@dereekb/dbx-cli 14.3.0 → 14.4.0

package/lint-cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli-lint-cache",
-  "version": "14.3.0",
+  "version": "14.4.0",
   "sideEffects": false,
   "private": true,
   "type": "module",
@@ -9,7 +9,7 @@
     "eslint": "10.9.1"
   },
   "peerDependencies": {
-    "@dereekb/util": "14.3.0",
+    "@dereekb/util": "14.4.0",
     "yargs": "^18.0.0"
   }
 }

package/manifest-extract/package.json

@@ -1,18 +1,22 @@
 {
   "name": "@dereekb/dbx-cli/manifest-extract",
-  "version": "14.3.0",
+  "version": "14.4.0",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/date": "14.3.0",
-    "@dereekb/dbx-cli": "14.3.0",
-    "@dereekb/firebase": "14.3.0",
-    "@dereekb/model": "14.3.0",
-    "@dereekb/nestjs": "14.3.0",
-    "@dereekb/rxjs": "14.3.0",
-    "@dereekb/util": "14.3.0",
+    "@dereekb/date": "14.4.0",
+    "@dereekb/dbx-cli": "14.4.0",
+    "@dereekb/firebase": "14.4.0",
+    "@dereekb/model": "14.4.0",
+    "@dereekb/nestjs": "14.4.0",
+    "@dereekb/oauth-resource": "14.4.0",
+    "@dereekb/rxjs": "14.4.0",
+    "@dereekb/util": "14.4.0",
     "ts-morph": "^28.0.0"
   },
+  "devDependencies": {
+    "@dereekb/firebase": "14.4.0"
+  },
   "exports": {
     "./package.json": "./package.json",
     ".": {

package/model-test/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dereekb/dbx-cli/model-test",
-  "version": "14.3.0",
+  "version": "14.4.0",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/util": "14.3.0",
+    "@dereekb/util": "14.4.0",
     "ts-morph": "^28.0.0"
   },
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/dbx-cli",
-  "version": "14.3.0",
+  "version": "14.4.0",
   "type": "module",
   "sideEffects": false,
   "bin": {
@@ -66,11 +66,12 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/date": "14.3.0",
-    "@dereekb/firebase": "14.3.0",
-    "@dereekb/model": "14.3.0",
-    "@dereekb/nestjs": "14.3.0",
-    "@dereekb/util": "14.3.0",
+    "@dereekb/date": "14.4.0",
+    "@dereekb/firebase": "14.4.0",
+    "@dereekb/model": "14.4.0",
+    "@dereekb/nestjs": "14.4.0",
+    "@dereekb/oauth-resource": "14.4.0",
+    "@dereekb/util": "14.4.0",
     "@nestjs/common": "^12.0.1",
     "arktype": "^2.2.0",
     "firebase": "^12.18.0",
@@ -83,7 +84,9 @@
   "devDependencies": {
     "@angular/core": "22.1.4",
     "@types/yargs": "^17.0.35",
-    "eslint": "10.9.1"
+    "@typescript-eslint/parser": "8.69.0",
+    "eslint": "10.9.1",
+    "firebase": "^12.18.0"
   },
   "module": "./index.esm.js",
   "main": "./index.esm.js",

package/route/package.json

@@ -1,15 +1,16 @@
 {
   "name": "@dereekb/dbx-cli/route",
-  "version": "14.3.0",
+  "version": "14.4.0",
   "type": "module",
   "sideEffects": false,
   "peerDependencies": {
-    "@dereekb/date": "14.3.0",
-    "@dereekb/dbx-cli": "14.3.0",
-    "@dereekb/firebase": "14.3.0",
-    "@dereekb/model": "14.3.0",
-    "@dereekb/nestjs": "14.3.0",
-    "@dereekb/util": "14.3.0"
+    "@dereekb/date": "14.4.0",
+    "@dereekb/dbx-cli": "14.4.0",
+    "@dereekb/firebase": "14.4.0",
+    "@dereekb/model": "14.4.0",
+    "@dereekb/nestjs": "14.4.0",
+    "@dereekb/oauth-resource": "14.4.0",
+    "@dereekb/util": "14.4.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/src/lib/api/firestore-session.client.d.ts

