@dereekb/dbx-cli 14.5.1 → 14.7.0

package/index.esm.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, writeFileSync, readFileSync, statSync, appendFileSync } from 'node:fs';
 import { join, dirname, resolve, sep, basename, relative, posix, isAbsolute, parse } from 'node:path';
-import { makeFirestoreCollectionGroup, addOrReplaceLimitInConstraints, CALL_MODEL_OIDC_SCOPES, CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, CALL_MODEL_OIDC_SCOPE_PREFIX, STORAGE_FILE_UPLOAD_USER_ROLE } from '@dereekb/firebase';
+import { twoWayFlatFirestoreModelKey, flatFirestoreModelKey, inferKeyFromTwoWayFlatFirestoreModelKey, makeFirestoreCollectionGroup, addOrReplaceLimitInConstraints, CALL_MODEL_OIDC_SCOPES, CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, CALL_MODEL_OIDC_SCOPE_PREFIX, STORAGE_FILE_UPLOAD_USER_ROLE } from '@dereekb/firebase';
 export { CALL_MODEL_APP_FUNCTION_KEY } from '@dereekb/firebase';
 import { createRequire } from 'node:module';
 import { CLIENT_FIRESTORE_DRIVER_IDENTIFIER, firebaseClientFirestoreIdentitySuggestion, inspectFirebaseClientFirestoreIdentity, fetchFirestoreSession as fetchFirestoreSession$1, DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST, firebaseClientEmulatorsInUse, isFirebaseClientConfigComplete, openFirebaseUserSession, closeFirebaseUserSession, closeFirebaseUserSessionApps, FIRESTORE_SESSION_EXPIRY_BUFFER_MS, FIRESTORE_SESSION_MAX_CACHE_MS, firestoreSessionEntryExpiresAt, isFirestoreSessionExpired } from '@dereekb/oauth-resource/firebase';
@@ -36,7 +36,7 @@ function _assert_this_initialized(self) {
     if (self === void 0) throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
     return self;
 }
-function asyncGeneratorStep$1v(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1w(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -47,16 +47,16 @@ function asyncGeneratorStep$1v(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1v(fn) {
+function _async_to_generator$1w(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1v(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1w(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1v(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1w(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -85,7 +85,7 @@ function _construct(Parent, args, Class) {
     }
     return _construct.apply(null, arguments);
 }
-function _define_property$11(obj, key, value) {
+function _define_property$14(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -115,7 +115,7 @@ function _inherits(subClass, superClass) {
     });
     if (superClass) _set_prototype_of(subClass, superClass);
 }
-function _instanceof$x(left, right) {
+function _instanceof$y(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -140,7 +140,7 @@ function _iterable_to_array$_(iter) {
 function _non_iterable_spread$_() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$10(target) {
+function _object_spread$13(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -150,12 +150,12 @@ function _object_spread$10(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$11(target, key, source[key]);
+            _define_property$14(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$J(object, enumerableOnly) {
+function ownKeys$L(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -163,11 +163,11 @@ function ownKeys$J(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$J(target, source) {
+function _object_spread_props$L(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$J(Object(source)).forEach(function(key) {
+        ownKeys$L(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -187,7 +187,7 @@ function _set_prototype_of(o, p) {
 function _to_consumable_array$_(arr) {
     return _array_without_holes$_(arr) || _iterable_to_array$_(arr) || _unsupported_iterable_to_array$1c(arr) || _non_iterable_spread$_();
 }
-function _ts_generator$1v(thisArg, body) {
+function _ts_generator$1w(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -411,10 +411,10 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
  * @param init - The RequestInit. Any existing `signal` is preserved; we only attach our own when no signal was supplied.
  * @returns The fetch Response.
  */ function tracedFetch(fetcher, input, init) {
-    return _async_to_generator$1v(function() {
+    return _async_to_generator$1w(function() {
         var _ref, fetchImpl, timeoutMs, method, url, controller, timeoutHandle, finalInit, // Don't let the abort timer itself keep the Node event loop (or a test worker) alive.
         _timeoutHandle_unref, localController, e;
-        return _ts_generator$1v(this, function(_state) {
+        return _ts_generator$1w(this, function(_state) {
             switch(_state.label){
                 case 0:
                     fetchImpl = fetcher !== null && fetcher !== void 0 ? fetcher : fetch;
@@ -422,7 +422,7 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
                     method = (_ref = init === null || init === void 0 ? void 0 : init.method) !== null && _ref !== void 0 ? _ref : 'GET';
                     if (typeof input === 'string') {
                         url = input;
-                    } else if (_instanceof$x(input, URL)) {
+                    } else if (_instanceof$y(input, URL)) {
                         url = input.toString();
                     } else {
                         url = input.url;
@@ -436,7 +436,7 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
                             return localController.abort();
                         }, timeoutMs);
                         (_timeoutHandle_unref = timeoutHandle.unref) === null || _timeoutHandle_unref === void 0 ? void 0 : _timeoutHandle_unref.call(timeoutHandle);
-                        finalInit = _object_spread_props$J(_object_spread$10({}, init), {
+                        finalInit = _object_spread_props$L(_object_spread$13({}, init), {
                             signal: localController.signal
                         });
                     }
@@ -600,7 +600,7 @@ function dumpResponse(data, meta) {
     if (!filePath) {
         return;
     }
-    var content = _object_spread$10({
+    var content = _object_spread$13({
         ok: true,
         data: data
     }, meta ? {
@@ -674,10 +674,21 @@ function stringifyEnvelope(value) {
  *
  * @param data - The command result to emit.
  * @param meta - Optional additional metadata to attach to the envelope.
- */ function outputResult(data, meta) {
+ * @param options - Optional per-command overrides — see {@link CliOutputResultOptions}.
