {} : {
-            version: version
-        });
-    } catch (e) {
-        result = {
-            error: _instanceof$w(e, Error) ? e.message : String(e)
-        };
-    }
-    return result;
-}
-/**
- * Reads a resolvable `package.json`'s `version`.
- *
- * @param resolver - The `require` to load through.
- * @param specifier - The `package.json` specifier.
- * @returns The version string, or `undefined` when absent.
- */ function readPackageVersion(resolver, specifier) {
-    var contents = resolver(specifier);
-    return typeof contents.version === 'string' ? contents.version : undefined;
-}
 
 function _array_like_to_array$1a(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
@@ -1542,7 +1378,7 @@ function _array_like_to_array$1a(arr, len) {
 function _array_without_holes$Y(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$1a(arr);
 }
-function asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1553,16 +1389,16 @@ function asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1r(fn) {
+function _async_to_generator$1s(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -1579,7 +1415,7 @@ function _non_iterable_spread$Y() {
 function _to_consumable_array$Y(arr) {
     return _array_without_holes$Y(arr) || _iterable_to_array$Y(arr) || _unsupported_iterable_to_array$1a(arr) || _non_iterable_spread$Y();
 }
-function _ts_generator$1r(thisArg, body) {
+function _ts_generator$1s(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1728,9 +1564,9 @@ function _unsupported_iterable_to_array$1a(o, minLen) {
  * @returns The session-bound {@link CliFirestoreModels}.
  * @throws {CliError} When the CLI was not configured with a `firestore` binding, or the session cannot be opened.
  */ function requireCliFirestoreModels(context) {
-    return _async_to_generator$1r(function() {
+    return _async_to_generator$1s(function() {
         var getFirestoreModels;
-        return _ts_generator$1r(this, function(_state) {
+        return _ts_generator$1s(this, function(_state) {
             getFirestoreModels = context.getFirestoreModels;
             if (!getFirestoreModels) {
                 throw new CliError({
@@ -1891,7 +1727,7 @@ function tryReadCollectionIdentity(binding, collections, modelType) {
     return result;
 }
 
-function asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1902,22 +1738,48 @@ function asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1q(fn) {
+function _async_to_generator$1r(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1q(thisArg, body) {
+function _define_property$$(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _object_spread$_(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$$(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function _ts_generator$1r(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2016,103 +1878,69 @@ function _ts_generator$1q(thisArg, body) {
         };
     }
 }
-function _type_of$6(obj) {
-    "@swc/helpers - typeof";
-    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
-}
 /**
- * Path (relative to the API base URL) of the direct-Firestore session endpoint served by
- * `@dereekb/firebase-server`'s `SessionApiController`.
+ * `CliError` code raised for each {@link FirestoreSessionErrorCode}.
  *
- * Duplicated here rather than imported so `dbx-cli` keeps no dependency on the server package —
- * the same arrangement `CALL_MODEL_API_PATH` uses.
- */ var FIRESTORE_SESSION_API_PATH = "/session/firestore";
+ * The mapping is exhaustive rather than defaulted so a new generic code is a compile error here
+ * instead of a silent `API_ERROR` in the operator's output.
+ */ var CLI_FIRESTORE_SESSION_ERROR_CODES = {
+    unauthorized: 'AUTH_UNAUTHORIZED',
+    forbidden: 'AUTH_FORBIDDEN',
+    not_found: 'NOT_FOUND',
+    unavailable: 'SERVER_ERROR',
+    invalid_response: 'API_ERROR',
+    invalid_config: 'INVALID_ARGUMENT'
+};
+/**
+ * Maps a generic session failure onto a {@link CliError}, re-attaching the CLI-flavored remediation
+ * an operator can act on (`<cli> auth login --env <env>` and friends).
+ *
+ * @param input - The generic failure.
+ * @returns The `CliError` to throw.
+ */ var cliFirestoreSessionErrorFactory = function cliFirestoreSessionErrorFactory(input) {
+    // the 401/403 text is CLI-specific — it names the command an operator runs to fix it, which the
+    // package-level wording deliberately cannot
+    var suggestion = input.code === 'unauthorized' || input.code === 'forbidden' ? 'The direct-Firestore session endpoint is admin-only and requires the `session.firestore` scope. Run `<cli> auth login` with that scope as an admin user.' : input.suggestion;
+    return new CliError(_object_spread$_({
+        message: input.message,
+        code: CLI_FIRESTORE_SESSION_ERROR_CODES[input.code]
+    }, suggestion == null ? {} : {
+        suggestion: suggestion
+    }));
+};
 /**
  * Fetches a direct-Firestore session from the API with the cached Bearer access token.
  *
- * The endpoint is admin-only and additionally gated on the `session.firestore` OIDC scope, so a 403
- * here usually means the logged-in user is not an admin or logged in without that scope.
+ * The thin CLI wrapper over `@dereekb/oauth-resource/firebase`'s `fetchFirestoreSession`: it binds
+ * the CLI's `tracedFetch` (so `--verbose` and `--timeout` apply) and the `CliError` factory.
  *
  * @param input - The API target, access token, and optional fetch override.
  * @returns The parsed {@link CliFirestoreSession}.
  * @throws {CliError} When the endpoint answers non-2xx or returns an unusable body.
  */ function fetchFirestoreSession(input) {
-    return _async_to_generator$1q(function() {
-        var url, res, text, body, session;
-        return _ts_generator$1q(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    url = "".concat(trimSlash(input.apiBaseUrl)).concat(FIRESTORE_SESSION_API_PATH);
-                    return [
-                        4,
-                        tracedFetch(input.fetcher, url, {
-                            method: 'GET',
-                            headers: {
-                                Accept: 'application/json',
-                                Authorization: "Bearer ".concat(input.accessToken)
-                            }
-                        })
-                    ];
-                case 1:
-                    res = _state.sent();
-                    return [
-                        4,
-                        res.text()
-                    ];
-                case 2:
-                    text = _state.sent();
-                    if (text.length > 0) {
-                        try {
-                            body = JSON.parse(text);
-                        } catch (unused) {
-                            body = text;
-                        }
-                    }
-                    if (!res.ok) {
-                        throw new CliError({
-                            message: "firestore session request failed: ".concat(extractMessage(body, text, res)),
-                            code: codeForStatus(res.status),
-                            suggestion: res.status === 401 || res.status === 403 ? 'The direct-Firestore session endpoint is admin-only and requires the `session.firestore` scope. Run `<cli> auth login` with that scope as an admin user.' : 'Verify the API exposes `/session/firestore` (the firebase-server session module must be registered and `/api/session` added to the OIDC `protectedPaths`).'
-                        });
-                    }
-                    session = body;
-                    if (!(session === null || session === void 0 ? void 0 : session.customToken)) {
-                        throw new CliError({
-                            message: 'firestore session response did not include a customToken.',
-                            code: 'API_ERROR',
-                            suggestion: 'Verify the API is running a `@dereekb/firebase-server` version that serves `/session/firestore`.'
-                        });
-                    }
-                    return [
-                        2,
-                        session
-                    ];
-            }
+    return _async_to_generator$1r(function() {
+        return _ts_generator$1r(this, function(_state) {
+            return [
+                2,
+                fetchFirestoreSession$1({
+                    apiBaseUrl: input.apiBaseUrl,
+                    accessToken: input.accessToken,
+                    fetcher: cliFirestoreSessionFetcher(input.fetcher),
+                    errorFactory: cliFirestoreSessionErrorFactory
+                })
+            ];
         });
     })();
 }
-function extractMessage(body, fallback, res) {
-    var bodyMessage = (typeof body === "undefined" ? "undefined" : _type_of$6(body)) === 'object' && body && 'message' in body ? body.message : undefined;
-    var messageString = typeof bodyMessage === 'string' ? bodyMessage : undefined;
-    return messageString !== null && messageString !== void 0 ? messageString : fallback || "".concat(res.status, " ").concat(res.statusText);
-}
-function codeForStatus(status) {
-    var result;
-    if (status === 401) {
-        result = 'AUTH_UNAUTHORIZED';
-    } else if (status === 403) {
-        result = 'AUTH_FORBIDDEN';
-    } else if (status === 404) {
-        result = 'NOT_FOUND';
-    } else if (status >= 500) {
-        result = 'SERVER_ERROR';
-    } else {
-        result = 'API_ERROR';
-    }
-    return result;
-}
-function trimSlash(url) {
-    return url.endsWith('/') ? url.slice(0, -1) : url;
+/**
+ * Binds the CLI's verbose-trace + `--timeout` fetch behavior onto the supplied (or global) fetch.
+ *
+ * @param fetcher - The underlying fetch impl, when one was injected.
+ * @returns A `fetch`-shaped function carrying the CLI's tracing.
+ */ function cliFirestoreSessionFetcher(fetcher) {
+    return function(input, init) {
+        return tracedFetch(fetcher, input, init);
+    };
 }
 
 function _define_property$_(obj, key, value) {
@@ -2176,7 +2004,12 @@ function _object_spread_props$F(target, source) {
 /**
  * The default redirect URI used by the CLI.
  *
- * Opens up to nothing in the browser so the user can copy/paste the resulting token url back into the CLI.
+ * The `0` port is a placeholder, not a bindable port: the redirect resolves to nothing in the
+ * browser and the user copy/pastes the resulting URL back into the CLI.
+ *
+ * To have `auth login` capture the redirect automatically instead, configure a redirect URI with a
+ * concrete loopback port (e.g. `http://127.0.0.1:8976/callback`) and register that exact URI with
+ * the OAuth client — `auth login` binds it and reads the code straight out of the browser redirect.
  */ var DEFAULT_CLI_REDIRECT_URI = 'http://127.0.0.1:0/callback';
 /**
  * The generic OIDC scopes a `--service-token` login adds to the requested set.
@@ -2264,15 +2097,16 @@ function _object_spread_props$F(target, source) {
     var d = input.defaultEnv;
     var result;
     if (e || d) {
-        var _ref, _nonEmpty, _ref1, _nonEmpty1, _nonEmpty2, _nonEmpty3, _nonEmpty4, _nonEmpty5, _nonEmpty6;
+        var _ref, _nonEmpty, _ref1, _nonEmpty1, _nonEmpty2, _nonEmpty3, _nonEmpty4, _nonEmpty5, _nonEmpty6, _nonEmpty7;
         result = {
             apiBaseUrl: (_ref = (_nonEmpty = nonEmpty(e === null || e === void 0 ? void 0 : e.apiBaseUrl)) !== null && _nonEmpty !== void 0 ? _nonEmpty : nonEmpty(d === null || d === void 0 ? void 0 : d.apiBaseUrl)) !== null && _ref !== void 0 ? _ref : '',
             oidcIssuer: (_ref1 = (_nonEmpty1 = nonEmpty(e === null || e === void 0 ? void 0 : e.oidcIssuer)) !== null && _nonEmpty1 !== void 0 ? _nonEmpty1 : nonEmpty(d === null || d === void 0 ? void 0 : d.oidcIssuer)) !== null && _ref1 !== void 0 ? _ref1 : '',
             appClientUrl: (_nonEmpty2 = nonEmpty(e === null || e === void 0 ? void 0 : e.appClientUrl)) !== null && _nonEmpty2 !== void 0 ? _nonEmpty2 : nonEmpty(d === null || d === void 0 ? void 0 : d.appClientUrl),
             clientId: (_nonEmpty3 = nonEmpty(e === null || e === void 0 ? void 0 : e.clientId)) !== null && _nonEmpty3 !== void 0 ? _nonEmpty3 : nonEmpty(d === null || d === void 0 ? void 0 : d.clientId),
             clientSecret: (_nonEmpty4 = nonEmpty(e === null || e === void 0 ? void 0 : e.clientSecret)) !== null && _nonEmpty4 !== void 0 ? _nonEmpty4 : nonEmpty(d === null || d === void 0 ? void 0 : d.clientSecret),
-            redirectUri: (_nonEmpty5 = nonEmpty(e === null || e === void 0 ? void 0 : e.redirectUri)) !== null && _nonEmpty5 !== void 0 ? _nonEmpty5 : nonEmpty(d === null || d === void 0 ? void 0 : d.redirectUri),
-            scopes: (_nonEmpty6 = nonEmpty(e === null || e === void 0 ? void 0 : e.scopes)) !== null && _nonEmpty6 !== void 0 ? _nonEmpty6 : nonEmpty(d === null || d === void 0 ? void 0 : d.scopes),
+            tokenEndpointAuthMethod: (_nonEmpty5 = nonEmpty(e === null || e === void 0 ? void 0 : e.tokenEndpointAuthMethod)) !== null && _nonEmpty5 !== void 0 ? _nonEmpty5 : nonEmpty(d === null || d === void 0 ? void 0 : d.tokenEndpointAuthMethod),
+            redirectUri: (_nonEmpty6 = nonEmpty(e === null || e === void 0 ? void 0 : e.redirectUri)) !== null && _nonEmpty6 !== void 0 ? _nonEmpty6 : nonEmpty(d === null || d === void 0 ? void 0 : d.redirectUri),
+            scopes: (_nonEmpty7 = nonEmpty(e === null || e === void 0 ? void 0 : e.scopes)) !== null && _nonEmpty7 !== void 0 ? _nonEmpty7 : nonEmpty(d === null || d === void 0 ? void 0 : d.scopes),
             firebase: mergeCliFirebaseConfig(e === null || e === void 0 ? void 0 : e.firebase, d === null || d === void 0 ? void 0 : d.firebase)
         };
     }
@@ -2319,8 +2153,8 @@ function nonEmpty(value) {
 }
 /**
  * Default host used for Firebase emulator connections when a {@link CliFirebaseEmulatorsConfig}
- * omits one.
- */ var DEFAULT_CLI_FIREBASE_EMULATOR_HOST = 'localhost';
+ * omits one. See {@link DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST}.
+ */ var DEFAULT_CLI_FIREBASE_EMULATOR_HOST = DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST;
 /**
  * Returns true when the env carries the minimum Firebase client config needed to open a direct
  * Firestore session.