@@ -1,33 +1,20 @@
+import { type FirestoreSessionCredentials, type FirestoreSessionErrorFactory } from '@dereekb/oauth-resource/firebase';
+export { FIRESTORE_SESSION_API_PATH } from '@dereekb/oauth-resource/firebase';
 /**
- * Path (relative to the API base URL) of the direct-Firestore session endpoint served by
- * `@dereekb/firebase-server`'s `SessionApiController`.
+ * The credential bundle `GET <apiBaseUrl>/session/firestore` returns.
  *
- * Duplicated here rather than imported so `dbx-cli` keeps no dependency on the server package —
- * the same arrangement `CALL_MODEL_API_PATH` uses.
+ * The CLI's name for {@link FirestoreSessionCredentials}, which is the shared implementation in
+ * `@dereekb/oauth-resource/firebase`.
  */
-export declare const FIRESTORE_SESSION_API_PATH = "/session/firestore";
+export type CliFirestoreSession = FirestoreSessionCredentials;
 /**
- * The credential bundle `GET <apiBaseUrl>/session/firestore` returns.
+ * Maps a generic session failure onto a {@link CliError}, re-attaching the CLI-flavored remediation
+ * an operator can act on (`<cli> auth login --env <env>` and friends).
+ *
+ * @param input - The generic failure.
+ * @returns The `CliError` to throw.
  */
-export interface CliFirestoreSession {
-    /**
-     * The uid the session was minted for.
-     */
-    readonly uid: string;
-    /**
-     * A Firebase Auth custom token to exchange via `signInWithCustomToken`.
-     */
-    readonly customToken: string;
-    /**
-     * An App Check attestation minted server-side for the project's registered web app. Absent when
-     * the API has no `appCheckAppId` configured (a project that does not enforce App Check).
-     */
-    readonly appCheckToken?: string;
-    /**
-     * ISO timestamp at which the session's shortest-lived credential expires.
-     */
-    readonly expiresAt: string;
-}
+export declare const cliFirestoreSessionErrorFactory: FirestoreSessionErrorFactory;
 export interface FetchFirestoreSessionInput {
     /**
      * The API base URL — typically `<host>/<project>/us-central1/api` or `https://<domain>/api`.
@@ -44,11 +31,18 @@ export interface FetchFirestoreSessionInput {
 /**
  * Fetches a direct-Firestore session from the API with the cached Bearer access token.
  *
- * The endpoint is admin-only and additionally gated on the `session.firestore` OIDC scope, so a 403
- * here usually means the logged-in user is not an admin or logged in without that scope.
+ * The thin CLI wrapper over `@dereekb/oauth-resource/firebase`'s `fetchFirestoreSession`: it binds
+ * the CLI's `tracedFetch` (so `--verbose` and `--timeout` apply) and the `CliError` factory.
  *
  * @param input - The API target, access token, and optional fetch override.
  * @returns The parsed {@link CliFirestoreSession}.
  * @throws {CliError} When the endpoint answers non-2xx or returns an unusable body.
  */
 export declare function fetchFirestoreSession(input: FetchFirestoreSessionInput): Promise<CliFirestoreSession>;
+/**
+ * Binds the CLI's verbose-trace + `--timeout` fetch behavior onto the supplied (or global) fetch.
+ *
+ * @param fetcher - The underlying fetch impl, when one was injected.
+ * @returns A `fetch`-shaped function carrying the CLI's tracing.
+ */
+export declare function cliFirestoreSessionFetcher(fetcher?: typeof fetch): typeof fetch;