+ */ function outputResult(data, meta, options) {
     dumpResponse(data, meta);
-    var outputData = _outputOptions.pick ? pickFields(data, _outputOptions.pick) : data;
-    var output = _object_spread$10({
+    var pick = _outputOptions.pick;
+    var outputData;
+    if (!pick) {
+        outputData = data;
+    } else if (options === null || options === void 0 ? void 0 : options.applyPick) {
+        outputData = options.applyPick(data, function(value) {
+            return pickFields(value, pick);
+        });
+    } else {
+        outputData = pickFields(data, pick);
+    }
+    var output = _object_spread$13({
         ok: true,
         data: outputData
     }, meta ? {
@@ -706,7 +717,7 @@ function stringifyEnvelope(value) {
         var _this;
         _this = _call_super(this, CliError, [
             input.message
-        ]), _define_property$11(_this, "code", void 0), _define_property$11(_this, "suggestion", void 0);
+        ]), _define_property$14(_this, "code", void 0), _define_property$14(_this, "suggestion", void 0);
         _this.name = 'CliError';
         _this.code = input.code;
         _this.suggestion = input.suggestion;
@@ -733,15 +744,15 @@ function stringifyEnvelope(value) {
     var result;
     if (mapped) {
         result = mapped;
-    } else if (_instanceof$x(error, CliError)) {
-        result = _object_spread$10({
+    } else if (_instanceof$y(error, CliError)) {
+        result = _object_spread$13({
             ok: false,
             error: sanitizeString(error.message),
             code: error.code
         }, error.suggestion ? {
             suggestion: error.suggestion
         } : {});
-    } else if (_instanceof$x(error, Error)) {
+    } else if (_instanceof$y(error, Error)) {
         result = {
             ok: false,
             error: sanitizeString(error.message),
@@ -765,7 +776,7 @@ function _array_like_to_array$1b(arr, len) {
 function _array_without_holes$Z(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$1b(arr);
 }
-function asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1v(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -776,22 +787,22 @@ function asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1u(fn) {
+function _async_to_generator$1v(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1v(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1v(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$10(obj, key, value) {
+function _define_property$13(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -810,7 +821,7 @@ function _iterable_to_array$Z(iter) {
 function _non_iterable_spread$Z() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$$(target) {
+function _object_spread$12(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -820,12 +831,12 @@ function _object_spread$$(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$10(target, key, source[key]);
+            _define_property$13(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$I(object, enumerableOnly) {
+function ownKeys$K(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -833,11 +844,11 @@ function ownKeys$I(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$I(target, source) {
+function _object_spread_props$K(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$I(Object(source)).forEach(function(key) {
+        ownKeys$K(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -846,7 +857,7 @@ function _object_spread_props$I(target, source) {
 function _to_consumable_array$Z(arr) {
     return _array_without_holes$Z(arr) || _iterable_to_array$Z(arr) || _unsupported_iterable_to_array$1b(arr) || _non_iterable_spread$Z();
 }
-function _ts_generator$1u(thisArg, body) {
+function _ts_generator$1v(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -970,9 +981,9 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The call envelope describing the API target, access token, model params, and optional fetch override.
  * @returns The parsed JSON response body cast to `R`.
  */ function callModelOverHttp(input) {
-    return _async_to_generator$1u(function() {
+    return _async_to_generator$1v(function() {
         var _input_params_call;
-        return _ts_generator$1u(this, function(_state) {
+        return _ts_generator$1v(this, function(_state) {
             return [
                 2,
                 requestJson({
@@ -1000,8 +1011,8 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The request envelope describing the API target, access token, model + key, and optional fetch override.
  * @returns The parsed `{ key, data }` envelope.
  */ function getModelOverHttp(input) {
-    return _async_to_generator$1u(function() {
-        return _ts_generator$1u(this, function(_state) {
+    return _async_to_generator$1v(function() {
+        return _ts_generator$1v(this, function(_state) {
             return [
                 2,
                 requestJson({
@@ -1029,8 +1040,8 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - The request envelope describing the API target, access token, model, keys, and optional fetch override.
  * @returns The parsed `{ results, errors }` envelope.
  */ function getMultipleModelsOverHttp(input) {
-    return _async_to_generator$1u(function() {
-        return _ts_generator$1u(this, function(_state) {
+    return _async_to_generator$1v(function() {
+        return _ts_generator$1v(this, function(_state) {
             if (input.keys.length === 0) {
                 throw new CliError({
                     message: 'get-many requires at least one key.',
@@ -1068,9 +1079,9 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
  * @param input - Same shape as {@link GetMultipleModelsOverHttpInput} but without the 50-key cap.
  * @returns The merged `{ results, errors }` envelope across all chunks.
  */ function getMultipleModelsOverHttpChunked(input) {
-    return _async_to_generator$1u(function() {
+    return _async_to_generator$1v(function() {
         var chunks, i, mergedResults, mergedErrors, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, chunk, _mergedResults, _mergedErrors, batch, err;
-        return _ts_generator$1u(this, function(_state) {
+        return _ts_generator$1v(this, function(_state) {
             switch(_state.label){
                 case 0:
                     if (input.keys.length === 0) {
@@ -1104,7 +1115,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                     chunk = _step.value;
                     return [
                         4,