@@ -2328,20 +2162,12 @@ function nonEmpty(value) {
  * Deliberately separate from {@link isCliEnvConfigComplete}: the Firebase config is optional, and
  * folding it into the general completeness check would break every CLI that only uses the model API.
  *
- * @param firebase - The env's Firebase client config, if any.
- * @returns `true` when `apiKey`, `projectId`, and `appId` are all present and non-empty.
- */ function isCliFirebaseConfigComplete(firebase) {
-    return Boolean((firebase === null || firebase === void 0 ? void 0 : firebase.apiKey) && (firebase === null || firebase === void 0 ? void 0 : firebase.projectId) && (firebase === null || firebase === void 0 ? void 0 : firebase.appId));
-}
+ * See {@link isFirebaseClientConfigComplete}.
+ */ var isCliFirebaseConfigComplete = isFirebaseClientConfigComplete;
 /**
- * Returns true when the env's emulator config is present and active.
- *
- * @param firebase - The env's Firebase client config, if any.
- * @returns `true` when emulators are configured and not explicitly disabled.
- */ function cliFirebaseEmulatorsInUse(firebase) {
-    var emulators = firebase === null || firebase === void 0 ? void 0 : firebase.emulators;
-    return Boolean(emulators && emulators.useEmulators !== false && (emulators.authPort != null || emulators.firestorePort != null));
-}
+ * Returns true when the env's emulator config is present and active. See
+ * {@link firebaseClientEmulatorsInUse}.
+ */ var cliFirebaseEmulatorsInUse = firebaseClientEmulatorsInUse;
 /**
  * Resolves the active env name from a flag, env var, or persisted default.
  *
@@ -2418,10 +2244,15 @@ function parsePort(value) {
 /**
  * Returns true when the env has the minimum fields needed to attempt an OAuth login or token refresh.
  *
+ * `clientSecret` is NOT among them. A CLI is a public client in the usual case
+ * (`token_endpoint_auth_method: 'none'`), authenticating with PKCE rather than a secret, so requiring
+ * one here would report a correctly-configured public env as incomplete — and send the caller back to
+ * `auth setup` to supply a credential the provider would then reject.
+ *
  * @param env - The env config to check.
- * @returns `true` when `apiBaseUrl`, `oidcIssuer`, `clientId`, `clientSecret`, and `redirectUri` are all present and non-empty.
+ * @returns `true` when `apiBaseUrl`, `oidcIssuer`, `clientId`, and `redirectUri` are all present and non-empty.
  */ function isCliEnvConfigComplete(env) {
-    return Boolean((env === null || env === void 0 ? void 0 : env.apiBaseUrl) && (env === null || env === void 0 ? void 0 : env.oidcIssuer) && (env === null || env === void 0 ? void 0 : env.clientId) && (env === null || env === void 0 ? void 0 : env.clientSecret) && (env === null || env === void 0 ? void 0 : env.redirectUri));
+    return Boolean((env === null || env === void 0 ? void 0 : env.apiBaseUrl) && (env === null || env === void 0 ? void 0 : env.oidcIssuer) && (env === null || env === void 0 ? void 0 : env.clientId) && (env === null || env === void 0 ? void 0 : env.redirectUri));
 }
 /**
  * Reads an OAuth token entry from environment variables, for non-interactive server consumption.
@@ -2460,66 +2291,7 @@ function parsePort(value) {
     return result;
 }
 
-/**
- * Hard ceiling on how long a minted direct-Firestore session may be reused, regardless of what the
- * API reported in `expiresAt`.
- *
- * One hour, because that is the Firebase ceiling the credentials themselves sit under: a custom
- * token is exchangeable for one hour, and the ID token it mints lives one hour. Holding a session
- * past that buys nothing — the sign-in would fail — and re-minting is one HTTP round-trip.
- */ var CLI_FIRESTORE_SESSION_MAX_CACHE_MS = 60 * 60 * 1000;
-/**
- * Default skew/latency buffer applied when deciding whether a cached session is still usable.
- */ var CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS = 60000;
-/**
- * Creates a per-env direct-Firestore session cache store backed by a single JSON file.
- *
- * Entries are written with mode 0o600 — they hold a Firebase custom token, which is a bearer
- * credential for the user it was minted for.
- *
- * @param input - The cache store inputs.
- * @param input.firestoreSessionCachePath - Absolute path to the JSON file backing the cache.
- * @returns A {@link CliFirestoreSessionCacheStore} keyed by env name.
- * @__NO_SIDE_EFFECTS__
- */ function createCliFirestoreSessionCacheStore(input) {
-    return createMemoizedJsonFileAsyncKeyedValueCache({
-        filePath: input.firestoreSessionCachePath
-    });
-}
-/**
- * Resolves the epoch-millis instant at which a cached session stops being usable.
- *
- * The effective expiry is the EARLIER of the API-reported `expiresAt` and
- * {@link CLI_FIRESTORE_SESSION_MAX_CACHE_MS} past the write. Taking the earlier of the two means a
- * server that reports an over-long (or unparsable) window still cannot push a session past the
- * Firebase credential ceiling.
- *
- * @param entry - The cached entry.
- * @returns The effective expiry in unix epoch milliseconds.
- *
- * @__NO_SIDE_EFFECTS__
- */ function cliFirestoreSessionEntryExpiresAt(entry) {
-    var ceiling = entry.cachedAt + CLI_FIRESTORE_SESSION_MAX_CACHE_MS;
-    var reported = Date.parse(entry.session.expiresAt);
-    return Number.isFinite(reported) ? Math.min(reported, ceiling) : ceiling;
-}
-/**
- * Returns true when the cached session is at or near its effective expiry.
- *
- * @param entry - The cached entry (`null`/`undefined` is treated as expired).
- * @param nowMs - The current time in unix epoch milliseconds. Defaults to `Date.now()`.
- * @param bufferMs - Skew/latency buffer; the entry is treated as expired this far ahead of its effective expiry.
- * @returns `true` when the entry is unusable, otherwise `false`.
- */ function isCliFirestoreSessionExpired(entry) {
-    var nowMs = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : Date.now(), bufferMs = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS;
-    return entry == null || expirationDetails({
-        expiresFromDate: cliFirestoreSessionEntryExpiresAt(entry),
-        expiresIn: -bufferMs,
-        now: new Date(nowMs)
-    }).hasExpired();
-}
-
-function asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2530,16 +2302,16 @@ function asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1p(fn) {
+function _async_to_generator$1q(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -2556,12 +2328,6 @@ function _define_property$Z(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$v(left, right) {
-    "@swc/helpers - instanceof";
-    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
-        return !!right[Symbol.hasInstance](left);
-    } else return left instanceof right;
-}
 function _object_spread$Y(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
@@ -2595,7 +2361,7 @@ function _object_spread_props$E(target, source) {
     }
     return target;
 }
-function _ts_generator$1p(thisArg, body) {
+function _ts_generator$1q(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2694,40 +2460,15 @@ function _ts_generator$1p(thisArg, body) {
         };
     }
 }
-/**
- * The Firebase app name a direct-Firestore session registers for a CLI + env pair.
- *
- * Deriving the name rather than tracking apps in a side registry is what makes ONE app per CLI + env
- * per process a property of the code instead of a convention: {@link createCliFirestoreSessionContext}
- * looks this name up in `getApps()` before initializing, so repeated session opens in one process —
- * a doctor probe alongside a command's own session, an action that re-resolves the accessor — all
- * share a single app, and {@link closeAllCliFirebaseApps} finds it again from the name alone.
- *
- * @param input - The CLI name and env name the session targets.
- * @returns The Firebase app name for that pair.
- * @__NO_SIDE_EFFECTS__
- */ function cliFirebaseAppName(input) {
-    return "".concat(input.cliName, "-").concat(input.envName);
-}
 /**
  * Opens a direct Firestore connection as the authenticated CLI user.
  *
- * Steps, in a strict order:
- *
- * 0. When a `sessionCache` is supplied, reuse the env's cached credential envelope if it is still
- *    live. Sessions are cached for up to an hour (see `CLI_FIRESTORE_SESSION_MAX_CACHE_MS`), which is
- *    the ceiling the Firebase credentials themselves sit under. A hit skips step 1 only — the
- *    Firebase app is per-process, so the sign-in in step 5 always runs.
- * 1. `GET <apiBaseUrl>/session/firestore` for a custom token + App Check attestation.
- * 2. `initializeApp` with the env's Firebase client config.
- * 3. `initializeAppCheck` with a `CustomProvider` handing back the server-minted token. **This must
- *    happen before any other Firebase call** — `dbx-firebase`'s provider documents the same
- *    constraint: "App Check must be initialized before any Firebase request goes out, otherwise
- *    requests are sent without an App Check token and are rejected in production." Skipped when the
- *    env targets emulators (which do not verify attestations) or when the API minted no token.
- * 4. `getAuth` / `getFirestore`, connecting each to its emulator when configured.
- * 5. `signInWithCustomToken`. The user's stored custom claims land at the top level of the exchanged
- *    ID token, so `request.auth.token.<claim>` reads in security rules behave exactly as in the app.
+ * A thin wrapper over `openFirebaseUserSession`: it validates the env's Firebase client config with
+ * the CLI's own env-var-naming remediation, then delegates. The strict step ORDER (mint → fresh app →
+ * App Check FIRST → emulator wiring → sign-in) and its reasoning live with the implementation.
+ *
+ * The session's Firebase app is named `<cliName>::<envName>::<uid>`, so
+ * {@link closeAllCliFirebaseApps} finds every app this CLI opened from the name alone.
  *
  * There is deliberately NO fallback to the HTTP model API — a failure here throws so the operator
  * sees it. `createFirestoreSessionDoctorCheck` is the diagnostic surface for why.
@@ -2736,9 +2477,9 @@ function _ts_generator$1p(thisArg, body) {
  * @returns The live {@link CliFirestoreSessionContext}.
  * @throws {CliError} When the env lacks Firebase client config, or any step of the handshake fails.
  */ function createCliFirestoreSessionContext(input) {
-    return _async_to_generator$1p(function() {
-        var _ref, _getApps_find, _firebase_emulators, _firebase_emulators1, _firebase_emulators2, cliName, envName, env, accessToken, fetcher, sessionCache, _input_refreshSession, refreshSession, firebase, cached, _tmp, liveCached, fromCache, session, _tmp1, appName, app, useEmulators, appCheckToken, expireTimeMillis, emulatorHost, auth, firestore, e;
-        return _ts_generator$1p(this, function(_state) {
+    return _async_to_generator$1q(function() {
+        var cliName, envName, env, accessToken, fetcher, sessionCache, _input_refreshSession, refreshSession, firebase, session;
+        return _ts_generator$1q(this, function(_state) {
             switch(_state.label){
                 case 0:
                     cliName = input.cliName, envName = input.envName, env = input.env, accessToken = input.accessToken, fetcher = input.fetcher, sessionCache = input.sessionCache, _input_refreshSession = input.refreshSession, refreshSession = _input_refreshSession === void 0 ? false : _input_refreshSession;
@@ -2750,168 +2491,30 @@ function _ts_generator$1p(thisArg, body) {
                             suggestion: "Set `firebase.apiKey`, `firebase.projectId`, and `firebase.appId` on the env (or via ".concat(cliName.replaceAll('-', '_').toUpperCase(), "_FIREBASE_* environment variables). Copy them from the app's Firebase web app config.")
                         });
                     }
-                    if (!(sessionCache && !refreshSession)) return [
-                        3,
-                        2
-                    ];
                     return [
                         4,
-                        sessionCache.get(envName)
-                    ];
-                case 1:
-                    _tmp = _state.sent();
-                    return [
-                        3,
-                        3
-                    ];
-                case 2:
-                    _tmp = undefined;
-                    _state.label = 3;
-                case 3:
-                    cached = _tmp;
-                    liveCached = isCliFirestoreSessionExpired(cached) ? undefined : cached;
-                    fromCache = liveCached != null;
-                    if (!((_ref = liveCached === null || liveCached === void 0 ? void 0 : liveCached.session) !== null && _ref !== void 0)) return [
-                        3,
-                        4
-                    ];
-                    _tmp1 = _ref;
-                    return [
-                        3,
-                        6
-                    ];
-                case 4:
-                    return [
-                        4,
-                        fetchFirestoreSession({
+                        openFirebaseUserSession({
+                            namespace: cliName,
+                            scope: envName,
+                            firebase: firebase,
                             apiBaseUrl: env.apiBaseUrl,
                             accessToken: accessToken,
-                            fetcher: fetcher
-                        })
-                    ];
-                case 5:
-                    _tmp1 = _state.sent();
-                    _state.label = 6;
-                case 6:
-                    session = _tmp1;
-                    if (!(!fromCache && sessionCache)) return [
-                        3,
-                        8
-                    ];
-                    return [
-                        4,
-                        sessionCache.set(envName, {
-                            session: session,
-                            cachedAt: Date.now(),
-                            uid: session.uid
+                            fetcher: cliFirestoreSessionFetcher(fetcher),
+                            errorFactory: cliFirestoreSessionErrorFactory,
+                            // the CLI's cache is keyed by ENV name, not uid: one CLI process serves one user, and the env is
+                            // what its on-disk `~/.<cli>/.firestore-sessions.json` has always been keyed by
+                            credentialsCache: sessionCache,
+                            cacheKey: envName,
+                            refreshCredentials: refreshSession
                         })
                     ];
-                case 7:
-                    _state.sent();
-                    _state.label = 8;
-                case 8:
-                    appName = cliFirebaseAppName({
-                        cliName: cliName,
-                        envName: envName
-                    });
-                    app = (_getApps_find = getApps().find(function(x) {
-                        return x.name === appName;
-                    })) !== null && _getApps_find !== void 0 ? _getApps_find : initializeApp({
-                        apiKey: firebase.apiKey,
-                        authDomain: firebase.authDomain,
-                        projectId: firebase.projectId,
-                        appId: firebase.appId
-                    }, appName);
-                    useEmulators = cliFirebaseEmulatorsInUse(firebase);
-                    // App Check must be registered on the app before any Firebase request goes out. Mirrors
-                    // `createDbxFirebaseAppCheck`, which likewise disables App Check whenever emulators are in use.