package/src/lib/config/env.d.ts

@@ -1,4 +1,5 @@
 import { type Maybe, type OidcClientAuthMethod } from '@dereekb/util';
+import { type FirebaseClientConfig, type FirebaseClientEmulatorsConfig, firebaseClientEmulatorsInUse, isFirebaseClientConfigComplete } from '@dereekb/oauth-resource/firebase';
 import { type CliTokenEntry } from './token.cache';
 /**
  * The default OAuth/OIDC scopes requested by the CLI when none are configured.
@@ -117,67 +118,22 @@ export declare function mergeCliEnvWithDefault(input: MergeCliEnvWithDefaultInpu
  */
 export declare function mergeCliFirebaseConfig(env: Maybe<CliFirebaseConfig>, defaultEnv: Maybe<CliFirebaseConfig>): CliFirebaseConfig | undefined;
 /**
- * Local Firebase emulator targets for a CLI env.
- *
- * Mirrors the semantics of `DbxFirebaseEmulatorsConfig` in `@dereekb/dbx-firebase` (whose parse
- * helper is Angular-bound and not reusable here): the presence of this object means "use emulators"
- * unless {@link useEmulators} is explicitly `false`.
- *
- * App Check is auto-disabled whenever emulators are in use — the emulators do not verify
- * attestations, and `initializeAppCheck` against a fake project only gets in the way.
+ * Local Firebase emulator targets for a CLI env. The CLI's name for
+ * {@link FirebaseClientEmulatorsConfig}.
  */
-export interface CliFirebaseEmulatorsConfig {
-    /**
-     * Set `false` to keep the emulator targets configured but inactive. Defaults to `true`.
-     */
-    readonly useEmulators?: boolean;
-    /**
-     * Host the emulators are reachable at. Defaults to {@link DEFAULT_CLI_FIREBASE_EMULATOR_HOST}.
-     */
-    readonly host?: string;
-    /**
-     * Port of the Auth emulator. When unset, Auth is not redirected to an emulator.
-     */
-    readonly authPort?: number;
-    /**
-     * Port of the Firestore emulator. When unset, Firestore is not redirected to an emulator.
-     */
-    readonly firestorePort?: number;
-}
+export type CliFirebaseEmulatorsConfig = FirebaseClientEmulatorsConfig;
 /**
  * Firebase client-SDK configuration for a CLI env, used only by the direct-Firestore session
  * (`CliContext.getFirestoreContext`). Everything else the CLI does goes over the model HTTP API and
  * needs none of this.
  *
- * These are the same public values the app's browser client initializes with — copy them from the
- * target app's environment file. `appId` in particular must be the registered **web** app, since the
- * server mints its App Check attestation for that app.
+ * The CLI's name for {@link FirebaseClientConfig}: the same shape any resource server opening a
+ * user-scoped Firestore session supplies.
  */
-export interface CliFirebaseConfig {
-    /**
-     * The Firebase web API key.
-     */
-    readonly apiKey?: string;
-    /**
-     * The project's auth domain (e.g. `my-project.firebaseapp.com`).
-     */
-    readonly authDomain?: string;
-    /**
-     * The Firebase project id.
-     */
-    readonly projectId?: string;
-    /**
-     * The registered **web** app id (e.g. `1:1234567890:web:abcdef`).
-     */
-    readonly appId?: string;
-    /**
-     * Optional emulator targets for local development.
-     */
-    readonly emulators?: CliFirebaseEmulatorsConfig;
-}
+export type CliFirebaseConfig = FirebaseClientConfig;
 /**
  * Default host used for Firebase emulator connections when a {@link CliFirebaseEmulatorsConfig}
- * omits one.
+ * omits one. See {@link DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST}.
  */
 export declare const DEFAULT_CLI_FIREBASE_EMULATOR_HOST = "localhost";
 /**
@@ -187,17 +143,14 @@ export declare const DEFAULT_CLI_FIREBASE_EMULATOR_HOST = "localhost";
  * Deliberately separate from {@link isCliEnvConfigComplete}: the Firebase config is optional, and
  * folding it into the general completeness check would break every CLI that only uses the model API.
  *
- * @param firebase - The env's Firebase client config, if any.
- * @returns `true` when `apiKey`, `projectId`, and `appId` are all present and non-empty.
+ * See {@link isFirebaseClientConfigComplete}.
  */
-export declare function isCliFirebaseConfigComplete(firebase: Maybe<CliFirebaseConfig>): firebase is Required<Pick<CliFirebaseConfig, 'apiKey' | 'projectId' | 'appId'>> & CliFirebaseConfig;
+export declare const isCliFirebaseConfigComplete: typeof isFirebaseClientConfigComplete;
 /**
- * Returns true when the env's emulator config is present and active.
- *
- * @param firebase - The env's Firebase client config, if any.
- * @returns `true` when emulators are configured and not explicitly disabled.
+ * Returns true when the env's emulator config is present and active. See
+ * {@link firebaseClientEmulatorsInUse}.
  */
-export declare function cliFirebaseEmulatorsInUse(firebase: Maybe<CliFirebaseConfig>): boolean;
+export declare const cliFirebaseEmulatorsInUse: typeof firebaseClientEmulatorsInUse;
 /**
  * The OAuth client's registered `token_endpoint_auth_method`, as far as the CLI needs to model it.
  *