-                        getMultipleModelsOverHttp(_object_spread_props$I(_object_spread$$({}, input), {
+                        getMultipleModelsOverHttp(_object_spread_props$K(_object_spread$12({}, input), {
                             keys: chunk
                         }))
                     ];
@@ -1158,15 +1169,15 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
     })();
 }
 function requestJson(input) {
-    return _async_to_generator$1u(function() {
+    return _async_to_generator$1v(function() {
         var hasJsonBody, init, res, _ref, ok, body, fallbackMessage;
-        return _ts_generator$1u(this, function(_state) {
+        return _ts_generator$1v(this, function(_state) {
             switch(_state.label){
                 case 0:
                     hasJsonBody = input.jsonBody !== undefined;
-                    init = _object_spread$$({
+                    init = _object_spread$12({
                         method: input.method,
-                        headers: _object_spread$$({
+                        headers: _object_spread$12({
                             Accept: 'application/json',
                             Authorization: "Bearer ".concat(input.accessToken)
                         }, hasJsonBody ? {
@@ -1203,9 +1214,9 @@ function requestJson(input) {
     })();
 }
 function readJsonResponse(res) {
-    return _async_to_generator$1u(function() {
+    return _async_to_generator$1v(function() {
         var text, body;
-        return _ts_generator$1u(this, function(_state) {
+        return _ts_generator$1v(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -1261,7 +1272,7 @@ function trimSlash(url) {
     return url.endsWith('/') ? url.slice(0, -1) : url;
 }
 
-function _instanceof$w(left, right) {
+function _instanceof$x(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -1350,7 +1361,7 @@ function _instanceof$w(left, right) {
  */ function cliFirestoreWiringError(input) {
     var error = input.error, operation = input.operation, modelType = input.modelType, collectionName = input.collectionName, parentKey = input.parentKey, firestoreContext = input.firestoreContext;
     var result;
-    if (_instanceof$w(error, CliError)) {
+    if (_instanceof$x(error, CliError)) {
         result = error;
     } else {
         var _cliFirestoreSdkIdentitySuggestion, _report_firestoreDriverIdentifier, _report_sdkFromConsumer_version, _report_sdkFromConsumer_packageDir;
@@ -1364,7 +1375,7 @@ function _instanceof$w(left, right) {
         var report = inspectCliFirestoreSdkIdentity({
             firestoreContext: firestoreContext
         });
-        var message = "Could not ".concat(operation, " (").concat(facts.join(', '), "): ").concat(_instanceof$w(error, Error) ? error.message : String(error));
+        var message = "Could not ".concat(operation, " (").concat(facts.join(', '), "): ").concat(_instanceof$x(error, Error) ? error.message : String(error));
         result = new CliError({
             message: message,
             code: report.ok ? FIRESTORE_COLLECTION_UNRESOLVABLE_CODE : FIRESTORE_SDK_INSTANCE_MISMATCH_CODE,
@@ -1382,7 +1393,7 @@ function _array_like_to_array$1a(arr, len) {
 function _array_without_holes$Y(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$1a(arr);
 }
-function asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1393,16 +1404,16 @@ function asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1t(fn) {
+function _async_to_generator$1u(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1u(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -1419,7 +1430,7 @@ function _non_iterable_spread$Y() {
 function _to_consumable_array$Y(arr) {
     return _array_without_holes$Y(arr) || _iterable_to_array$Y(arr) || _unsupported_iterable_to_array$1a(arr) || _non_iterable_spread$Y();
 }
-function _ts_generator$1t(thisArg, body) {
+function _ts_generator$1u(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1568,9 +1579,9 @@ function _unsupported_iterable_to_array$1a(o, minLen) {
  * @returns The session-bound {@link CliFirestoreModels}.
  * @throws {CliError} When the CLI was not configured with a `firestore` binding, or the session cannot be opened.
  */ function requireCliFirestoreModels(context) {
-    return _async_to_generator$1t(function() {
+    return _async_to_generator$1u(function() {
         var getFirestoreModels;
-        return _ts_generator$1t(this, function(_state) {
+        return _ts_generator$1u(this, function(_state) {
             getFirestoreModels = context.getFirestoreModels;
             if (!getFirestoreModels) {
                 throw new CliError({
@@ -1731,7 +1742,7 @@ function tryReadCollectionIdentity(binding, collections, modelType) {
     return result;
 }
 
-function asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -1742,22 +1753,22 @@ function asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1s(fn) {
+function _async_to_generator$1t(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1t(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$$(obj, key, value) {
+function _define_property$12(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -1768,7 +1779,7 @@ function _define_property$$(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$_(target) {
+function _object_spread$11(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -1778,12 +1789,12 @@ function _object_spread$_(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$$(target, key, source[key]);
+            _define_property$12(target, key, source[key]);
         });
     }
     return target;
 }
-function _ts_generator$1s(thisArg, body) {
+function _ts_generator$1t(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -1905,7 +1916,7 @@ function _ts_generator$1s(thisArg, body) {
     // the 401/403 text is CLI-specific — it names the command an operator runs to fix it, which the
     // package-level wording deliberately cannot
     var suggestion = input.code === 'unauthorized' || input.code === 'forbidden' ? 'The direct-Firestore session endpoint is admin-only and requires the `session.firestore` scope. Run `<cli> auth login` with that scope as an admin user.' : input.suggestion;
-    return new CliError(_object_spread$_({
+    return new CliError(_object_spread$11({
         message: input.message,
         code: CLI_FIRESTORE_SESSION_ERROR_CODES[input.code]
     }, suggestion == null ? {} : {
@@ -1922,8 +1933,8 @@ function _ts_generator$1s(thisArg, body) {
  * @returns The parsed {@link CliFirestoreSession}.
  * @throws {CliError} When the endpoint answers non-2xx or returns an unusable body.