-                    if (session.appCheckToken && !useEmulators) {
-                        appCheckToken = session.appCheckToken;
-                        expireTimeMillis = expireTimeMillisFromSession(session);
-                        initializeAppCheck(app, {
-                            provider: new CustomProvider({
-                                getToken: function getToken() {
-                                    return _async_to_generator$1p(function() {
-                                        return _ts_generator$1p(this, function(_state) {
-                                            return [
-                                                2,
-                                                {
-                                                    token: appCheckToken,
-                                                    expireTimeMillis: expireTimeMillis
-                                                }
-                                            ];
-                                        });
-                                    })();
-                                }
-                            }),
-                            // the token is minted per-session by the API; there is no local attestation to refresh against
-                            isTokenAutoRefreshEnabled: false
-                        });
-                    }
-                    emulatorHost = ((_firebase_emulators = firebase.emulators) === null || _firebase_emulators === void 0 ? void 0 : _firebase_emulators.host) || DEFAULT_CLI_FIREBASE_EMULATOR_HOST;
-                    auth = getAuth(app);
-                    if (useEmulators && ((_firebase_emulators1 = firebase.emulators) === null || _firebase_emulators1 === void 0 ? void 0 : _firebase_emulators1.authPort) != null) {
-                        connectAuthEmulator(auth, "http://".concat(emulatorHost, ":").concat(firebase.emulators.authPort), {
-                            disableWarnings: true
-                        });
-                    }
-                    firestore = getFirestore(app);
-                    if (useEmulators && ((_firebase_emulators2 = firebase.emulators) === null || _firebase_emulators2 === void 0 ? void 0 : _firebase_emulators2.firestorePort) != null) {
-                        connectFirestoreEmulator(firestore, emulatorHost, firebase.emulators.firestorePort);
-                    }
-                    _state.label = 9;
-                case 9:
-                    _state.trys.push([
-                        9,
-                        11,
-                        ,
-                        14
-                    ]);
-                    return [
-                        4,
-                        signInWithCustomToken(auth, session.customToken)
-                    ];
-                case 10:
-                    _state.sent();
-                    return [
-                        3,
-                        14
-                    ];
-                case 11:
-                    e = _state.sent();
-                    if (!(fromCache && sessionCache)) return [
-                        3,
-                        13
-                    ];
-                    return [
-                        4,
-                        sessionCache.remove(envName)
-                    ];
-                case 12:
-                    _state.sent();
-                    return [
-                        2,
-                        createCliFirestoreSessionContext(_object_spread_props$E(_object_spread$Y({}, input), {
-                            refreshSession: true
-                        }))
-                    ];
-                case 13:
-                    throw new CliError({
-                        message: "Failed to sign in with the minted custom token: ".concat(_instanceof$v(e, Error) ? e.message : String(e)),
-                        code: 'AUTH_UNAUTHORIZED',
-                        suggestion: 'Verify the env `firebase.projectId`/`firebase.apiKey` match the project the API mints tokens for.'
-                    });
-                case 14:
+                case 1:
+                    session = _state.sent();
                     return [
                         2,
-                        {
-                            session: session,
-                            fromCache: fromCache,
-                            app: app,
-                            auth: auth,
-                            firestore: firestore,
-                            firestoreContext: clientFirebaseFirestoreContextFactory(firestore)
-                        }
+                        _object_spread_props$E(_object_spread$Y({}, session), {
+                            session: session.credentials
+                        })
                     ];
             }
         });
@@ -2922,67 +2525,20 @@ function _ts_generator$1p(thisArg, body) {
  *
  * Required for the CLI to EXIT. A signed-in `Auth` and a live `Firestore` both hold open handles
  * that keep the Node event loop alive indefinitely, so without this a command prints its result and
- * then hangs forever — the process never returns to the shell. Nothing in the CLI is long-lived
- * enough to want that: a session is opened for one invocation and is dead weight afterwards.
- *
- * `deleteApp` is the single call that covers it — it disposes every registered component, which for
- * Firestore runs the same shutdown `terminate()` does, and for Auth stops the token-refresh timer.
- *
- * Deliberately tolerant: teardown runs in a `finally` after the command has already produced its
- * output, so a failure here must not change the exit code or mask the real result. A session that
- * was never opened is a no-op.
+ * then hangs forever — the process never returns to the shell.
  *
  * @param session - The session context to close.
  */ function closeCliFirestoreSessionContext(session) {
-    return _async_to_generator$1p(function() {
-        return _ts_generator$1p(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    return [
-                        4,
-                        closeCliFirebaseApp(session.app)
-                    ];
-                case 1:
-                    _state.sent();
-                    return [
-                        2
-                    ];
-            }
-        });
-    })();
-}
-/**
- * Deletes one Firebase app, swallowing any failure.
- *
- * @param app - The app to delete.
- */ function closeCliFirebaseApp(app) {
-    return _async_to_generator$1p(function() {
-        return _ts_generator$1p(this, function(_state) {
+    return _async_to_generator$1q(function() {
+        return _ts_generator$1q(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    _state.trys.push([
-                        0,
-                        2,
-                        ,
-                        3
-                    ]);
                     return [
                         4,
-                        deleteApp(app)
+                        closeFirebaseUserSession(session)
                     ];
                 case 1:
                     _state.sent();
-                    return [
-                        3,
-                        3
-                    ];
-                case 2:
-                    _state.sent();
-                    return [
-                        3,
-                        3
-                    ];
-                case 3:
                     return [
                         2
                     ];
@@ -2993,43 +2549,29 @@ function _ts_generator$1p(thisArg, body) {
 /**
  * Deletes every still-live Firebase app this CLI opened, whether or not a session was handed back.
  *
- * The CLI's last line of defence against a hang. `closeCliFirestoreSessionContext` covers the normal
- * path, but it needs a session to be handed to it, and three cases never produce one:
+ * The CLI's last line of defence against a hang. {@link closeCliFirestoreSessionContext} covers the
+ * normal path, but it needs a session to be handed to it, and three cases never produce one:
  *
- * - a handshake that fails AFTER `initializeApp` — a rejected custom token, a failed App Check
- *   registration — throws, so the caller that catches it has an initialized app and no session;
+ * - a handshake that fails AFTER `initializeApp` — a failed App Check registration, a broken emulator
+ *   connection — throws, so the caller that catches it has an initialized app and no session;
  * - a caller that opens its own session outside the context memo (the doctor probe) owns its own
  *   teardown, and forgetting it hangs the process;
  * - a {@link CliContext} orphaned mid-invocation carries the only reference to its session memo.
  *
- * Each leaves an app whose `Firestore` and signed-in `Auth` hold the Node event loop open forever.
- * `getApps()` already tracks every live app and `deleteApp` removes it from that list, so the app
- * names {@link cliFirebaseAppName} derives are enough to find them again — no side registry to keep
- * in sync, and idempotent by construction.
- *
- * Tolerant of failures for the same reason {@link closeCliFirestoreSessionContext} is: it runs after
- * the result is already on stdout.
- *
  * @param input - The function inputs.
  * @param input.cliName - The CLI whose apps should be closed. Apps belonging to other Firebase
  *   consumers in the same process are left alone.
  * @returns Resolves once every matching app has been deleted.
  */ function closeAllCliFirebaseApps(input) {
-    return _async_to_generator$1p(function() {
-        var prefix, apps;
-        return _ts_generator$1p(this, function(_state) {
+    return _async_to_generator$1q(function() {
+        return _ts_generator$1q(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    // every env this process opened a session for, which is normally exactly one
-                    prefix = "".concat(input.cliName, "-");
-                    apps = getApps().filter(function(x) {
-                        return x.name.startsWith(prefix);
-                    });
                     return [
                         4,
-                        Promise.all(apps.map(function(app) {
-                            return closeCliFirebaseApp(app);
-                        }))
+                        closeFirebaseUserSessionApps({
+                            namespace: input.cliName
+                        })
                     ];
                 case 1:
                     _state.sent();
@@ -3040,16 +2582,6 @@ function _ts_generator$1p(thisArg, body) {
         });
     })();
 }
-/**
- * Resolves the App Check token's expiry from the session envelope, falling back to a short window
- * when the API returned an unparsable `expiresAt`.
- *
- * @param session - The session envelope returned by the API.
- * @returns The epoch-millis expiry to advertise to the App Check `CustomProvider`.
- */ function expireTimeMillisFromSession(session) {
-    var parsed = Date.parse(session.expiresAt);
-    return Number.isFinite(parsed) ? parsed : Date.now() + 30 * 60 * 1000;
-}
 
 /**
  * Creates a typed module-level slot.
@@ -3090,7 +2622,7 @@ function _ts_generator$1p(thisArg, body) {
     };
 }
 
-function asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3101,22 +2633,22 @@ function asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1o(fn) {
+function _async_to_generator$1p(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1o(thisArg, body) {
+function _ts_generator$1p(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3228,9 +2760,9 @@ function _ts_generator$1o(thisArg, body) {
  * @returns The opened (and memoized) direct-Firestore session.
  * @throws {CliError} When the context does not support direct-Firestore sessions.
  */ function requireCliFirestoreSession(context) {
-    return _async_to_generator$1o(function() {
+    return _async_to_generator$1p(function() {
         var getFirestoreSession;
-        return _ts_generator$1o(this, function(_state) {
+        return _ts_generator$1p(this, function(_state) {
             getFirestoreSession = context.getFirestoreSession;
             if (!getFirestoreSession) {
                 throw new CliError({
@@ -3257,8 +2789,8 @@ function _ts_generator$1o(thisArg, body) {
  * @returns The client `FirestoreContext` an app's collections factory consumes.
  * @throws {CliError} When the context does not support direct-Firestore sessions.
  */ function requireCliFirestoreContext(context) {
-    return _async_to_generator$1o(function() {
-        return _ts_generator$1o(this, function(_state) {
+    return _async_to_generator$1p(function() {
+        return _ts_generator$1p(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -3355,9 +2887,9 @@ var getCliContext = _cliContextSlot.get;
         return getFirestoreModelsForBinding(firestore);
     };
     function closeFirestoreSession() {
-        return _async_to_generator$1o(function() {
+        return _async_to_generator$1p(function() {
             var opened, session;
-            return _ts_generator$1o(this, function(_state) {
+            return _ts_generator$1p(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         opened = firestoreSession;
@@ -3436,7 +2968,7 @@ var getCliContext = _cliContextSlot.get;
     };
 }
 
-function asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3447,22 +2979,22 @@ function asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1n(fn) {
+function _async_to_generator$1o(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1n(thisArg, body) {
+function _ts_generator$1o(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3575,9 +3107,9 @@ function _ts_generator$1n(thisArg, body) {
  */ function wrapCommandHandler(handler) {
     var exitCode = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : CLI_EXIT_CODE_HANDLER;
     return function(argv) {
-        return _async_to_generator$1n(function() {
+        return _async_to_generator$1o(function() {
             var e;
-            return _ts_generator$1n(this, function(_state) {
+            return _ts_generator$1o(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         _state.trys.push([
@@ -3638,7 +3170,7 @@ function _ts_generator$1n(thisArg, body) {
     };
 }
 
-function asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3649,22 +3181,22 @@ function asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1m(fn) {
+function _async_to_generator$1n(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1m(thisArg, body) {
+function _ts_generator$1n(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3784,9 +3316,9 @@ function _ts_generator$1m(thisArg, body) {
             return spec.helpEpilogue ? built.epilogue(spec.helpEpilogue) : built;
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1m(function() {
+            return _async_to_generator$1n(function() {
                 var context, result;
-                return _ts_generator$1m(this, function(_state) {
+                return _ts_generator$1n(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             context = requireCliContext();
@@ -4010,7 +3542,7 @@ function _array_with_holes$o(arr) {
 function _array_without_holes$X(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$18(arr);
 }
-function asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4021,16 +3553,16 @@ function asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1l(fn) {
+function _async_to_generator$1m(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -4121,7 +3653,7 @@ function _sliced_to_array$o(arr, i) {
 function _to_consumable_array$X(arr) {
     return _array_without_holes$X(arr) || _iterable_to_array$X(arr) || _unsupported_iterable_to_array$18(arr) || _non_iterable_spread$X();
 }
-function _ts_generator$1l(thisArg, body) {
+function _ts_generator$1m(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4253,9 +3785,9 @@ function _defaultBuildRequestData(params, state, limit) {
     return base;
 }
 function _runItemTasks(input) {
-    return _async_to_generator$1l(function() {
+    return _async_to_generator$1m(function() {
         var context, items, keys, pageIndex, iterateItem, itemPerformTasksConfig, maxParallelPerPage, indexed, taskConfig, performResult;
-        return _ts_generator$1l(this, function(_state) {
+        return _ts_generator$1m(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, items = input.items, keys = input.keys, pageIndex = input.pageIndex, iterateItem = input.iterateItem, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -4300,9 +3832,9 @@ function _runItemTasks(input) {
     })();
 }
 function _processPage(input) {
-    return _async_to_generator$1l(function() {
+    return _async_to_generator$1m(function() {
         var context, raw, pageIndex, responseAdapter, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, items, keys, nextCursorDocumentKey, hasMore, itemResults, _tmp, pageResult, _tmp1, output;
-        return _ts_generator$1l(this, function(_state) {
+        return _ts_generator$1m(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, raw = input.raw, pageIndex = input.pageIndex, responseAdapter = input.responseAdapter, iterateItem = input.iterateItem, iteratePage = input.iteratePage, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -4442,9 +3974,9 @@ function _evaluateLoopExit(input) {
  * });
  * ```
  */ function iterateDbxCliCallModel(config) {
-    return _async_to_generator$1l(function() {
+    return _async_to_generator$1m(function() {
         var context, modelType, call, specifier, params, _config_buildRequestData, buildRequestData, _config_responseAdapter, responseAdapter, limitPerPage, totalItemsLimit, maxPages, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, _config_collectItems, collectItems, _config_collectItemResults, collectItemResults, _config_collectPageResults, collectPageResults, allItems, allItemResults, allPageResults, pageIndex, totalItems, cursorDocumentKey, hitLimit, keepGoing, collectItemsForPage, collectItemResultsForPage, collectPageResultsForPage, effectiveLimit, data, raw, pageOutcome, _allItems, _allItemResults, exit, result;
-        return _ts_generator$1l(this, function(_state) {
+        return _ts_generator$1m(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = config.context, modelType = config.modelType, call = config.call, specifier = config.specifier, params = config.params, _config_buildRequestData = config.buildRequestData, buildRequestData = _config_buildRequestData === void 0 ? _defaultBuildRequestData : _config_buildRequestData, _config_responseAdapter = config.responseAdapter, responseAdapter = _config_responseAdapter === void 0 ? _defaultResponseAdapter : _config_responseAdapter, limitPerPage = config.limitPerPage, totalItemsLimit = config.totalItemsLimit, maxPages = config.maxPages, iterateItem = config.iterateItem, iteratePage = config.iteratePage, itemPerformTasksConfig = config.itemPerformTasksConfig, maxParallelPerPage = config.maxParallelPerPage, _config_collectItems = config.collectItems, collectItems = _config_collectItems === void 0 ? true : _config_collectItems, _config_collectItemResults = config.collectItemResults, collectItemResults = _config_collectItemResults === void 0 ? iterateItem != null : _config_collectItemResults, _config_collectPageResults = config.collectPageResults, collectPageResults = _config_collectPageResults === void 0 ? iteratePage != null : _config_collectPageResults;
@@ -4545,7 +4077,7 @@ function _evaluateLoopExit(input) {
     })();
 }
 
-function asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4556,16 +4088,16 @@ function asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1k(fn) {
+function _async_to_generator$1l(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -4615,7 +4147,7 @@ function _object_spread_props$C(target, source) {
     }
     return target;
 }
-function _ts_generator$1k(thisArg, body) {
+function _ts_generator$1l(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4731,9 +4263,9 @@ function _ts_generator$1k(thisArg, body) {
             return spec.builder ? spec.builder(yargs) : yargs;
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1k(function() {
+            return _async_to_generator$1l(function() {
                 var context, data, params, result;
-                return _ts_generator$1k(this, function(_state) {
+                return _ts_generator$1l(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             context = requireCliContext();
@@ -4918,7 +4450,7 @@ function AsyncFromSyncIterator$4(s) {
         }
     }, new AsyncFromSyncIterator$4(s);
 }
-function asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4929,22 +4461,22 @@ function asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1j(fn) {
+function _async_to_generator$1k(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1j(thisArg, body) {
+function _ts_generator$1k(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5107,9 +4639,9 @@ function _ts_generator$1j(thisArg, body) {
  * @returns The UTF-8 decoded stdin contents.