package/src/lib/config/firestore-session.cache.d.ts

@@ -1,40 +1,19 @@
-import { type AsyncKeyedValueCache, type Maybe } from '@dereekb/util';
-import { type CliFirestoreSession } from '../api/firestore-session.client';
+import { type FirestoreSessionCacheEntry, type FirestoreSessionCredentialsCache, firestoreSessionEntryExpiresAt, isFirestoreSessionExpired } from '@dereekb/oauth-resource/firebase';
 /**
  * Hard ceiling on how long a minted direct-Firestore session may be reused, regardless of what the
- * API reported in `expiresAt`.
- *
- * One hour, because that is the Firebase ceiling the credentials themselves sit under: a custom
- * token is exchangeable for one hour, and the ID token it mints lives one hour. Holding a session
- * past that buys nothing — the sign-in would fail — and re-minting is one HTTP round-trip.
+ * API reported in `expiresAt`. See {@link FIRESTORE_SESSION_MAX_CACHE_MS}.
  */
 export declare const CLI_FIRESTORE_SESSION_MAX_CACHE_MS: number;
 /**
- * Default skew/latency buffer applied when deciding whether a cached session is still usable.
+ * Default skew/latency buffer applied when deciding whether a cached session is still usable. See
+ * {@link FIRESTORE_SESSION_EXPIRY_BUFFER_MS}.
  */
-export declare const CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS = 60000;
+export declare const CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS: number;
 /**
- * A cached direct-Firestore session for a single env.
- *
- * Stores the credential envelope the API minted, not the live Firebase objects — those are
- * per-process and cannot be serialized. A cache hit still signs in; it just skips the
- * `GET /session/firestore` round-trip.
+ * A cached direct-Firestore session for a single env. The CLI's name for
+ * {@link FirestoreSessionCacheEntry}.
  */
-export interface CliFirestoreSessionEntry {
-    /**
-     * The credential bundle returned by `GET /session/firestore`.
-     */
-    readonly session: CliFirestoreSession;
-    /**
-     * Unix epoch milliseconds at which the entry was written.
-     */
-    readonly cachedAt: number;
-    /**
-     * The uid the entry was minted for, denormalized so a stale entry belonging to a different user
-     * can be detected without parsing the custom token.
-     */
-    readonly uid: string;
-}
+export type CliFirestoreSessionEntry = FirestoreSessionCacheEntry;
 /**
  * Firestore session cache shape on disk — keyed by env name.
  */
@@ -45,13 +24,18 @@ export type CliFirestoreSessionCache = Record<string, CliFirestoreSessionEntry>;
  * Backed by a single JSON file with per-process in-memory memoization, exactly like the token
  * cache — see {@link createMemoizedJsonFileAsyncKeyedValueCache}.
  */