  */ function fetchFirestoreSession(input) {
-    return _async_to_generator$1s(function() {
-        return _ts_generator$1s(this, function(_state) {
+    return _async_to_generator$1t(function() {
+        return _ts_generator$1t(this, function(_state) {
             return [
                 2,
                 fetchFirestoreSession$1({
@@ -1947,7 +1958,7 @@ function _ts_generator$1s(thisArg, body) {
     };
 }
 
-function _define_property$_(obj, key, value) {
+function _define_property$11(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -1958,7 +1969,7 @@ function _define_property$_(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$Z(target) {
+function _object_spread$10(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -1968,12 +1979,12 @@ function _object_spread$Z(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$_(target, key, source[key]);
+            _define_property$11(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$H(object, enumerableOnly) {
+function ownKeys$J(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -1981,11 +1992,11 @@ function ownKeys$H(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$H(target, source) {
+function _object_spread_props$J(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$H(Object(source)).forEach(function(key) {
+        ownKeys$J(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -2128,7 +2139,7 @@ function _object_spread_props$H(target, source) {
     if (env || defaultEnv) {
         var _nonEmpty, _nonEmpty1, _nonEmpty2, _nonEmpty3;
         var emulators = mergeCliFirebaseEmulatorsConfig(env === null || env === void 0 ? void 0 : env.emulators, defaultEnv === null || defaultEnv === void 0 ? void 0 : defaultEnv.emulators);
-        result = _object_spread$Z({
+        result = _object_spread$10({
             apiKey: (_nonEmpty = nonEmpty(env === null || env === void 0 ? void 0 : env.apiKey)) !== null && _nonEmpty !== void 0 ? _nonEmpty : nonEmpty(defaultEnv === null || defaultEnv === void 0 ? void 0 : defaultEnv.apiKey),
             authDomain: (_nonEmpty1 = nonEmpty(env === null || env === void 0 ? void 0 : env.authDomain)) !== null && _nonEmpty1 !== void 0 ? _nonEmpty1 : nonEmpty(defaultEnv === null || defaultEnv === void 0 ? void 0 : defaultEnv.authDomain),
             projectId: (_nonEmpty2 = nonEmpty(env === null || env === void 0 ? void 0 : env.projectId)) !== null && _nonEmpty2 !== void 0 ? _nonEmpty2 : nonEmpty(defaultEnv === null || defaultEnv === void 0 ? void 0 : defaultEnv.projectId),
@@ -2215,7 +2226,7 @@ function nonEmpty(value) {
     } else {
         var _ref, _ref1;
         var _input_env, _input_env1, _input_env2, _input_env3, _input_env4, _input_env5, _input_env6, _input_env7, _input_env8;
-        var firebase = mergeCliFirebaseConfig(_object_spread$Z({
+        var firebase = mergeCliFirebaseConfig(_object_spread$10({
             apiKey: firebaseApiKey,
             authDomain: firebaseAuthDomain,
             projectId: firebaseProjectId,
@@ -2227,7 +2238,7 @@ function nonEmpty(value) {
                 firestorePort: firebaseFirestoreEmulatorPort
             }
         } : undefined), (_input_env = input.env) === null || _input_env === void 0 ? void 0 : _input_env.firebase);
-        result = _object_spread$Z({
+        result = _object_spread$10({
             apiBaseUrl: (_ref = apiBaseUrl !== null && apiBaseUrl !== void 0 ? apiBaseUrl : (_input_env1 = input.env) === null || _input_env1 === void 0 ? void 0 : _input_env1.apiBaseUrl) !== null && _ref !== void 0 ? _ref : '',
             oidcIssuer: (_ref1 = oidcIssuer !== null && oidcIssuer !== void 0 ? oidcIssuer : (_input_env2 = input.env) === null || _input_env2 === void 0 ? void 0 : _input_env2.oidcIssuer) !== null && _ref1 !== void 0 ? _ref1 : '',
             appClientUrl: appClientUrl !== null && appClientUrl !== void 0 ? appClientUrl : (_input_env3 = input.env) === null || _input_env3 === void 0 ? void 0 : _input_env3.appClientUrl,
@@ -2281,7 +2292,7 @@ function parsePort(value) {
     if (refreshToken) {
         var accessToken = nonEmpty(process.env["".concat(prefix, "_ACCESS_TOKEN")]);
         var scope = nonEmpty(process.env["".concat(prefix, "_TOKEN_SCOPE")]);
-        result = _object_spread_props$H(_object_spread$Z({
+        result = _object_spread_props$J(_object_spread$10({
             accessToken: accessToken !== null && accessToken !== void 0 ? accessToken : '',
             refreshToken: refreshToken,
             // No reliable expiry is supplied via env, so force a refresh on first use (expiresAt 0 = expired).
@@ -2295,7 +2306,7 @@ function parsePort(value) {
     return result;
 }
 
-function asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2306,22 +2317,22 @@ function asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1r(fn) {
+function _async_to_generator$1s(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1s(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$Z(obj, key, value) {
+function _define_property$10(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -2332,7 +2343,7 @@ function _define_property$Z(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$Y(target) {
+function _object_spread$$(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -2342,12 +2353,12 @@ function _object_spread$Y(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$Z(target, key, source[key]);
+            _define_property$10(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$G(object, enumerableOnly) {
+function ownKeys$I(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -2355,17 +2366,17 @@ function ownKeys$G(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$G(target, source) {
+function _object_spread_props$I(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$G(Object(source)).forEach(function(key) {
+        ownKeys$I(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _ts_generator$1r(thisArg, body) {
+function _ts_generator$1s(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2481,9 +2492,9 @@ function _ts_generator$1r(thisArg, body) {
  * @returns The live {@link CliFirestoreSessionContext}.
  * @throws {CliError} When the env lacks Firebase client config, or any step of the handshake fails.
  */ function createCliFirestoreSessionContext(input) {
-    return _async_to_generator$1r(function() {
+    return _async_to_generator$1s(function() {
         var cliName, envName, env, accessToken, fetcher, sessionCache, _input_refreshSession, refreshSession, firebase, session;
-        return _ts_generator$1r(this, function(_state) {
+        return _ts_generator$1s(this, function(_state) {
             switch(_state.label){
                 case 0:
                     cliName = input.cliName, envName = input.envName, env = input.env, accessToken = input.accessToken, fetcher = input.fetcher, sessionCache = input.sessionCache, _input_refreshSession = input.refreshSession, refreshSession = _input_refreshSession === void 0 ? false : _input_refreshSession;
@@ -2516,7 +2527,7 @@ function _ts_generator$1r(thisArg, body) {
                     session = _state.sent();
                     return [
                         2,
-                        _object_spread_props$G(_object_spread$Y({}, session), {
+                        _object_spread_props$I(_object_spread$$({}, session), {
                             session: session.credentials
                         })
                     ];
@@ -2533,8 +2544,8 @@ function _ts_generator$1r(thisArg, body) {
  *
  * @param session - The session context to close.
  */ function closeCliFirestoreSessionContext(session) {
-    return _async_to_generator$1r(function() {
-        return _ts_generator$1r(this, function(_state) {
+    return _async_to_generator$1s(function() {
+        return _ts_generator$1s(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -2567,8 +2578,8 @@ function _ts_generator$1r(thisArg, body) {
  *   consumers in the same process are left alone.
  * @returns Resolves once every matching app has been deleted.
  */ function closeAllCliFirebaseApps(input) {
-    return _async_to_generator$1r(function() {
-        return _ts_generator$1r(this, function(_state) {
+    return _async_to_generator$1s(function() {
+        return _ts_generator$1s(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -2626,7 +2637,7 @@ function _ts_generator$1r(thisArg, body) {
     };
 }
 
-function asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2637,22 +2648,22 @@ function asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1q(fn) {
+function _async_to_generator$1r(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1r(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1q(thisArg, body) {
+function _ts_generator$1r(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2764,9 +2775,9 @@ function _ts_generator$1q(thisArg, body) {
  * @returns The opened (and memoized) direct-Firestore session.