  * @throws {CliError} When stdin is a TTY, with `code: 'STDIN_NOT_PIPED'`.
  */ function readAllStdin() {
-    return _async_to_generator$1j(function() {
+    return _async_to_generator$1k(function() {
         var chunks, _iteratorAbruptCompletion, _didIteratorError, _iteratorError, _iterator, _step, _value, chunk, err;
-        return _ts_generator$1j(this, function(_state) {
+        return _ts_generator$1k(this, function(_state) {
             switch(_state.label){
                 case 0:
                     if (process.stdin.isTTY) {
@@ -5213,9 +4745,9 @@ function _ts_generator$1j(thisArg, body) {
  *
  * @returns The tokens parsed from stdin.
  */ function readStdinTokens() {
-    return _async_to_generator$1j(function() {
+    return _async_to_generator$1k(function() {
         var raw;
-        return _ts_generator$1j(this, function(_state) {
+        return _ts_generator$1k(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -5235,7 +4767,7 @@ function _ts_generator$1j(thisArg, body) {
     })();
 }
 
-function asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -5246,16 +4778,16 @@ function asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1i(fn) {
+function _async_to_generator$1j(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -5272,7 +4804,7 @@ function _define_property$W(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$u(left, right) {
+function _instanceof$v(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -5311,7 +4843,7 @@ function _object_spread_props$B(target, source) {
     }
     return target;
 }
-function _ts_generator$1i(thisArg, body) {
+function _ts_generator$1j(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5422,9 +4954,9 @@ function _ts_generator$1i(thisArg, body) {
         return withCallModelArgs(yargs);
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$1i(function() {
+        return _async_to_generator$1j(function() {
             var context, data, rawData, _tmp, params, result;
-            return _ts_generator$1i(this, function(_state) {
+            return _ts_generator$1j(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -5459,7 +4991,7 @@ function _ts_generator$1i(thisArg, body) {
                                 data = JSON.parse(rawData);
                             } catch (e) {
                                 throw new CliError({
-                                    message: "--data must be valid JSON: ".concat(_instanceof$u(e, Error) ? e.message : String(e)),
+                                    message: "--data must be valid JSON: ".concat(_instanceof$v(e, Error) ? e.message : String(e)),
                                     code: 'INVALID_DATA_JSON'
                                 });
                             }
@@ -5496,7 +5028,7 @@ function _array_like_to_array$17(arr, len) {
 function _array_with_holes$n(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _instanceof$t(left, right) {
+function _instanceof$u(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -5684,7 +5216,7 @@ function isPlainObject(value) {
     var result;
     if (value === null || (typeof value === "undefined" ? "undefined" : _type_of$5(value)) !== 'object') {
         result = false;
-    } else if (Array.isArray(value) || _instanceof$t(value, Date)) {
+    } else if (Array.isArray(value) || _instanceof$u(value, Date)) {
         result = false;
     } else {
         // Objects from JSON.parse have Object.prototype as their proto. Anything
@@ -6142,7 +5674,7 @@ function _array_with_holes$l(arr) {
 function _array_without_holes$U(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$14(arr);
 }
-function asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -6153,16 +5685,16 @@ function asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1h(fn) {
+function _async_to_generator$1i(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -6179,7 +5711,7 @@ function _define_property$V(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$s(left, right) {
+function _instanceof$t(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -6241,7 +5773,7 @@ function _sliced_to_array$l(arr, i) {
 function _to_consumable_array$U(arr) {
     return _array_without_holes$U(arr) || _iterable_to_array$U(arr) || _unsupported_iterable_to_array$14(arr) || _non_iterable_spread$U();
 }
-function _ts_generator$1h(thisArg, body) {
+function _ts_generator$1i(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -6443,9 +5975,9 @@ function _unsupported_iterable_to_array$14(o, minLen) {
  * @returns The resolved source, carrying the opened models view when it is `firestore`.
  * @throws {CliError} `MODEL_IS_SERVER_ONLY` for a server-only model, or the session's own error when `--via firestore` was demanded and the session could not open.
  */ function resolveCliReadSource(input) {
-    return _async_to_generator$1h(function() {
+    return _async_to_generator$1i(function() {
         var context, via, modelType, result, _tmp;
-        return _ts_generator$1h(this, function(_state) {
+        return _ts_generator$1i(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, via = input.via, modelType = input.modelType;
@@ -6542,9 +6074,9 @@ function _unsupported_iterable_to_array$14(o, minLen) {
  * @param via - The requested via, carried onto the result.
  * @returns The resolved source.
  */ function resolveAutoReadSource(context, via) {
-    return _async_to_generator$1h(function() {
+    return _async_to_generator$1i(function() {
         var result, _tmp, e, code, message;
-        return _ts_generator$1h(this, function(_state) {
+        return _ts_generator$1i(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -6570,8 +6102,8 @@ function _unsupported_iterable_to_array$14(o, minLen) {
                     ];
                 case 2:
                     e = _state.sent();
-                    code = _instanceof$s(e, CliError) ? e.code : undefined;
-                    message = _instanceof$s(e, Error) ? e.message : String(e);
+                    code = _instanceof$t(e, CliError) ? e.code : undefined;
+                    message = _instanceof$t(e, Error) ? e.message : String(e);
                     if (code != null && CAPABILITY_FAILURE_CODES.has(code)) {
                         verboseLog("read: --via auto → api (direct-Firestore session unavailable: ".concat(code, " ").concat(message, ")"));
                         result = {
@@ -6597,9 +6129,9 @@ function _unsupported_iterable_to_array$14(o, minLen) {
     })();
 }
 function requireModels(context) {
-    return _async_to_generator$1h(function() {
+    return _async_to_generator$1i(function() {
         var getFirestoreModels;
-        return _ts_generator$1h(this, function(_state) {
+        return _ts_generator$1i(this, function(_state) {
             getFirestoreModels = context.getFirestoreModels;
             if (getFirestoreModels == null) {
                 throw new CliError({
@@ -6647,9 +6179,9 @@ function requireModels(context) {
  * @returns `{ key, data }`, with `data: null` when the document does not exist.
  * @throws {CliError} When the key does not match the model's path shape.
  */ function getModelOverFirestore(input) {
-    return _async_to_generator$1h(function() {
+    return _async_to_generator$1i(function() {
         var models, modelType, key, service, data, _ref, e;
-        return _ts_generator$1h(this, function(_state) {
+        return _ts_generator$1i(this, function(_state) {
             switch(_state.label){
                 case 0:
                     models = input.models, modelType = input.modelType, key = input.key;
@@ -6708,9 +6240,9 @@ function requireModels(context) {
  * @returns `{ results, errors }`, key order preserved within each partition.
  * @throws {CliError} `INVALID_ARGUMENT` when `modelType` is not a registered model.
  */ function getMultipleModelsOverFirestore(input) {
-    return _async_to_generator$1h(function() {
+    return _async_to_generator$1i(function() {
         var models, modelType, keys, service, taskResult;
-        return _ts_generator$1h(this, function(_state) {
+        return _ts_generator$1i(this, function(_state) {
             switch(_state.label){
                 case 0:
                     models = input.models, modelType = input.modelType, keys = input.keys;
@@ -6722,8 +6254,8 @@ function requireModels(context) {
                         4,
                         performAsyncTasks(_to_consumable_array$U(keys), function(key) {
                             var _ref;
-                            return _async_to_generator$1h(function() {
-                                return _ts_generator$1h(this, function(_state) {
+                            return _async_to_generator$1i(function() {
+                                return _ts_generator$1i(this, function(_state) {
                                     switch(_state.label){
                                         case 0:
                                             return [
@@ -6785,7 +6317,7 @@ function requireModels(context) {
     return _object_spread$U({
         key: key,
         error: mapped.message
-    }, _instanceof$s(mapped, CliError) ? {
+    }, _instanceof$t(mapped, CliError) ? {
         code: mapped.code
     } : {});
 }
@@ -6802,19 +6334,19 @@ function requireModels(context) {
  * @returns A `CliError` for a key-shape mismatch, otherwise the original error.
  */ function asKeyShapeError(error, modelType, key) {
     var result;
-    if (_instanceof$s(error, Error) && /unexpected key\/path/i.test(error.message)) {
+    if (_instanceof$t(error, Error) && /unexpected key\/path/i.test(error.message)) {
         result = new CliError({
             message: 'Key "'.concat(key, '" does not match the path shape for model "').concat(modelType, '": ').concat(error.message),
             code: 'INVALID_ARGUMENT',
             suggestion: 'Nested models need their full parent path, e.g. "gb/<guestbookId>/gbe/<entryId>".'
         });
     } else {
-        result = _instanceof$s(error, Error) ? error : new Error(String(error));
+        result = _instanceof$t(error, Error) ? error : new Error(String(error));
     }
     return result;
 }
 
-function asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -6825,22 +6357,22 @@ function asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1g(fn) {
+function _async_to_generator$1h(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1g(thisArg, body) {
+function _ts_generator$1h(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -6993,9 +6525,9 @@ function _ts_generator$1g(thisArg, body) {
         }));
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$1g(function() {
+        return _async_to_generator$1h(function() {
             var context, _parseGetArgs, modelType, key, resolved, result, _tmp;
-            return _ts_generator$1g(this, function(_state) {
+            return _ts_generator$1h(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -7052,7 +6584,7 @@ function _ts_generator$1g(thisArg, body) {
     })
 };
 
-function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7063,22 +6595,22 @@ function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1f(fn) {
+function _async_to_generator$1g(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1f(thisArg, body) {
+function _ts_generator$1g(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7214,9 +6746,9 @@ function _ts_generator$1f(thisArg, body) {
         }).epilogue(CLI_READ_VIA_EPILOGUE);
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$1f(function() {
+        return _async_to_generator$1g(function() {
             var context, firstArg, rest, resolvedFirst, resolvedRest, stdinKeys, _parseGetManyArgs, modelType, keys, resolved, result, _tmp;
-            return _ts_generator$1f(this, function(_state) {
+            return _ts_generator$1g(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -7291,7 +6823,7 @@ function _ts_generator$1f(thisArg, body) {
     })
 };
 
-function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7302,16 +6834,16 @@ function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1e(fn) {
+function _async_to_generator$1f(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -7343,7 +6875,7 @@ function _object_spread$T(target) {
     }
     return target;
 }
-function _ts_generator$1e(thisArg, body) {
+function _ts_generator$1f(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7502,9 +7034,9 @@ function _ts_generator$1e(thisArg, body) {
  * @param input.updates - The partial {@link CliConfig} to merge on top of the existing on-disk config.
  * @returns The merged {@link CliConfig} that was just written.
  */ function mergeCliConfig(input) {
-    return _async_to_generator$1e(function() {
+    return _async_to_generator$1f(function() {
         var _ref, _input_updates_activeEnv, existing, merged;
-        return _ts_generator$1e(this, function(_state) {
+        return _ts_generator$1f(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -7629,7 +7161,7 @@ function mergeOutputCommandsConfig(existing, updates) {
     return result;
 }
 
-function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7640,22 +7172,22 @@ function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1d(fn) {
+function _async_to_generator$1e(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1d(thisArg, body) {
+function _ts_generator$1e(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7782,9 +7314,9 @@ function _ts_generator$1d(thisArg, body) {
  * @param input - Resolution inputs.
  * @returns The resolved env triple.