-export type CliFirestoreSessionCacheStore = AsyncKeyedValueCache<CliFirestoreSessionEntry>;
+export type CliFirestoreSessionCacheStore = FirestoreSessionCredentialsCache;
 export interface CreateCliFirestoreSessionCacheStoreInput {
     readonly firestoreSessionCachePath: string;
 }
 /**
  * Creates a per-env direct-Firestore session cache store backed by a single JSON file.
  *
+ * The file-backed half of the session cache stays HERE rather than moving to
+ * `@dereekb/oauth-resource/firebase`: it depends on `@dereekb/nestjs`, and a Nest peer has no business
+ * in a package whose whole point is a clean install graph. Only the expiry policy and the
+ * {@link FirestoreSessionCredentialsCache} port are shared.
+ *
  * Entries are written with mode 0o600 — they hold a Firebase custom token, which is a bearer
  * credential for the user it was minted for.
  *
@@ -62,25 +46,12 @@ export interface CreateCliFirestoreSessionCacheStoreInput {
  */
 export declare function createCliFirestoreSessionCacheStore(input: CreateCliFirestoreSessionCacheStoreInput): CliFirestoreSessionCacheStore;
 /**
- * Resolves the epoch-millis instant at which a cached session stops being usable.
- *
- * The effective expiry is the EARLIER of the API-reported `expiresAt` and
- * {@link CLI_FIRESTORE_SESSION_MAX_CACHE_MS} past the write. Taking the earlier of the two means a
- * server that reports an over-long (or unparsable) window still cannot push a session past the
- * Firebase credential ceiling.
- *
- * @param entry - The cached entry.
- * @returns The effective expiry in unix epoch milliseconds.
- *
- * @__NO_SIDE_EFFECTS__
+ * Resolves the epoch-millis instant at which a cached session stops being usable. See
+ * {@link firestoreSessionEntryExpiresAt}.
  */
-export declare function cliFirestoreSessionEntryExpiresAt(entry: CliFirestoreSessionEntry): number;
+export declare const cliFirestoreSessionEntryExpiresAt: typeof firestoreSessionEntryExpiresAt;
 /**
- * Returns true when the cached session is at or near its effective expiry.
- *
- * @param entry - The cached entry (`null`/`undefined` is treated as expired).
- * @param nowMs - The current time in unix epoch milliseconds. Defaults to `Date.now()`.
- * @param bufferMs - Skew/latency buffer; the entry is treated as expired this far ahead of its effective expiry.
- * @returns `true` when the entry is unusable, otherwise `false`.
+ * Returns true when the cached session is at or near its effective expiry. See
+ * {@link isFirestoreSessionExpired}.
  */
-export declare function isCliFirestoreSessionExpired(entry: Maybe<CliFirestoreSessionEntry>, nowMs?: number, bufferMs?: number): boolean;
+export declare const isCliFirestoreSessionExpired: typeof isFirestoreSessionExpired;