  * @throws {CliError} When the context does not support direct-Firestore sessions.
  */ function requireCliFirestoreSession(context) {
-    return _async_to_generator$1q(function() {
+    return _async_to_generator$1r(function() {
         var getFirestoreSession;
-        return _ts_generator$1q(this, function(_state) {
+        return _ts_generator$1r(this, function(_state) {
             getFirestoreSession = context.getFirestoreSession;
             if (!getFirestoreSession) {
                 throw new CliError({
@@ -2793,8 +2804,8 @@ function _ts_generator$1q(thisArg, body) {
  * @returns The client `FirestoreContext` an app's collections factory consumes.
  * @throws {CliError} When the context does not support direct-Firestore sessions.
  */ function requireCliFirestoreContext(context) {
-    return _async_to_generator$1q(function() {
-        return _ts_generator$1q(this, function(_state) {
+    return _async_to_generator$1r(function() {
+        return _ts_generator$1r(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -2891,9 +2902,9 @@ var getCliContext = _cliContextSlot.get;
         return getFirestoreModelsForBinding(firestore);
     };
     function closeFirestoreSession() {
-        return _async_to_generator$1q(function() {
+        return _async_to_generator$1r(function() {
             var opened, session;
-            return _ts_generator$1q(this, function(_state) {
+            return _ts_generator$1r(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         opened = firestoreSession;
@@ -2972,7 +2983,7 @@ var getCliContext = _cliContextSlot.get;
     };
 }
 
-function asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2983,22 +2994,22 @@ function asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1p(fn) {
+function _async_to_generator$1q(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1p(thisArg, body) {
+function _ts_generator$1q(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3111,9 +3122,9 @@ function _ts_generator$1p(thisArg, body) {
  */ function wrapCommandHandler(handler) {
     var exitCode = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : CLI_EXIT_CODE_HANDLER;
     return function(argv) {
-        return _async_to_generator$1p(function() {
+        return _async_to_generator$1q(function() {
             var e;
-            return _ts_generator$1p(this, function(_state) {
+            return _ts_generator$1q(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         _state.trys.push([
@@ -3174,7 +3185,7 @@ function _ts_generator$1p(thisArg, body) {
     };
 }
 
-function asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3185,22 +3196,22 @@ function asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1o(fn) {
+function _async_to_generator$1p(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1p(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1o(thisArg, body) {
+function _ts_generator$1p(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3320,9 +3331,9 @@ function _ts_generator$1o(thisArg, body) {
             return spec.helpEpilogue ? built.epilogue(spec.helpEpilogue) : built;
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1o(function() {
+            return _async_to_generator$1p(function() {
                 var context, result;
-                return _ts_generator$1o(this, function(_state) {
+                return _ts_generator$1p(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             context = requireCliContext();
@@ -3546,7 +3557,7 @@ function _array_with_holes$o(arr) {
 function _array_without_holes$X(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$18(arr);
 }
-function asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -3557,22 +3568,22 @@ function asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1n(fn) {
+function _async_to_generator$1o(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1o(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$Y(obj, key, value) {
+function _define_property$$(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -3618,7 +3629,7 @@ function _non_iterable_rest$o() {
 function _non_iterable_spread$X() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$X(target) {
+function _object_spread$_(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -3628,12 +3639,12 @@ function _object_spread$X(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$Y(target, key, source[key]);
+            _define_property$$(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$F(object, enumerableOnly) {
+function ownKeys$H(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -3641,11 +3652,11 @@ function ownKeys$F(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$F(target, source) {
+function _object_spread_props$H(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$F(Object(source)).forEach(function(key) {
+        ownKeys$H(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -3657,7 +3668,7 @@ function _sliced_to_array$o(arr, i) {
 function _to_consumable_array$X(arr) {
     return _array_without_holes$X(arr) || _iterable_to_array$X(arr) || _unsupported_iterable_to_array$18(arr) || _non_iterable_spread$X();
 }
-function _ts_generator$1n(thisArg, body) {
+function _ts_generator$1o(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -3779,7 +3790,7 @@ var _defaultResponseAdapter = {
     }
 };
 function _defaultBuildRequestData(params, state, limit) {
-    var base = _object_spread$X({}, params);
+    var base = _object_spread$_({}, params);
     if (state.cursorDocumentKey != null) {
         base['cursorDocumentKey'] = state.cursorDocumentKey;
     }
@@ -3789,9 +3800,9 @@ function _defaultBuildRequestData(params, state, limit) {
     return base;
 }
 function _runItemTasks(input) {
-    return _async_to_generator$1n(function() {
+    return _async_to_generator$1o(function() {
         var context, items, keys, pageIndex, iterateItem, itemPerformTasksConfig, maxParallelPerPage, indexed, taskConfig, performResult;
-        return _ts_generator$1n(this, function(_state) {
+        return _ts_generator$1o(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, items = input.items, keys = input.keys, pageIndex = input.pageIndex, iterateItem = input.iterateItem, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -3803,7 +3814,7 @@ function _runItemTasks(input) {
                             itemIndex: itemIndex
                         };
                     });
-                    taskConfig = _object_spread_props$F(_object_spread$X({
+                    taskConfig = _object_spread_props$H(_object_spread$_({
                         sequential: true,
                         throwError: true
                     }, itemPerformTasksConfig), {
@@ -3836,9 +3847,9 @@ function _runItemTasks(input) {
     })();
 }
 function _processPage(input) {