  */ function resolveCliEnv(input) {
-    return _async_to_generator$1d(function() {
+    return _async_to_generator$1e(function() {
         var _ref, _input_envVarName, _ref1, _input_flagEnv, _config_envs, _findCliEnvDefault, config, envVarName, envName, stored, defaultEnv, merged, env;
-        return _ts_generator$1d(this, function(_state) {
+        return _ts_generator$1e(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -7823,9 +7355,9 @@ function _ts_generator$1d(thisArg, body) {
     })();
 }
 function resolveCliEnvOrThrow(input) {
-    return _async_to_generator$1d(function() {
+    return _async_to_generator$1e(function() {
         var _ref, config, envName, env;
-        return _ts_generator$1d(this, function(_state) {
+        return _ts_generator$1e(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -7891,6 +7423,43 @@ function resolveCliEnvOrThrow(input) {
     };
 }
 
+/**
+ * Hard ceiling on how long a minted direct-Firestore session may be reused, regardless of what the
+ * API reported in `expiresAt`. See {@link FIRESTORE_SESSION_MAX_CACHE_MS}.
+ */ var CLI_FIRESTORE_SESSION_MAX_CACHE_MS = FIRESTORE_SESSION_MAX_CACHE_MS;
+/**
+ * Default skew/latency buffer applied when deciding whether a cached session is still usable. See
+ * {@link FIRESTORE_SESSION_EXPIRY_BUFFER_MS}.
+ */ var CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS = FIRESTORE_SESSION_EXPIRY_BUFFER_MS;
+/**
+ * Creates a per-env direct-Firestore session cache store backed by a single JSON file.
+ *
+ * The file-backed half of the session cache stays HERE rather than moving to
+ * `@dereekb/oauth-resource/firebase`: it depends on `@dereekb/nestjs`, and a Nest peer has no business
+ * in a package whose whole point is a clean install graph. Only the expiry policy and the
+ * {@link FirestoreSessionCredentialsCache} port are shared.
+ *
+ * Entries are written with mode 0o600 — they hold a Firebase custom token, which is a bearer
+ * credential for the user it was minted for.
+ *
+ * @param input - The cache store inputs.
+ * @param input.firestoreSessionCachePath - Absolute path to the JSON file backing the cache.
+ * @returns A {@link CliFirestoreSessionCacheStore} keyed by env name.
+ * @__NO_SIDE_EFFECTS__
+ */ function createCliFirestoreSessionCacheStore(input) {
+    return createMemoizedJsonFileAsyncKeyedValueCache({
+        filePath: input.firestoreSessionCachePath
+    });
+}
+/**
+ * Resolves the epoch-millis instant at which a cached session stops being usable. See
+ * {@link firestoreSessionEntryExpiresAt}.
+ */ var cliFirestoreSessionEntryExpiresAt = firestoreSessionEntryExpiresAt;
+/**
+ * Returns true when the cached session is at or near its effective expiry. See
+ * {@link isFirestoreSessionExpired}.
+ */ var isCliFirestoreSessionExpired = isFirestoreSessionExpired;
+
 /**
  * Creates a per-env token cache store backed by a single JSON file.
  *
@@ -7924,7 +7493,7 @@ function resolveCliEnvOrThrow(input) {
     }).hasExpired();
 }
 
-function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7935,16 +7504,16 @@ function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1c(fn) {
+function _async_to_generator$1d(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -7961,7 +7530,7 @@ function _define_property$T(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$r(left, right) {
+function _instanceof$s(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -8000,7 +7569,7 @@ function _object_spread_props$A(target, source) {
     }
     return target;
 }
-function _ts_generator$1c(thisArg, body) {
+function _ts_generator$1d(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -8155,7 +7724,7 @@ var cliOidcFetch = function cliOidcFetch(input, init) {
  * @returns A {@link CliError} for relying-party errors, otherwise the original value.
  */ function oidcRelyingPartyErrorToCliError(error) {
     var result = error;
-    if (_instanceof$r(error, OidcRelyingPartyError)) {
+    if (_instanceof$s(error, OidcRelyingPartyError)) {
         var mapped = OIDC_ERROR_CODE_MAP[error.code];
         result = new CliError(_object_spread$S({
             message: error.message,
@@ -8167,9 +7736,9 @@ var cliOidcFetch = function cliOidcFetch(input, init) {
     return result;
 }
 function withCliErrors(fn) {
-    return _async_to_generator$1c(function() {
+    return _async_to_generator$1d(function() {
         var e;
-        return _ts_generator$1c(this, function(_state) {
+        return _ts_generator$1d(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -8360,6 +7929,450 @@ function _object_spread_props$z(target, source) {
     }
 }
 
+function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
+}
+function _async_to_generator$1c(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _instanceof$r(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else return left instanceof right;
+}
+function _ts_generator$1c(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Hostnames RFC 8252 §7.3 treats as the loopback interface, and the exact set `oidc-provider`
+ * recognizes as a loopback redirect host.
+ *
+ * `[::1]` carries its brackets because that is what `URL.hostname` returns for an IPv6 literal —
+ * the brackets are stripped again before the address is handed to `server.listen`.
+ */ var LOOPBACK_REDIRECT_HOSTNAMES = [
+    '127.0.0.1',
+    'localhost',
+    '[::1]'
+];
+/**
+ * The loopback port the CLI suggests when the configured redirect URI has no bindable port.
+ *
+ * Deliberately outside the 9900-9910 block the Firebase emulators occupy, so a suggested redirect
+ * URI never collides with a running emulator.
+ */ var SUGGESTED_CLI_LOOPBACK_REDIRECT_PORT = 8976;
+/**
+ * Error code raised when the loopback listener cannot bind the redirect URI's port (e.g. the port
+ * is already in use, or is privileged).
+ */ var LOOPBACK_REDIRECT_LISTEN_FAILED_ERROR_CODE = 'AUTH_REDIRECT_LISTEN_FAILED';
+/**
+ * Error code raised when no redirect reached the loopback listener within the allotted time.
+ */ var LOOPBACK_REDIRECT_TIMEOUT_ERROR_CODE = 'AUTH_REDIRECT_TIMEOUT';
+/**
+ * Decomposes a redirect URI into a {@link LoopbackRedirectTarget} when the CLI can bind a local
+ * listener for it.
+ *
+ * A target is only produced for an `http:` loopback URI carrying a concrete, non-zero port. The
+ * conventional `http://127.0.0.1:0/callback` placeholder is deliberately NOT capturable: binding an
+ * ephemeral port would mean sending a `redirect_uri` that differs from the registered one, which
+ * every OAuth provider rejects unless the client is registered as a native app (where loopback
+ * ports are compared port-insensitively).
+ *
+ * @param input - The parse inputs.
+ * @param input.redirectUri - The configured redirect URI.
+ * @param input.port - Optional port override applied to the parsed URI.
+ * @returns The bindable target, or `undefined` when the URI cannot be captured locally.
+ * @__NO_SIDE_EFFECTS__
+ */ function parseLoopbackRedirectUri(input) {
+    var result;
+    if (input.redirectUri) {
+        var parsed;
+        try {
+            parsed = new URL(input.redirectUri);
+        } catch (unused) {
+            // A non-URL redirect (e.g. the `urn:ietf:wg:oauth:2.0:oob` out-of-band URN) is a valid
+            // configuration — it just has nothing to bind.
+            parsed = undefined;
+        }
+        if ((parsed === null || parsed === void 0 ? void 0 : parsed.protocol) === 'http:' && LOOPBACK_REDIRECT_HOSTNAMES.includes(parsed.hostname)) {
+            var _input_port;
+            var port = (_input_port = input.port) !== null && _input_port !== void 0 ? _input_port : Number(parsed.port);
+            if (Number.isInteger(port) && port > 0) {
+                parsed.port = String(port);
+                result = {
+                    redirectUri: parsed.toString(),
+                    hostname: parsed.hostname,
+                    port: port,
+                    pathname: parsed.pathname
+                };
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Renders the single page the browser lands on after the provider redirects back.
+ *
+ * @param input - The page inputs.
+ * @param input.title - The heading + document title.
+ * @param input.message - The body line under the heading.
+ * @returns A self-contained HTML document.
+ * @__NO_SIDE_EFFECTS__
+ */ function renderLoopbackRedirectPage(input) {
+    // Both values are CLI-authored or provider-supplied error text, so they are escaped rather than
+    // interpolated raw — an `error_description` is attacker-influenceable in the general case.
+    var escape = function escape(value) {
+        return value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+    };
+    var title = escape(input.title);
+    var message = escape(input.message);
+    return '<!doctype html><html lang="en"><head><meta charset="utf-8"><title>'.concat(title, "</title><style>body{font-family:system-ui,-apple-system,sans-serif;margin:0;display:flex;min-height:100vh;align-items:center;justify-content:center;background:#101418;color:#e8eaed}main{text-align:center;padding:2rem}h1{font-size:1.25rem;font-weight:600;margin:0 0 .5rem}p{margin:0;opacity:.75}</style></head><body><main><h1>").concat(title, "</h1><p>").concat(message, "</p></main></body></html>");
+}
+/**
+ * Binds a local HTTP listener to a loopback redirect URI so the authorization code can be read
+ * straight out of the browser redirect instead of being pasted back by hand.
+ *
+ * The listener answers exactly one path — the redirect URI's own — and serves a short "you can close
+ * this tab" page. Everything else is answered `404`, which is what keeps the browser's automatic
+ * `/favicon.ico` request from being mistaken for the redirect.
+ *
+ * @param input - The capture inputs.
+ * @param input.target - The bindable target, from {@link parseLoopbackRedirectUri}.
+ * @param input.successMessage - Optional override for the browser success page's body line.
+ * @returns The started {@link LoopbackRedirectCapture}.
+ * @throws {CliError} `AUTH_REDIRECT_LISTEN_FAILED` when the port cannot be bound.
+ */ function startLoopbackRedirectCapture(input) {
+    return _async_to_generator$1c(function() {
+        var target, sockets, resolveRedirect, redirect, handleRequest, hostnames, bindings, servers, close;
+        return _ts_generator$1c(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    target = input.target;
+                    sockets = new Set();
+                    resolveRedirect = noop;
+                    redirect = new Promise(function(resolve) {
+                        resolveRedirect = resolve;
+                    });
+                    handleRequest = function handleRequest(req, res) {
+                        var requestUrl;
+                        try {
+                            var _req_url;
+                            requestUrl = new URL((_req_url = req.url) !== null && _req_url !== void 0 ? _req_url : '/', target.redirectUri);
+                        } catch (unused) {
+                            requestUrl = undefined;
+                        }
+                        if ((requestUrl === null || requestUrl === void 0 ? void 0 : requestUrl.pathname) === target.pathname) {
+                            var _requestUrl_searchParams_get, _input_successMessage;
+                            var error = requestUrl.searchParams.get('error');
+                            var page = error ? renderLoopbackRedirectPage({
+                                title: 'Sign-in failed',
+                                message: (_requestUrl_searchParams_get = requestUrl.searchParams.get('error_description')) !== null && _requestUrl_searchParams_get !== void 0 ? _requestUrl_searchParams_get : error
+                            }) : renderLoopbackRedirectPage({
+                                title: 'Signed in',
+                                message: (_input_successMessage = input.successMessage) !== null && _input_successMessage !== void 0 ? _input_successMessage : 'You can close this tab and return to your terminal.'
+                            });
+                            res.writeHead(error ? 400 : 200, {
+                                'content-type': 'text/html; charset=utf-8',
+                                connection: 'close'
+                            });
+                            res.end(page);
+                            resolveRedirect(requestUrl.toString());
+                        } else {
+                            res.writeHead(404, {
+                                'content-type': 'text/plain; charset=utf-8',
+                                connection: 'close'
+                            });
+                            res.end('Not found.');
+                        }
+                    };
+                    // `localhost` is bound on BOTH loopback families rather than on whatever the resolver happens to
+                    // return first. Node binds a single address, and browsers pick their own — a listener that landed
+                    // only on `::1` refuses the connection whenever the browser reaches for `127.0.0.1`.
+                    // An explicit literal is bound as written; `URL.hostname` brackets an IPv6 literal, and
+                    // `server.listen` wants the bare address.
+                    hostnames = target.hostname === 'localhost' ? [
+                        '::1',
+                        '127.0.0.1'
+                    ] : [
+                        target.hostname.replaceAll(/^\[|\]$/g, '')
+                    ];
+                    return [
+                        4,
+                        Promise.all(hostnames.map(function(hostname) {
+                            return new Promise(function(resolveBinding) {
+                                var server = createServer(handleRequest);
+                                var onListenError = function onListenError(e) {
+                                    resolveBinding(new CliError({
+                                        message: "Could not bind the loopback redirect listener on ".concat(hostname, ":").concat(target.port, " (").concat(e.message, ")."),
+                                        code: LOOPBACK_REDIRECT_LISTEN_FAILED_ERROR_CODE
+                                    }));
+                                };
+                                server.once('error', onListenError);
+                                server.on('connection', function(socket) {
+                                    sockets.add(socket);
+                                    socket.once('close', function() {
+                                        return sockets.delete(socket);
+                                    });
+                                });
+                                server.listen(target.port, hostname, function() {
+                                    server.removeListener('error', onListenError);
+                                    // Past bind, a socket-level error (a browser hanging up mid-response) must not take the
+                                    // CLI down — the flow either already has its code or falls through to the paste prompt.
+                                    server.on('error', noop);
+                                    resolveBinding(server);
+                                });
+                            });
+                        }))
+                    ];
+                case 1:
+                    bindings = _state.sent();
+                    servers = bindings.filter(function(x) {
+                        return !_instanceof$r(x, CliError);
+                    });
+                    if (servers.length === 0) {
+                        // Both families failing is one failure to report; the first is the representative one.
+                        throw bindings[0];
+                    }
+                    close = function close() {
+                        return new Promise(function(resolveClose) {
+                            sockets.forEach(function(socket) {
+                                return socket.destroy();
+                            });
+                            sockets.clear();
+                            void Promise.all(servers.map(function(server) {
+                                return new Promise(function(resolveServer) {
+                                    return server.close(function() {
+                                        return resolveServer();
+                                    });
+                                });
+                            })).then(function() {
+                                return resolveClose();
+                            });
+                        });
+                    };
+                    return [
+                        2,
+                        {
+                            redirectUri: target.redirectUri,
+                            port: target.port,
+                            waitForRedirect: function waitForRedirect(timeoutMs) {
+                                var result;
+                                if (timeoutMs != null && timeoutMs > 0) {
+                                    result = new Promise(function(resolveWait, rejectWait) {
+                                        var // A caller that races this against another source (the paste prompt) abandons the loser
+                                        // mid-flight — a still-ref'd timer would then hold the CLI open for the rest of the
+                                        // timeout after the command was otherwise done.