package/src/lib/firestore/firestore.sdk-identity.d.ts

@@ -1,12 +1,9 @@
 import { type FirestoreModelKey, type FirestoreModelType } from '@dereekb/firebase';
 import { type Maybe } from '@dereekb/util';
+import { type FirebaseClientFirestoreIdentityContext, type FirebaseClientFirestoreIdentityProblem, type FirebaseClientFirestoreIdentityReport, type FirebaseClientFirestoreSdkModuleIdentity } from '@dereekb/oauth-resource/firebase';
 /**
- * The `drivers.firestoreDriverIdentifier` a client-SDK `FirestoreContext` reports.
- *
- * `clientFirebaseFirestoreContextFactory` stamps this; the server's
- * `googleCloudFirestoreContextFactory` stamps `@google-cloud/firestore` instead. Comparing against
- * it is how {@link inspectCliFirestoreSdkIdentity} tells an admin-SDK context handed to the CLI apart
- * from a genuinely broken client one.
+ * The `drivers.firestoreDriverIdentifier` a client-SDK `FirestoreContext` reports. See
+ * {@link CLIENT_FIRESTORE_DRIVER_IDENTIFIER}.
  */
 export declare const CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER = "@firebase/firestore";
 /**
@@ -22,94 +19,31 @@ export declare const FIRESTORE_SDK_IDENTITY_STAGE = "firestore-sdk-identity";
  */
 export declare const FIRESTORE_SDK_INSTANCE_MISMATCH_CODE = "FIRESTORE_SDK_INSTANCE_MISMATCH";
 /**
- * The distinct ways a session's Firestore handle can be unusable, in the order
- * {@link inspectCliFirestoreSdkIdentity} tests them — most specific diagnosis first.
- */
-export type CliFirestoreSdkIdentityProblem = 
-/**
- * `firestoreContext` is absent, or its `firestore` is null/undefined. Every `collection()` call
- * built off it throws `Expected first argument to collection() to be a CollectionReference, a
- * DocumentReference or FirebaseFirestore` — the SDK's message for ANY non-Firestore first
- * argument, which is why it never named this.
- */
-'no-firestore-handle'
-/**
- * The context reports a driver other than {@link CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER} — an
- * admin/`@google-cloud/firestore` context reached the client-SDK read path.
- */
- | 'unexpected-driver'
-/**
- * Two copies of `@firebase/firestore` are loaded, so the handle minted by one fails the other's
- * brand check.
+ * `CliError` code for a collection/document reference the SDK refused to build for a reason the
+ * wiring identity check cannot explain — a bad `--parent`, or an app collection whose own
+ * construction is broken.
  */
- | 'duplicated-firestore-sdk'
+export declare const FIRESTORE_COLLECTION_UNRESOLVABLE_CODE = "FIRESTORE_COLLECTION_UNRESOLVABLE";
 /**
- * The handle is present and the driver looks right, but it is not an instance of THIS copy of the
- * SDK's `Firestore` class and no duplicate install explains it.
+ * The distinct ways a session's Firestore handle can be unusable. See
+ * {@link FirebaseClientFirestoreIdentityProblem}.
  */
- | 'foreign-firestore-instance';
+export type CliFirestoreSdkIdentityProblem = FirebaseClientFirestoreIdentityProblem;
 /**
- * Where one consumer resolved `@firebase/firestore` to, and at which version.
- *
- * Reported for both `@dereekb/dbx-cli` and `@dereekb/firebase` because the whole point of the
- * duplicated-SDK hypothesis is that those two answers can differ.
+ * Where one consumer resolved `@firebase/firestore` to, and at which version. See
+ * {@link FirebaseClientFirestoreSdkModuleIdentity}.
  */
-export interface CliFirestoreSdkModuleIdentity {
-    /**
-     * The resolved package directory, or `undefined` when resolution failed.
-     */
-    readonly packageDir?: Maybe<string>;
-    readonly version?: Maybe<string>;
-    /**
-     * Why resolution failed, when it did.
-     */
-    readonly error?: Maybe<string>;
-}
+export type CliFirestoreSdkModuleIdentity = FirebaseClientFirestoreSdkModuleIdentity;
 /**
- * The provenance + brand-check report {@link inspectCliFirestoreSdkIdentity} produces.
- *
- * Everything here is reported whether or not the check passed: a `sdkDuplicated: true` alongside
- * `ok: true` is a latent hazard worth seeing before it becomes an outage.
+ * The provenance + brand-check report {@link inspectCliFirestoreSdkIdentity} produces. See
+ * {@link FirebaseClientFirestoreIdentityReport}.
  */
-export interface CliFirestoreSdkIdentityReport {
-    readonly ok: boolean;