-    return _async_to_generator$1n(function() {
+    return _async_to_generator$1o(function() {
         var context, raw, pageIndex, responseAdapter, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, items, keys, nextCursorDocumentKey, hasMore, itemResults, _tmp, pageResult, _tmp1, output;
-        return _ts_generator$1n(this, function(_state) {
+        return _ts_generator$1o(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, raw = input.raw, pageIndex = input.pageIndex, responseAdapter = input.responseAdapter, iterateItem = input.iterateItem, iteratePage = input.iteratePage, itemPerformTasksConfig = input.itemPerformTasksConfig, maxParallelPerPage = input.maxParallelPerPage;
@@ -3978,9 +3989,9 @@ function _evaluateLoopExit(input) {
  * });
  * ```
  */ function iterateDbxCliCallModel(config) {
-    return _async_to_generator$1n(function() {
+    return _async_to_generator$1o(function() {
         var context, modelType, call, specifier, params, _config_buildRequestData, buildRequestData, _config_responseAdapter, responseAdapter, limitPerPage, totalItemsLimit, maxPages, iterateItem, iteratePage, itemPerformTasksConfig, maxParallelPerPage, _config_collectItems, collectItems, _config_collectItemResults, collectItemResults, _config_collectPageResults, collectPageResults, allItems, allItemResults, allPageResults, pageIndex, totalItems, cursorDocumentKey, hitLimit, keepGoing, collectItemsForPage, collectItemResultsForPage, collectPageResultsForPage, effectiveLimit, data, raw, pageOutcome, _allItems, _allItemResults, exit, result;
-        return _ts_generator$1n(this, function(_state) {
+        return _ts_generator$1o(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = config.context, modelType = config.modelType, call = config.call, specifier = config.specifier, params = config.params, _config_buildRequestData = config.buildRequestData, buildRequestData = _config_buildRequestData === void 0 ? _defaultBuildRequestData : _config_buildRequestData, _config_responseAdapter = config.responseAdapter, responseAdapter = _config_responseAdapter === void 0 ? _defaultResponseAdapter : _config_responseAdapter, limitPerPage = config.limitPerPage, totalItemsLimit = config.totalItemsLimit, maxPages = config.maxPages, iterateItem = config.iterateItem, iteratePage = config.iteratePage, itemPerformTasksConfig = config.itemPerformTasksConfig, maxParallelPerPage = config.maxParallelPerPage, _config_collectItems = config.collectItems, collectItems = _config_collectItems === void 0 ? true : _config_collectItems, _config_collectItemResults = config.collectItemResults, collectItemResults = _config_collectItemResults === void 0 ? iterateItem != null : _config_collectItemResults, _config_collectPageResults = config.collectPageResults, collectPageResults = _config_collectPageResults === void 0 ? iteratePage != null : _config_collectPageResults;
@@ -4060,7 +4071,7 @@ function _evaluateLoopExit(input) {
                         1
                     ];
                 case 4:
-                    result = _object_spread$X({
+                    result = _object_spread$_({
                         totalPages: pageIndex,
                         totalItems: totalItems,
                         hitLimit: hitLimit,
@@ -4081,7 +4092,7 @@ function _evaluateLoopExit(input) {
     })();
 }
 
-function asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4092,22 +4103,22 @@ function asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1m(fn) {
+function _async_to_generator$1n(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1n(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$X(obj, key, value) {
+function _define_property$_(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4118,7 +4129,7 @@ function _define_property$X(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$W(target) {
+function _object_spread$Z(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4128,12 +4139,12 @@ function _object_spread$W(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$X(target, key, source[key]);
+            _define_property$_(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$E(object, enumerableOnly) {
+function ownKeys$G(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -4141,17 +4152,17 @@ function ownKeys$E(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$E(target, source) {
+function _object_spread_props$G(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$E(Object(source)).forEach(function(key) {
+        ownKeys$G(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _ts_generator$1m(thisArg, body) {
+function _ts_generator$1n(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4267,14 +4278,14 @@ function _ts_generator$1m(thisArg, body) {
             return spec.builder ? spec.builder(yargs) : yargs;
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1m(function() {
+            return _async_to_generator$1n(function() {
                 var context, data, params, result;
-                return _ts_generator$1m(this, function(_state) {
+                return _ts_generator$1n(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             context = requireCliContext();
                             data = spec.buildParams(argv);
-                            params = _object_spread_props$E(_object_spread$W({
+                            params = _object_spread_props$G(_object_spread$Z({
                                 modelType: spec.model,
                                 call: spec.verb
                             }, spec.specifier == null ? {} : {
@@ -4454,7 +4465,7 @@ function AsyncFromSyncIterator$4(s) {
         }
     }, new AsyncFromSyncIterator$4(s);
 }
-function asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4465,22 +4476,22 @@ function asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1l(fn) {
+function _async_to_generator$1m(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1m(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1l(thisArg, body) {
+function _ts_generator$1m(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4643,9 +4654,9 @@ function _ts_generator$1l(thisArg, body) {
  * @returns The UTF-8 decoded stdin contents.
  * @throws {CliError} When stdin is a TTY, with `code: 'STDIN_NOT_PIPED'`.
  */ function readAllStdin() {
-    return _async_to_generator$1l(function() {
+    return _async_to_generator$1m(function() {
         var chunks, _iteratorAbruptCompletion, _didIteratorError, _iteratorError, _iterator, _step, _value, chunk, err;
-        return _ts_generator$1l(this, function(_state) {
+        return _ts_generator$1m(this, function(_state) {
             switch(_state.label){
                 case 0:
                     if (process.stdin.isTTY) {
@@ -4749,9 +4760,9 @@ function _ts_generator$1l(thisArg, body) {
  *
  * @returns The tokens parsed from stdin.