+                                        _timer_unref;
+                                        var timer = setTimeout(function() {
+                                            rejectWait(new CliError({
+                                                message: "Timed out after ".concat(timeoutMs, "ms waiting for the browser redirect to ").concat(target.redirectUri, "."),
+                                                code: LOOPBACK_REDIRECT_TIMEOUT_ERROR_CODE
+                                            }));
+                                        }, timeoutMs);
+                                        (_timer_unref = timer.unref) === null || _timer_unref === void 0 ? void 0 : _timer_unref.call(timer);
+                                        redirect.then(function(url) {
+                                            clearTimeout(timer);
+                                            resolveWait(url);
+                                        }, rejectWait);
+                                    });
+                                } else {
+                                    result = redirect;
+                                }
+                                return result;
+                            },
+                            close: close
+                        }
+                    ];
+            }
+        });
+    })();
+}
+
+/**
+ * Opens a URL in the user's default browser.
+ *
+ * Shells out to the platform's URL handler (`open` on macOS, `start` on Windows, `xdg-open`
+ * elsewhere) rather than taking a dependency for what is a single spawn. The child is detached with
+ * its stdio ignored, so the browser neither holds the CLI's event loop open nor interleaves output
+ * into the CLI's own stdout/stderr.
+ *
+ * Never throws or rejects: a headless machine with no handler registered is an ordinary outcome, and
+ * the caller falls back to the printed URL.
+ *
+ * @param input - The open inputs.
+ * @param input.url - The URL to open.
+ * @returns `true` when the handler process was spawned, `false` when it could not be.
+ */ function openUrlInBrowser(input) {
+    var url = input.url;
+    var command;
+    var args;
+    var windowsVerbatimArguments = false;
+    switch(process.platform){
+        case 'darwin':
+            command = 'open';
+            args = [
+                url
+            ];
+            break;
+        case 'win32':
+            // `start` is a cmd builtin whose first quoted argument is the window title, hence the empty
+            // `""`. `windowsVerbatimArguments` suppresses Node's own quoting so the `^`-escaped `&`
+            // separating the OAuth query params survives — unescaped, cmd reads it as a command separator
+            // and truncates the authorization URL at the first parameter.
+            command = 'cmd.exe';
+            args = [
+                '/s',
+                '/c',
+                'start',
+                '""',
+                '/b',
+                url.replaceAll('&', '^&')
+            ];
+            windowsVerbatimArguments = true;
+            break;
+        default:
+            command = 'xdg-open';
+            args = [
+                url
+            ];
+            break;
+    }
+    return new Promise(function(resolve) {
+        try {
+            var child = spawn(command, args, {
+                detached: true,
+                stdio: 'ignore',
+                windowsVerbatimArguments: windowsVerbatimArguments
+            });
+            child.once('error', function() {
+                return resolve(false);
+            });
+            child.once('spawn', function() {
+                child.unref();
+                resolve(true);
+            });
+        } catch (unused) {
+            resolve(false);
+        }
+    });
+}
+
 /**
  * Error code thrown by {@link promptLine} when the user cancels a masked prompt with Ctrl-C.
  *
@@ -8377,17 +8390,18 @@ var KEY_DEL = ''; // DEL
  * pasted redirect URL.
  *
  * Rejects with a {@link CliError} (`code: 'PROMPT_CANCELLED'`) when the user presses Ctrl-C
- * during a masked prompt, instead of forcibly terminating the process.
+ * during a masked prompt, or when `signal` aborts, instead of forcibly terminating the process.
  *
  * @param input - The prompt inputs.
  * @param input.question - The prompt text written to stdout (or stderr when masking).
  * @param input.mask - When `true`, characters are echoed as `*` and Ctrl-C cancels the prompt.
+ * @param input.signal - Optional signal that cancels the prompt and releases stdin.
  * @returns The line entered by the user (without the trailing newline).
  */ function promptLine(input) {
     var result;
     if (input.mask) {
         result = new Promise(function(resolve, reject) {
-            var _process_stdin_setRawMode, _process_stdin;
+            var _input_signal, _process_stdin_setRawMode, _process_stdin;
             var stdout = process.stdout;
             stdout.write(input.question);
             var buffer = '';
@@ -8443,6 +8457,20 @@ var KEY_DEL = ''; // DEL
                     }
                 }
             };
+            var onAbort = function onAbort() {
+                var _process_stdin_setRawMode, _process_stdin;
+                stdout.write('\n');
+                process.stdin.removeListener('data', onData);
+                (_process_stdin_setRawMode = (_process_stdin = process.stdin).setRawMode) === null || _process_stdin_setRawMode === void 0 ? void 0 : _process_stdin_setRawMode.call(_process_stdin, false);
+                process.stdin.pause();
+                reject(new CliError({
+                    message: 'Prompt cancelled.',
+                    code: PROMPT_CANCELLED_ERROR_CODE
+                }));
+            };
+            (_input_signal = input.signal) === null || _input_signal === void 0 ? void 0 : _input_signal.addEventListener('abort', onAbort, {
+                once: true
+            });
             (_process_stdin_setRawMode = (_process_stdin = process.stdin).setRawMode) === null || _process_stdin_setRawMode === void 0 ? void 0 : _process_stdin_setRawMode.call(_process_stdin, true);
             process.stdin.resume();
             process.stdin.on('data', onData);
@@ -8453,11 +8481,30 @@ var KEY_DEL = ''; // DEL
             output: process.stdout,
             terminal: false
         });
-        result = new Promise(function(resolve) {
-            rl.question(input.question, function(answer) {
+        result = new Promise(function(resolve, reject) {
+            var signal = input.signal;
+            var onAbort = function onAbort() {
                 rl.close();
-                resolve(answer);
-            });
+                // `rl.close()` detaches the interface but leaves the stream flowing, which keeps the CLI's
+                // event loop alive after the racing source already produced the answer.
+                process.stdin.pause();
+                reject(new CliError({
+                    message: 'Prompt cancelled.',
+                    code: PROMPT_CANCELLED_ERROR_CODE
+                }));
+            };
+            if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
+                onAbort();
+            } else {
+                signal === null || signal === void 0 ? void 0 : signal.addEventListener('abort', onAbort, {
+                    once: true
+                });
+                rl.question(input.question, function(answer) {
+                    signal === null || signal === void 0 ? void 0 : signal.removeEventListener('abort', onAbort);
+                    rl.close();
+                    resolve(answer);
+                });
+            }
         });
     }
     return result;
@@ -8632,6 +8679,13 @@ function _ts_generator$1b(thisArg, body) {
         };
     }
 }
+/**
+ * Default time `auth login` waits for the browser redirect to reach the loopback listener before
+ * falling back to the paste prompt.
+ *
+ * Long enough to cover a first-time sign-in (account picker, password manager, MFA, consent screen),
+ * since the fallback costs the user the whole flow again.
+ */ var DEFAULT_AUTH_LOGIN_LISTEN_FOR = '5m';
 function resolveAuthSetupPrompt(input) {
     return _async_to_generator$1b(function() {
         var argvValue, existingValue, prompt, mask, result, answer;
@@ -8646,19 +8700,33 @@ function resolveAuthSetupPrompt(input) {
                     result = argvValue;
                     return [
                         3,
-                        4
+                        5
                     ];
                 case 1:
-                    if (!existingValue) return [
+                    if (!(argvValue === '')) return [
                         3,
                         2
                     ];
-                    result = existingValue;
+                    // An EXPLICIT empty flag clears the stored value. Distinguished from an absent flag — which is
+                    // `undefined` and falls through to the existing value — because the two mean opposite things:
+                    // `--client-secret ''` is how a confidential client is converted to a public one, and treating
+                    // it as "not supplied" silently keeps the old secret, which the provider then rejects.
+                    result = undefined;
                     return [
                         3,
-                        4
+                        5
                     ];
                 case 2:
+                    if (!existingValue) return [
+                        3,
+                        3
+                    ];
+                    result = existingValue;
+                    return [
+                        3,
+                        5
+                    ];
+                case 3:
                     return [
                         4,
                         promptLine({
@@ -8666,11 +8734,11 @@ function resolveAuthSetupPrompt(input) {
                             mask: mask
                         })
                     ];
-                case 3:
+                case 4:
                     answer = _state.sent().trim();
                     result = answer.length > 0 ? answer : existingValue;
-                    _state.label = 4;
-                case 4:
+                    _state.label = 5;
+                case 5:
                     return [
                         2,
                         result
@@ -8852,7 +8920,15 @@ function resolveAuthSetupPrompt(input) {
                 describe: 'OAuth client ID registered with the target app'
             }).option('client-secret', {
                 type: 'string',
-                describe: 'OAuth client secret'
+                describe: "OAuth client secret; omit for a public (PKCE) client, or pass '' to clear a stored one"
+            }).option('token-endpoint-auth-method', {
+                type: 'string',
+                choices: [
+                    'none',
+                    'client_secret_post',
+                    'client_secret_basic'
+                ],
+                describe: "The OAuth client's registered token_endpoint_auth_method; 'none' marks a public (PKCE) client and skips the client-secret prompt"
             }).option('redirect-uri', {
                 type: 'string',
                 describe: 'OAuth redirect URI registered with the OAuth client'
@@ -8867,7 +8943,7 @@ function resolveAuthSetupPrompt(input) {
         },
         handler: wrapCommandHandler(function(argv) {
             return _async_to_generator$1b(function() {
-                var _ref, _ref1, _argv_env, _ref2, _ref3, _argv_appClientUrl, _ref4, _ref5, _argv_scopes, _config_envs, _findCliEnvDefault, config, envName, stored, defaultEnv, existing, apiBaseUrl, oidcIssuer, appClientUrl, clientId, clientSecret, redirectUri, scopes, nextEnv, merged;
+                var _ref, _ref1, _argv_env, _ref2, _ref3, _argv_appClientUrl, _argv_tokenEndpointAuthMethod, _ref4, _ref5, _argv_scopes, _config_envs, _findCliEnvDefault, config, envName, stored, defaultEnv, existing, apiBaseUrl, oidcIssuer, appClientUrl, clientId, tokenEndpointAuthMethod, publicClient, clientSecret, _tmp, redirectUri, scopes, nextEnv, merged;
                 return _ts_generator$1b(this, function(_state) {
                     switch(_state.label){
                         case 0:
@@ -8926,6 +9002,22 @@ function resolveAuthSetupPrompt(input) {
                             ];
                         case 4:
                             clientId = _state.sent();
+                            tokenEndpointAuthMethod = (_argv_tokenEndpointAuthMethod = argv.tokenEndpointAuthMethod) !== null && _argv_tokenEndpointAuthMethod !== void 0 ? _argv_tokenEndpointAuthMethod : existing === null || existing === void 0 ? void 0 : existing.tokenEndpointAuthMethod;
+                            // A public client has no secret to ask for, so a KNOWN `none` skips the prompt entirely rather
+                            // than asking and accepting an empty answer. Any other value — including an unknown one — keeps
+                            // the prompt, since "no secret configured yet" and "never has a secret" are indistinguishable
+                            // without this field.
+                            publicClient = tokenEndpointAuthMethod === 'none';
+                            if (!publicClient) return [
+                                3,
+                                5
+                            ];
+                            _tmp = undefined;
+                            return [
+                                3,
+                                7
+                            ];
+                        case 5:
                             return [
                                 4,
                                 resolveAuthSetupPrompt({
@@ -8935,8 +9027,11 @@ function resolveAuthSetupPrompt(input) {
                                     mask: true
                                 })
                             ];
-                        case 5:
-                            clientSecret = _state.sent();
+                        case 6:
+                            _tmp = _state.sent();
+                            _state.label = 7;
+                        case 7:
+                            clientSecret = _tmp;
                             return [
                                 4,
                                 resolveAuthSetupPrompt({
@@ -8945,12 +9040,16 @@ function resolveAuthSetupPrompt(input) {
                                     prompt: "Redirect URI [".concat((_ref5 = existing === null || existing === void 0 ? void 0 : existing.redirectUri) !== null && _ref5 !== void 0 ? _ref5 : DEFAULT_CLI_REDIRECT_URI, "]: ")
                                 })
                             ];
-                        case 6:
+                        case 8:
                             redirectUri = (_ref4 = _state.sent()) !== null && _ref4 !== void 0 ? _ref4 : DEFAULT_CLI_REDIRECT_URI;
                             scopes = (_argv_scopes = argv.scopes) !== null && _argv_scopes !== void 0 ? _argv_scopes : existing === null || existing === void 0 ? void 0 : existing.scopes;
-                            if (!apiBaseUrl || !oidcIssuer || !clientId || !clientSecret) {
+                            // `clientSecret` is deliberately NOT required: a CLI is a public client in the usual case
+                            // (`token_endpoint_auth_method: 'none'`), authenticating with PKCE instead of a secret. The
+                            // protocol layer already omits an absent secret from the token request, so requiring one here
+                            // was the only thing making a public client unconfigurable.