-    readonly problem?: CliFirestoreSdkIdentityProblem;
-    readonly firestorePresent: boolean;
-    /**
-     * Whether the handle passes `instanceof Firestore` against the copy of `@firebase/firestore` THIS
-     * package loaded.
-     */
-    readonly firestoreIsSdkInstance: boolean;
-    /**
-     * The handle's constructor name, which distinguishes a duplicate `Firestore` (same name, different
-     * class) from a genuinely foreign object.
-     */
-    readonly firestoreConstructor?: Maybe<string>;
-    readonly firestoreDriverIdentifier?: Maybe<string>;
-    /**
-     * The version of the `firebase` umbrella package resolved at runtime.
-     */
-    readonly firebaseVersion?: Maybe<string>;
-    readonly sdkFromDbxCli: CliFirestoreSdkModuleIdentity;
-    readonly sdkFromDbxFirebase: CliFirestoreSdkModuleIdentity;
-    /**
-     * True when the two resolutions above name DIFFERENT package directories.
-     */
-    readonly sdkDuplicated: boolean;
-}
+export type CliFirestoreSdkIdentityReport = FirebaseClientFirestoreIdentityReport;
 /**
- * The slice of a session context {@link inspectCliFirestoreSdkIdentity} reads.
- *
- * Deliberately looser than `FirestoreContext`: this check exists precisely for the case where the
- * object is not the shape its declared type claims, so narrowing it here would assume away the
- * failure. A real `CliFirestoreSessionContext['firestoreContext']` is structurally assignable.
+ * The slice of a session context {@link inspectCliFirestoreSdkIdentity} reads. See
+ * {@link FirebaseClientFirestoreIdentityContext}.
  */
-export interface CliFirestoreSdkIdentityContext {
-    readonly firestore?: unknown;
-    readonly drivers?: {
-        readonly firestoreDriverIdentifier?: unknown;
-    };
-}
+export type CliFirestoreSdkIdentityContext = FirebaseClientFirestoreIdentityContext;
 /**
  * Input for {@link inspectCliFirestoreSdkIdentity}.
  */
@@ -117,20 +51,12 @@ export interface InspectCliFirestoreSdkIdentityInput {
     readonly firestoreContext?: Maybe<CliFirestoreSdkIdentityContext>;
 }
 /**
- * Checks that a session's Firestore handle is one THIS copy of the client SDK will accept, and
- * reports where every consumer resolved the SDK from.
- *
- * Exists because `collection()` refuses any non-`Firestore` first argument with one message —
- * `Expected first argument to collection() to be a CollectionReference, a DocumentReference or
- * FirebaseFirestore` — that names neither the model, nor the collection, nor which of the three
- * distinct causes ({@link CliFirestoreSdkIdentityProblem}) produced it. Every downstream CLI built on
- * `@dereekb/dbx-cli` shares that hazard, so the diagnosis belongs here rather than in an app.
+ * Checks that a session's Firestore handle is one the loaded client SDK will accept, and reports
+ * where every consumer resolved the SDK from.
  *
- * The `instanceof` test is the load-bearing one and it is deliberately NOT structural: an identity
- * check across the package boundary is the only thing that can detect a duplicated
- * `@firebase/firestore`, which is exactly what a structural check would hide. (Contrast
- * `firestore.error.ts`, which narrows a thrown `FirebaseError` structurally — there the goal is to
- * classify an error even when copies differ, so the tradeoff runs the other way.)
+ * The CLI wrapper over {@link inspectFirebaseClientFirestoreIdentity}: it supplies this package's own
+ * `require` as the resolution root and names the CLI in the report, so `doctor`'s output is unchanged
+ * by the move of the inspection core into `@dereekb/oauth-resource/firebase`.
  *
  * @param input - The session's `firestoreContext`, when one was built.
  * @returns The provenance + brand-check report.
@@ -149,12 +75,6 @@ export declare function inspectCliFirestoreSdkIdentity(input: InspectCliFirestor
  * @__NO_SIDE_EFFECTS__
  */
 export declare function cliFirestoreSdkIdentitySuggestion(report: CliFirestoreSdkIdentityReport): Maybe<string>;
-/**
- * `CliError` code for a collection/document reference the SDK refused to build for a reason the
- * wiring identity check cannot explain — a bad `--parent`, or an app collection whose own
- * construction is broken.
- */
-export declare const FIRESTORE_COLLECTION_UNRESOLVABLE_CODE = "FIRESTORE_COLLECTION_UNRESOLVABLE";
 /**
  * Input for {@link cliFirestoreWiringError}.
  */