  */ function readStdinTokens() {
-    return _async_to_generator$1l(function() {
+    return _async_to_generator$1m(function() {
         var raw;
-        return _ts_generator$1l(this, function(_state) {
+        return _ts_generator$1m(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -4771,7 +4782,7 @@ function _ts_generator$1l(thisArg, body) {
     })();
 }
 
-function asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -4782,22 +4793,22 @@ function asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1k(fn) {
+function _async_to_generator$1l(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1l(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$W(obj, key, value) {
+function _define_property$Z(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4808,13 +4819,13 @@ function _define_property$W(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$v(left, right) {
+function _instanceof$w(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
     } else return left instanceof right;
 }
-function _object_spread$V(target) {
+function _object_spread$Y(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -4824,12 +4835,12 @@ function _object_spread$V(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$W(target, key, source[key]);
+            _define_property$Z(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$D(object, enumerableOnly) {
+function ownKeys$F(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -4837,17 +4848,17 @@ function ownKeys$D(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$D(target, source) {
+function _object_spread_props$F(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$D(Object(source)).forEach(function(key) {
+        ownKeys$F(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _ts_generator$1k(thisArg, body) {
+function _ts_generator$1l(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -4958,9 +4969,9 @@ function _ts_generator$1k(thisArg, body) {
         return withCallModelArgs(yargs);
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$1k(function() {
+        return _async_to_generator$1l(function() {
             var context, data, rawData, _tmp, params, result;
-            return _ts_generator$1k(this, function(_state) {
+            return _ts_generator$1l(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -4995,12 +5006,12 @@ function _ts_generator$1k(thisArg, body) {
                                 data = JSON.parse(rawData);
                             } catch (e) {
                                 throw new CliError({
-                                    message: "--data must be valid JSON: ".concat(_instanceof$v(e, Error) ? e.message : String(e)),
+                                    message: "--data must be valid JSON: ".concat(_instanceof$w(e, Error) ? e.message : String(e)),
                                     code: 'INVALID_DATA_JSON'
                                 });
                             }
                         }
-                        params = _object_spread_props$D(_object_spread$V({
+                        params = _object_spread_props$F(_object_spread$Y({
                             modelType: argv.model,
                             call: argv.verb
                         }, argv.specifier == null ? {} : {
@@ -5032,7 +5043,7 @@ function _array_like_to_array$17(arr, len) {
 function _array_with_holes$n(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _instanceof$u(left, right) {
+function _instanceof$v(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -5220,7 +5231,7 @@ function isPlainObject(value) {
     var result;
     if (value === null || (typeof value === "undefined" ? "undefined" : _type_of$5(value)) !== 'object') {
         result = false;
-    } else if (Array.isArray(value) || _instanceof$u(value, Date)) {
+    } else if (Array.isArray(value) || _instanceof$v(value, Date)) {
         result = false;
     } else {
         // Objects from JSON.parse have Object.prototype as their proto. Anything
@@ -5239,6 +5250,17 @@ function _array_like_to_array$16(arr, len) {
 function _array_without_holes$W(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$16(arr);
 }
+function _define_property$Y(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
 function _iterable_to_array$W(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
         return Array.from(iter);
@@ -5247,6 +5269,39 @@ function _iterable_to_array$W(iter) {
 function _non_iterable_spread$W() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
+function _object_spread$X(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$Y(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$E(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$E(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    else {
+        ownKeys$E(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
 function _to_consumable_array$W(arr) {
     return _array_without_holes$W(arr) || _iterable_to_array$W(arr) || _unsupported_iterable_to_array$16(arr) || _non_iterable_spread$W();
 }
@@ -5309,16 +5364,91 @@ function runHandler$1(manifest, argv) {
 }
 /**
  * Splits `rawKey` on `/`, resolves each `[prefix, id]` pair against the
- * manifest, and returns the leaf segment + ancestor chain. Throws
+ * manifest, and returns the leaf segment + ancestor chain, plus the
+ * composite-key relationships declared on the manifest: the keys of models
+ * derived from this key (`derivedKeys`) and, for a two-way composite-key
+ * leaf, the recovered source key (`compositeSource`). Throws
  * {@link CliError} for malformed inputs.
  *
+ * Mirrors the `@dereekb/firebase-server/mcp` `model-decode` tool; both
+ * implementations must stay in lockstep on segment count, resolution order,
+ * and composite-key output.
+ *
  * @param rawKey - The Firestore key string.
  * @param manifest - The generated model manifest.
- * @returns The decoded key with leaf, ancestors, and any unresolved prefixes.
+ * @returns The decoded key with leaf, ancestors, unresolved prefixes, and composite-key relationships.
  * @throws {CliError} When `rawKey` is empty or does not parse into an even number of `prefix/id` segments.
  *
  * @__NO_SIDE_EFFECTS__
  */ function decodeFirestoreModelKey(rawKey, manifest) {
+    var _leafEntry_compositeKey;
+    var segments = decodeFirestoreModelKeySegments(rawKey, manifest);
+    var leafEntry = segments.leaf.modelType == null ? undefined : findCliModelManifestEntry(segments.leaf.prefix, manifest);
+    var derivedKeys = leafEntry == null ? [] : findCompositeKeyModelsDerivedFrom(leafEntry, manifest).map(function(entry) {
+        return toDerivedCompositeKey(segments.key, entry);
+    });
+    var compositeSource = (leafEntry === null || leafEntry === void 0 ? void 0 : (_leafEntry_compositeKey = leafEntry.compositeKey) === null || _leafEntry_compositeKey === void 0 ? void 0 : _leafEntry_compositeKey.encoding) === 'two-way' ? decodeTwoWayCompositeSource(segments.leaf.id, manifest) : undefined;
+    return _object_spread$X(_object_spread_props$E(_object_spread$X({}, segments), {
+        derivedKeys: derivedKeys
+    }), compositeSource == null ? {} : {
+        compositeSource: compositeSource
+    });
+}
+/**
+ * Resolves the manifest entries whose `compositeKey.from` names `source` — the models whose document
+ * id is derived from a `source` document's key. A wildcard `from=*` matches every model except
+ * `source` itself.
+ *
+ * @param source - The manifest entry of the decoded key's leaf model.
+ * @param manifest - The generated model manifest.