+                            if (!apiBaseUrl || !oidcIssuer || !clientId) {
                                 throw new CliError({
-                                    message: 'apiBaseUrl, oidcIssuer, clientId, and clientSecret are all required.',
+                                    message: 'apiBaseUrl, oidcIssuer, and clientId are all required.',
                                     code: 'AUTH_SETUP_INCOMPLETE'
                                 });
                             }
@@ -8958,9 +9057,12 @@ function resolveAuthSetupPrompt(input) {
                                 apiBaseUrl: apiBaseUrl,
                                 oidcIssuer: oidcIssuer,
                                 clientId: clientId,
-                                clientSecret: clientSecret,
                                 redirectUri: redirectUri
-                            }, appClientUrl ? {
+                            }, clientSecret ? {
+                                clientSecret: clientSecret
+                            } : {}, tokenEndpointAuthMethod ? {
+                                tokenEndpointAuthMethod: tokenEndpointAuthMethod
+                            } : {}, appClientUrl ? {
                                 appClientUrl: appClientUrl
                             } : {}, scopes ? {
                                 scopes: scopes
@@ -8977,7 +9079,7 @@ function resolveAuthSetupPrompt(input) {
                                     } : {})
                                 })
                             ];
-                        case 7:
+                        case 9:
                             merged = _state.sent();
                             outputResult({
                                 saved: true,
@@ -9000,8 +9102,19 @@ function resolveAuthSetupPrompt(input) {
         builder: function builder(yargs) {
             return withEnv(yargs).option('open', {
                 type: 'boolean',
-                default: false,
-                describe: 'Print the auth URL only (does not auto-open a browser)'
+                default: true,
+                describe: 'Open the authorization URL in the default browser. Use --no-open to print it only.'
+            }).option('listen', {
+                type: 'boolean',
+                default: true,
+                describe: 'Bind the loopback redirect URI and read the authorization code straight out of the browser redirect. Use --no-listen to always paste it back by hand.'
+            }).option('listen-for', {
+                type: 'string',
+                default: DEFAULT_AUTH_LOGIN_LISTEN_FOR,
+                describe: "How long to wait for the browser redirect before falling back to the paste prompt (e.g. 5m, 90s). Defaults to ".concat(DEFAULT_AUTH_LOGIN_LISTEN_FOR, ".")
+            }).option('redirect-port', {
+                type: 'number',
+                describe: 'Bind the loopback listener on this port instead of the one in the configured redirect URI. The resulting redirect URI must also be registered with the OAuth client.'
             }).option('code', {
                 type: 'string',
                 describe: 'Skip the prompt and pass the redirect URL or bare code directly'
@@ -9021,7 +9134,7 @@ function resolveAuthSetupPrompt(input) {
         },
         handler: wrapCommandHandler(function(argv) {
             return _async_to_generator$1b(function() {
-                var _argv_code, _tokenResponse_expires_in, _ref, _ref1, envName, env, meta, _ref2, codeVerifier, codeChallenge, state, requestedScopes, requestedSessionTtlSeconds, ms, url, pasted, _tmp, code, tokenResponse, expiresAt, sessionInfo, sessionExpiresAt, rotationDisabled, entry, sessionSummary;
+                var _argv_listenFor, _ref, _tokenResponse_expires_in, _ref1, _ref2, envName, env, meta, _ref3, codeVerifier, codeChallenge, state, requestedScopes, requestedSessionTtlSeconds, ms, listenForMs, suppliedCode, shouldListen, loopbackTarget, capture, e, suggestedRedirectUri, redirectUri, url, _tmp, pasted, controller, prompt, redirected, e1, code, tokenResponse, expiresAt, sessionInfo, sessionExpiresAt, rotationDisabled, entry, sessionSummary;
                 return _ts_generator$1b(this, function(_state) {
                     switch(_state.label){
                         case 0:
@@ -9037,7 +9150,7 @@ function resolveAuthSetupPrompt(input) {
                                 })
                             ];
                         case 1:
-                            _ref1 = _state.sent(), envName = _ref1.envName, env = _ref1.env;
+                            _ref2 = _state.sent(), envName = _ref2.envName, env = _ref2.env;
                             return [
                                 4,
                                 discoverOidcMetadata({
@@ -9052,7 +9165,7 @@ function resolveAuthSetupPrompt(input) {
                                 generatePkceMaterial()
                             ];
                         case 3:
-                            _ref2 = _state.sent(), codeVerifier = _ref2.codeVerifier, codeChallenge = _ref2.codeChallenge;
+                            _ref3 = _state.sent(), codeVerifier = _ref3.codeVerifier, codeChallenge = _ref3.codeChallenge;
                             state = generateOAuthState();
                             requestedScopes = argv.readOnlyScopes ? filterReadOnlyModelScopes(env.scopes) : env.scopes;
                             if (argv.serviceToken) {
@@ -9071,42 +9184,214 @@ function resolveAuthSetupPrompt(input) {
                                 }
                                 requestedSessionTtlSeconds = Math.floor(ms / MS_IN_SECOND);
                             }
+                            listenForMs = durationDataToMilliseconds(parseDurationString((_argv_listenFor = argv.listenFor) !== null && _argv_listenFor !== void 0 ? _argv_listenFor : DEFAULT_AUTH_LOGIN_LISTEN_FOR));
+                            if (listenForMs <= 0) {
+                                throw new CliError({
+                                    message: '--listen-for: invalid duration "'.concat(argv.listenFor, '". Use formats like "5m", "90s", or mixed units like "1h30m".'),
+                                    code: 'AUTH_LISTEN_FOR_INVALID'
+                                });
+                            }
+                            // The loopback listener is started BEFORE the authorization URL is built: the port it binds is
+                            // part of the `redirect_uri` the provider echoes back, so it has to be settled first.
+                            suppliedCode = argv.code;
+                            shouldListen = suppliedCode == null && argv.listen !== false;
+                            loopbackTarget = shouldListen ? parseLoopbackRedirectUri({
+                                redirectUri: env.redirectUri,
+                                port: argv.redirectPort
+                            }) : undefined;
+                            if (!loopbackTarget) return [
+                                3,
+                                8
+                            ];
+                            _state.label = 4;
+                        case 4:
+                            _state.trys.push([
+                                4,
+                                6,
+                                ,
+                                7
+                            ]);
+                            return [
+                                4,
+                                startLoopbackRedirectCapture({
+                                    target: loopbackTarget
+                                })
+                            ];
+                        case 5:
+                            capture = _state.sent();
+                            return [
+                                3,
+                                7
+                            ];
+                        case 6:
+                            e = _state.sent();
+                            // A port that is already in use is not worth failing the whole login over — the paste
+                            // flow is still there, and it is what the CLI did unconditionally before.
+                            process.stderr.write("".concat(e.message, " Falling back to pasting the redirect URL.\n"));
+                            return [
+                                3,
+                                7
+                            ];
+                        case 7:
+                            return [
+                                3,
+                                9
+                            ];
+                        case 8:
+                            if (shouldListen) {
+                                suggestedRedirectUri = "http://127.0.0.1:".concat(SUGGESTED_CLI_LOOPBACK_REDIRECT_PORT, "/callback");
+                                process.stderr.write('Redirect capture is unavailable: "'.concat(env.redirectUri, '" has no loopback port to bind.\n  To capture the redirect automatically, register ').concat(suggestedRedirectUri, " with the OAuth client, then run:\n    ").concat(cliName, " auth setup --env ").concat(envName, " --redirect-uri ").concat(suggestedRedirectUri, "\n"));
+                            }
+                            _state.label = 9;
+                        case 9:
+                            // Identical to the configured redirect URI unless `--redirect-port` moved it, and it is what
+                            // the token exchange must echo back — a mismatch there is rejected as `invalid_grant`.
+                            redirectUri = (_ref = capture === null || capture === void 0 ? void 0 : capture.redirectUri) !== null && _ref !== void 0 ? _ref : env.redirectUri;
                             url = buildAuthorizationUrl({
                                 authorizationEndpoint: meta.authorization_endpoint,
                                 oidcIssuer: env.oidcIssuer,
                                 apiBaseUrl: env.apiBaseUrl,
                                 appClientUrl: env.appClientUrl,
                                 clientId: env.clientId,
-                                redirectUri: env.redirectUri,
+                                redirectUri: redirectUri,
                                 scopes: requestedScopes,
                                 state: state,
                                 codeChallenge: codeChallenge,
                                 requestedSessionTtlSeconds: requestedSessionTtlSeconds
                             });
-                            // The CLI never opens a browser itself — it prints the URL and reads the redirect back.
-                            // Emit the URL through a clearly-prefixed stderr line so JSON stdout stays parseable.
+                            // Printed even when the browser opens: it is the fallback whenever the launch fails, and the
+                            // record of what was opened. Emitted on stderr so JSON stdout stays parseable.
                             process.stderr.write("Authorization URL:\n  ".concat(url, "\n"));
-                            if (!((_argv_code = argv.code) !== null && _argv_code !== void 0)) return [
+                            _tmp = suppliedCode == null && argv.open !== false;
+                            if (!_tmp) return [
                                 3,
-                                4
+                                11
+                            ];
+                            return [
+                                4,
+                                openUrlInBrowser({
+                                    url: url
+                                })
+                            ];
+                        case 10:
+                            _tmp = !_state.sent();
+                            _state.label = 11;
+                        case 11:
+                            if (_tmp) {
+                                process.stderr.write('Could not open a browser automatically — open the URL above by hand.\n');
+                            }
+                            _state.label = 12;
+                        case 12:
+                            _state.trys.push([
+                                12,
+                                ,
+                                23,
+                                25
+                            ]);
+                            if (!(suppliedCode != null)) return [
+                                3,
+                                13
                             ];
-                            _tmp = _argv_code;
+                            pasted = suppliedCode;
                             return [
                                 3,
-                                6
+                                22
                             ];
-                        case 4:
+                        case 13:
+                            if (!capture) return [
+                                3,
+                                20
+                            ];
+                            // The hint goes to stderr and the prompt itself is rendered empty, so the readline prompt
+                            // never lands on stdout alongside the JSON envelope.
+                            process.stderr.write("Waiting for the redirect to ".concat(capture.redirectUri, " ... (or paste the redirect URL here)\n"));
+                            // Both sources run at once. The listener is the happy path, and the prompt is the way out
+                            // when the browser cannot reach this process's loopback interface at all (an SSH session,
+                            // a container) — without it that case would just sit here until the listener timed out.
+                            controller = new AbortController();
+                            prompt = promptLine({
+                                question: '',
+                                signal: controller.signal
+                            });
+                            redirected = capture.waitForRedirect(listenForMs);
+                            // Whichever source loses is abandoned mid-flight; its rejection is expected, not unhandled.
+                            prompt.catch(noop);
+                            redirected.catch(noop);
+                            _state.label = 14;
+                        case 14:
+                            _state.trys.push([
+                                14,
+                                16,
+                                18,
+                                19
+                            ]);
+                            return [
+                                4,
+                                Promise.race([
+                                    redirected,
+                                    prompt
+                                ])
+                            ];
+                        case 15:
+                            pasted = _state.sent();
+                            return [
+                                3,
+                                19
+                            ];
+                        case 16:
+                            e1 = _state.sent();
+                            // Only the listener's timeout reaches here — the prompt is still open, so keep waiting on it.
+                            process.stderr.write("".concat(e1.message, "\n"));
+                            return [
+                                4,
+                                prompt
+                            ];
+                        case 17:
+                            pasted = _state.sent();
+                            return [
+                                3,
+                                19
+                            ];
+                        case 18:
+                            // Released only once a winner is settled. Aborting from inside the redirect's own `then`
+                            // instead would reject the prompt a microtask BEFORE the redirect resolved, and the race
+                            // would hand back that rejection rather than the code it just captured.
+                            controller.abort();
+                            return [
+                                7
+                            ];
+                        case 19:
+                            return [
+                                3,
+                                22
+                            ];
+                        case 20:
                             return [
                                 4,
                                 promptLine({
                                     question: 'Paste redirect URL or code: '
                                 })
                             ];
-                        case 5:
-                            _tmp = _state.sent();
-                            _state.label = 6;
-                        case 6:
-                            pasted = _tmp;
+                        case 21:
+                            pasted = _state.sent();
+                            _state.label = 22;
+                        case 22:
+                            return [
+                                3,
+                                25
+                            ];
+                        case 23:
+                            // Unconditional: a listener left bound keeps the process alive well past the command.
+                            return [
+                                4,
+                                capture === null || capture === void 0 ? void 0 : capture.close()
+                            ];
+                        case 24:
+                            _state.sent();
+                            return [
+                                7
+                            ];
+                        case 25:
                             code = parsePastedRedirect({
                                 pasted: pasted,
                                 expectedState: state
@@ -9117,12 +9402,12 @@ function resolveAuthSetupPrompt(input) {
                                     tokenEndpoint: meta.token_endpoint,
                                     clientId: env.clientId,
                                     clientSecret: env.clientSecret,
-                                    redirectUri: env.redirectUri,
+                                    redirectUri: redirectUri,
                                     code: code,
                                     codeVerifier: codeVerifier
                                 })
                             ];
-                        case 7:
+                        case 26:
                             tokenResponse = _state.sent();
                             expiresAt = Date.now() + ((_tokenResponse_expires_in = tokenResponse.expires_in) !== null && _tokenResponse_expires_in !== void 0 ? _tokenResponse_expires_in : 0) * 1000;
                             return [
@@ -9132,9 +9417,9 @@ function resolveAuthSetupPrompt(input) {
                                     accessToken: tokenResponse.access_token
                                 })
                             ];
-                        case 8:
+                        case 27:
                             sessionInfo = _state.sent();
-                            sessionExpiresAt = (_ref = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.expiresAt) !== null && _ref !== void 0 ? _ref : undefined;
+                            sessionExpiresAt = (_ref1 = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.expiresAt) !== null && _ref1 !== void 0 ? _ref1 : undefined;
                             rotationDisabled = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.rotationDisabled;
                             entry = _object_spread$Q({
                                 accessToken: tokenResponse.access_token,
@@ -9152,7 +9437,7 @@ function resolveAuthSetupPrompt(input) {
                                 4,
                                 tokens.set(envName, entry)
                             ];
-                        case 9:
+                        case 28:
                             _state.sent();
                             sessionSummary = describeSessionLifetime({
                                 sessionExpiresAt: sessionExpiresAt,
@@ -9216,7 +9501,7 @@ function resolveAuthSetupPrompt(input) {
                             ];
                         case 2:
                             entry = _state.sent();
-                            if (!(argv.revoke && (entry === null || entry === void 0 ? void 0 : entry.refreshToken) && env.clientId && env.clientSecret)) return [
+                            if (!(argv.revoke && (entry === null || entry === void 0 ? void 0 : entry.refreshToken) && env.clientId)) return [
                                 3,
                                 8
                             ];
@@ -12550,7 +12835,7 @@ function _unsupported_iterable_to_array$$(o, minLen) {
                 return _ts_generator$17(this, function(_state) {
                     switch(_state.label){
                         case 0:
-                            if (!(!envName || !(env === null || env === void 0 ? void 0 : env.clientId) || !(env === null || env === void 0 ? void 0 : env.clientSecret))) return [
+                            if (!(!envName || !(env === null || env === void 0 ? void 0 : env.clientId))) return [
                                 3,
                                 1
                             ];
@@ -13754,7 +14039,7 @@ function runFirestoreSessionProbe(input) {
                         7
                     ];
                 case 2:
-                    if (!((entry === null || entry === void 0 ? void 0 : entry.refreshToken) && env.clientId && env.clientSecret)) return [
+                    if (!((entry === null || entry === void 0 ? void 0 : entry.refreshToken) && env.clientId)) return [
                         3,
                         7
                     ];
@@ -69078,4 +69363,4 @@ function printPaginatedOutput(input) {
     })();
 }
 
-export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILD_DRIFT_DOCTOR_CHECK_NAME, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER, CLI_DATA_CACHE_CYCLE_ERROR_CODE, CLI_DATA_CACHE_FINGERPRINT_LENGTH, CLI_DATA_CACHE_GLOBAL_OPTION_NAMES, CLI_DATA_CACHE_INDEX_FILE_NAME, CLI_DATA_CACHE_SCHEMA_VERSION, CLI_DATA_CACHE_UNSUPPORTED_VALUE_ERROR_CODE, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CLI_FIRESTORE_QUERY_DATASET_PREFIX, CLI_FIRESTORE_QUERY_DATASET_VERSION, CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS, CLI_FIRESTORE_SESSION_MAX_CACHE_MS, CLI_FRAMEWORK_PACKAGE_PREFIX, CLI_READ_VIA_EPILOGUE, CLI_READ_VIA_VALUES, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_CODEC, DEFAULT_CLI_DATA_CACHE_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_MAX_AGE_HOURS, DEFAULT_CLI_DATA_CACHE_OPTIONS, DEFAULT_CLI_FIREBASE_EMULATOR_HOST, DEFAULT_CLI_HTTP_TIMEOUT_MS, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_READ_VIA, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FIRESTORE_GET_COMMAND_NAME, DEFAULT_FIRESTORE_QUERIES_COMMAND_NAME, DEFAULT_FIRESTORE_QUERY_COMMAND_NAME, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DISABLED_CLI_DATA_CACHE_OPTIONS, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FIRESTORE_COLLECTION_UNRESOLVABLE_CODE, FIRESTORE_QUERY_PARENT_REQUIRED_CODE, FIRESTORE_QUERY_UNAVAILABLE_CODE, FIRESTORE_SDK_IDENTITY_STAGE, FIRESTORE_SDK_INSTANCE_MISMATCH_CODE, FIRESTORE_SESSION_API_PATH, FIRESTORE_SESSION_DOCTOR_CHECK_NAME, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_IS_SERVER_ONLY_CODE, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, ROUTE_MANIFEST_VERSION, ROUTE_MODEL_LIST_TAG, ROUTE_MODEL_TAG, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, STDIN_NOT_PIPED_ERROR_CODE, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, appendCliErrorMapper, applyEnvVarOverrides, assertCliFirestoreQueryCanRun, assertCliFirestoreQueryParentKey, assertCliModelIsNotServerOnly, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildFirestoreGetCommand, buildFirestoreQueriesCommand, buildFirestoreQueryCommand, buildFirestoreSessionDoctorReadRouting, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildPipesManifest, buildRouteManifest, buildRouteTree, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, canonicalCliCacheJson, checkCliDataCacheArgv, clearDownstreamCatalogCache, cliBuildDriftDescription, cliCacheFingerprint, cliDataCacheKey, cliDataCacheMeta, cliDataCacheOptions, cliDataCachePathSegment, cliFirebaseAppName, cliFirebaseEmulatorsInUse, cliFirestoreAccessorFactory, cliFirestoreBinding, cliFirestoreCollectionForQuery, cliFirestoreErrorMapper, cliFirestoreQueryConstraints, cliFirestoreQueryMode, cliFirestoreQueryModeForRules, cliFirestoreSdkIdentitySuggestion, cliFirestoreSessionEntryExpiresAt, cliFirestoreWiringError, cliLifecycleRunner, cliReadResultMeta, closeAllCliFirebaseApps, closeCliFirestoreSessionContext, coerceCliReadVia, collectClassPropertiesWithInheritance, computeRelativeSpecifiers, configureCliDataCacheOptions, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCacheCommand, createCallModelCommand, createCli, createCliBuildDriftDoctorCheck, createCliContext, createCliDataCache, createCliFirestoreModels, createCliFirestoreQueryRegistry, createCliFirestoreSessionCacheStore, createCliFirestoreSessionContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createFirestoreSessionDoctorCheck, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, describeCliFirestoreQueryMode, detectDataHelpFormat, detectHelpMode, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractComponentRouteModelTags, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFile, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUrlParamKeys, extractUtilEntries, fetchFirestoreSession, fetchSessionInfo, fetchUserInfo, filterCliFirestoreQueries, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, flattenList, formatGeneratedTs, fromCliCacheJson, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverFirestore, getModelOverHttp, getMultipleModelsOverFirestore, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, hasParamSegment, indentLines$1 as indentLines, inspectCliBuildDrift, inspectCliFirestoreSdkIdentity, isCliEnvConfigComplete, isCliFirebaseConfigComplete, isCliFirestoreQueryInvocable, isCliFirestoreSessionExpired, isCliVerbose, isCoreTopic, isEntryExpired, isExportedFromPackage, isStdinPositionalSentinel, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadOrBuildCliCachedData, loadPackageName, loadPipeManifests, loadPipeRegistry, loadRouteTree, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, matchUrlAgainstEntries, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeCliFirebaseConfig, mergeOutputConfig, normalizeCliCacheFilter, normalizePathname, oidcRelyingPartyErrorToCliError, openStreamingDump, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseFirestoreModelIdentityArgs, parseGetArgs, parseGetManyArgs, parsePastedRedirect, parseRouteModelTag, parseScanArgs, pickFields, promptLine, readAllStdin, readCliArtifactPackage, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderCliFirestoreQueryEntry, renderCliFirestoreQueryList, renderDecodedKey, renderGroupedImportLines, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, renderTable, requireCliContext, requireCliFirestoreContext, requireCliFirestoreModels, requireCliFirestoreSession, resolveActiveEnvName, resolveCliDataCacheOptions, resolveCliEnv, resolveCliEnvOrThrow, resolveCliFirestoreQueryArgs, resolveCliFirestoreQueryEntry, resolveCliModel, resolveCliReadSource, resolveComponentSourceFromSources, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveExtendsName, resolveModelArchetype, resolveOutputConfig, resolveOxfmtConfig, resolvePerModelGetKey, resolveRouteSources, revokeToken, runActionsScanCli, runCli, runCliFirestoreQuery, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, saveCliConfig, scanFactoryReferences, scoreCandidates, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliRawArgv, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, splitSegments, stripUrlQueryAndHash, toActionEntryInfo, toCliCacheJson, toFilterEntryInfo, toFormFieldInfo, tracedFetch, truncate, tryMatchSegments, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler, writeGeneratedTsFile };
+export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILD_DRIFT_DOCTOR_CHECK_NAME, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER, CLI_DATA_CACHE_CYCLE_ERROR_CODE, CLI_DATA_CACHE_FINGERPRINT_LENGTH, CLI_DATA_CACHE_GLOBAL_OPTION_NAMES, CLI_DATA_CACHE_INDEX_FILE_NAME, CLI_DATA_CACHE_SCHEMA_VERSION, CLI_DATA_CACHE_UNSUPPORTED_VALUE_ERROR_CODE, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CLI_FIRESTORE_QUERY_DATASET_PREFIX, CLI_FIRESTORE_QUERY_DATASET_VERSION, CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS, CLI_FIRESTORE_SESSION_MAX_CACHE_MS, CLI_FRAMEWORK_PACKAGE_PREFIX, CLI_READ_VIA_EPILOGUE, CLI_READ_VIA_VALUES, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_CODEC, DEFAULT_CLI_DATA_CACHE_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_MAX_AGE_HOURS, DEFAULT_CLI_DATA_CACHE_OPTIONS, DEFAULT_CLI_FIREBASE_EMULATOR_HOST, DEFAULT_CLI_HTTP_TIMEOUT_MS, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_READ_VIA, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FIRESTORE_GET_COMMAND_NAME, DEFAULT_FIRESTORE_QUERIES_COMMAND_NAME, DEFAULT_FIRESTORE_QUERY_COMMAND_NAME, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DISABLED_CLI_DATA_CACHE_OPTIONS, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FIRESTORE_COLLECTION_UNRESOLVABLE_CODE, FIRESTORE_QUERY_PARENT_REQUIRED_CODE, FIRESTORE_QUERY_UNAVAILABLE_CODE, FIRESTORE_SDK_IDENTITY_STAGE, FIRESTORE_SDK_INSTANCE_MISMATCH_CODE, FIRESTORE_SESSION_DOCTOR_CHECK_NAME, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, LOOPBACK_REDIRECT_HOSTNAMES, LOOPBACK_REDIRECT_LISTEN_FAILED_ERROR_CODE, LOOPBACK_REDIRECT_TIMEOUT_ERROR_CODE, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_IS_SERVER_ONLY_CODE, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, ROUTE_MANIFEST_VERSION, ROUTE_MODEL_LIST_TAG, ROUTE_MODEL_TAG, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, STDIN_NOT_PIPED_ERROR_CODE, SUGGESTED_CLI_LOOPBACK_REDIRECT_PORT, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, appendCliErrorMapper, applyEnvVarOverrides, assertCliFirestoreQueryCanRun, assertCliFirestoreQueryParentKey, assertCliModelIsNotServerOnly, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildFirestoreGetCommand, buildFirestoreQueriesCommand, buildFirestoreQueryCommand, buildFirestoreSessionDoctorReadRouting, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildPipesManifest, buildRouteManifest, buildRouteTree, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, canonicalCliCacheJson, checkCliDataCacheArgv, clearDownstreamCatalogCache, cliBuildDriftDescription, cliCacheFingerprint, cliDataCacheKey, cliDataCacheMeta, cliDataCacheOptions, cliDataCachePathSegment, cliFirebaseEmulatorsInUse, cliFirestoreAccessorFactory, cliFirestoreBinding, cliFirestoreCollectionForQuery, cliFirestoreErrorMapper, cliFirestoreQueryConstraints, cliFirestoreQueryMode, cliFirestoreQueryModeForRules, cliFirestoreSdkIdentitySuggestion, cliFirestoreSessionEntryExpiresAt, cliFirestoreSessionErrorFactory, cliFirestoreSessionFetcher, cliFirestoreWiringError, cliLifecycleRunner, cliReadResultMeta, closeAllCliFirebaseApps, closeCliFirestoreSessionContext, coerceCliReadVia, collectClassPropertiesWithInheritance, computeRelativeSpecifiers, configureCliDataCacheOptions, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCacheCommand, createCallModelCommand, createCli, createCliBuildDriftDoctorCheck, createCliContext, createCliDataCache, createCliFirestoreModels, createCliFirestoreQueryRegistry, createCliFirestoreSessionCacheStore, createCliFirestoreSessionContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createFirestoreSessionDoctorCheck, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, describeCliFirestoreQueryMode, detectDataHelpFormat, detectHelpMode, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractComponentRouteModelTags, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFile, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUrlParamKeys, extractUtilEntries, fetchFirestoreSession, fetchSessionInfo, fetchUserInfo, filterCliFirestoreQueries, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, flattenList, formatGeneratedTs, fromCliCacheJson, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverFirestore, getModelOverHttp, getMultipleModelsOverFirestore, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, hasParamSegment, indentLines$1 as indentLines, inspectCliBuildDrift, inspectCliFirestoreSdkIdentity, isCliEnvConfigComplete, isCliFirebaseConfigComplete, isCliFirestoreQueryInvocable, isCliFirestoreSessionExpired, isCliVerbose, isCoreTopic, isEntryExpired, isExportedFromPackage, isStdinPositionalSentinel, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadOrBuildCliCachedData, loadPackageName, loadPipeManifests, loadPipeRegistry, loadRouteTree, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, matchUrlAgainstEntries, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeCliFirebaseConfig, mergeOutputConfig, normalizeCliCacheFilter, normalizePathname, oidcRelyingPartyErrorToCliError, openStreamingDump, openUrlInBrowser, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseFirestoreModelIdentityArgs, parseGetArgs, parseGetManyArgs, parseLoopbackRedirectUri, parsePastedRedirect, parseRouteModelTag, parseScanArgs, pickFields, promptLine, readAllStdin, readCliArtifactPackage, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderCliFirestoreQueryEntry, renderCliFirestoreQueryList, renderDecodedKey, renderGroupedImportLines, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, renderTable, requireCliContext, requireCliFirestoreContext, requireCliFirestoreModels, requireCliFirestoreSession, resolveActiveEnvName, resolveCliDataCacheOptions, resolveCliEnv, resolveCliEnvOrThrow, resolveCliFirestoreQueryArgs, resolveCliFirestoreQueryEntry, resolveCliModel, resolveCliReadSource, resolveComponentSourceFromSources, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveExtendsName, resolveModelArchetype, resolveOutputConfig, resolveOxfmtConfig, resolvePerModelGetKey, resolveRouteSources, revokeToken, runActionsScanCli, runCli, runCliFirestoreQuery, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, saveCliConfig, scanFactoryReferences, scoreCandidates, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliRawArgv, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, splitSegments, startLoopbackRedirectCapture, stripUrlQueryAndHash, toActionEntryInfo, toCliCacheJson, toFilterEntryInfo, toFormFieldInfo, tracedFetch, truncate, tryMatchSegments, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler, writeGeneratedTsFile };