+ * @returns The composite-key entries derived from `source`, in manifest order.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function findCompositeKeyModelsDerivedFrom(source, manifest) {
+    return manifest.filter(function(entry) {
+        return entry.compositeKey != null && entry.modelType !== source.modelType && (entry.compositeKey.from === '*' || entry.compositeKey.from.some(function(name) {
+            return name === source.modelName || name === source.identityConst || name === source.modelType;
+        }));
+    });
+}
+function toDerivedCompositeKey(sourceKey, entry) {
+    var _ref;
+    var _entry_compositeKey;
+    var encoding = (_ref = (_entry_compositeKey = entry.compositeKey) === null || _entry_compositeKey === void 0 ? void 0 : _entry_compositeKey.encoding) !== null && _ref !== void 0 ? _ref : 'one-way';
+    var flatId = encoding === 'two-way' ? twoWayFlatFirestoreModelKey(sourceKey) : flatFirestoreModelKey(sourceKey);
+    return {
+        key: "".concat(entry.collectionPrefix, "/").concat(flatId),
+        modelType: entry.modelType,
+        modelName: entry.modelName,
+        collectionPrefix: entry.collectionPrefix,
+        encoding: encoding
+    };
+}
+function decodeTwoWayCompositeSource(flatId, manifest) {
+    var result;
+    if (flatId.includes('_')) {
+        var sourceKey = inferKeyFromTwoWayFlatFirestoreModelKey(flatId);
+        var segmentCount = sourceKey.split('/').filter(function(s) {
+            return s.length > 0;
+        }).length;
+        if (segmentCount >= 2 && segmentCount % 2 === 0) {
+            result = decodeFirestoreModelKeySegments(sourceKey, manifest);
+        }
+    }
+    return result;
+}
+/**
+ * Splits `rawKey` on `/` and resolves each `[prefix, id]` pair against the
+ * manifest — the segment walk shared by {@link decodeFirestoreModelKey} and
+ * the two-way composite-source decode.
+ *
+ * @param rawKey - The Firestore key string.
+ * @param manifest - The generated model manifest.
+ * @returns The decoded key with leaf, ancestors, and any unresolved prefixes.
+ * @throws {CliError} When `rawKey` is empty or does not parse into an even number of `prefix/id` segments.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function decodeFirestoreModelKeySegments(rawKey, manifest) {
     var trimmed = rawKey.trim();
     if (trimmed.length === 0) {
         throw new CliError({
@@ -5395,6 +5525,21 @@ function toSegment(prefix, id, entry) {
         var suffix = decoded.unresolvedPrefixes.length === 1 ? '' : 'es';
         lines.push('', "Unresolved prefix".concat(suffix, ": ").concat(decoded.unresolvedPrefixes.join(', '), ". Run `model-info` to list known models."));
     }
+    if (decoded.compositeSource != null) {
+        var _source_leaf_modelName;
+        var source = decoded.compositeSource;
+        var sourceModel = (_source_leaf_modelName = source.leaf.modelName) !== null && _source_leaf_modelName !== void 0 ? _source_leaf_modelName : "<unknown — prefix '".concat(source.leaf.prefix, "' not in manifest>");
+        lines.push('', "Composite source (two-way): ".concat(source.key, " → ").concat(sourceModel));
+    }
+    if (decoded.derivedKeys.length > 0) {
+        var _lines1;
+        (_lines1 = lines).push.apply(_lines1, [
+            '',
+            'Derived keys:'
+        ].concat(_to_consumable_array$W(decoded.derivedKeys.map(function(derived) {
+            return "- ".concat(derived.modelName, " (").concat(derived.encoding, ") — ").concat(derived.key);
+        }))));
+    }
     return lines.join('\n') + '\n';
 }
 function renderLeafLines(leaf) {
@@ -5678,7 +5823,7 @@ function _array_with_holes$l(arr) {
 function _array_without_holes$U(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$14(arr);
 }
-function asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -5689,22 +5834,22 @@ function asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1j(fn) {
+function _async_to_generator$1k(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1k(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$V(obj, key, value) {
+function _define_property$X(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -5715,7 +5860,7 @@ function _define_property$V(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$t(left, right) {
+function _instanceof$u(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -5756,7 +5901,7 @@ function _non_iterable_rest$l() {
 function _non_iterable_spread$U() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$U(target) {
+function _object_spread$W(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -5766,7 +5911,7 @@ function _object_spread$U(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$V(target, key, source[key]);
+            _define_property$X(target, key, source[key]);
         });
     }
     return target;
@@ -5777,7 +5922,7 @@ function _sliced_to_array$l(arr, i) {
 function _to_consumable_array$U(arr) {
     return _array_without_holes$U(arr) || _iterable_to_array$U(arr) || _unsupported_iterable_to_array$14(arr) || _non_iterable_spread$U();
 }
-function _ts_generator$1j(thisArg, body) {
+function _ts_generator$1k(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -5979,9 +6124,9 @@ function _unsupported_iterable_to_array$14(o, minLen) {
  * @returns The resolved source, carrying the opened models view when it is `firestore`.
  * @throws {CliError} `MODEL_IS_SERVER_ONLY` for a server-only model, or the session's own error when `--via firestore` was demanded and the session could not open.
  */ function resolveCliReadSource(input) {
-    return _async_to_generator$1j(function() {
+    return _async_to_generator$1k(function() {
         var context, via, modelType, result, _tmp;
-        return _ts_generator$1j(this, function(_state) {
+        return _ts_generator$1k(this, function(_state) {
             switch(_state.label){
                 case 0:
                     context = input.context, via = input.via, modelType = input.modelType;
@@ -6078,9 +6223,9 @@ function _unsupported_iterable_to_array$14(o, minLen) {
  * @param via - The requested via, carried onto the result.
  * @returns The resolved source.
  */ function resolveAutoReadSource(context, via) {
-    return _async_to_generator$1j(function() {
+    return _async_to_generator$1k(function() {
         var result, _tmp, e, code, message;
-        return _ts_generator$1j(this, function(_state) {
+        return _ts_generator$1k(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -6106,8 +6251,8 @@ function _unsupported_iterable_to_array$14(o, minLen) {
                     ];
                 case 2:
                     e = _state.sent();
-                    code = _instanceof$t(e, CliError) ? e.code : undefined;
-                    message = _instanceof$t(e, Error) ? e.message : String(e);
+                    code = _instanceof$u(e, CliError) ? e.code : undefined;
+                    message = _instanceof$u(e, Error) ? e.message : String(e);
                     if (code != null && CAPABILITY_FAILURE_CODES.has(code)) {
                         verboseLog("read: --via auto → api (direct-Firestore session unavailable: ".concat(code, " ").concat(message, ")"));
                         result = {
@@ -6133,9 +6278,9 @@ function _unsupported_iterable_to_array$14(o, minLen) {
     })();
 }
 function requireModels(context) {
-    return _async_to_generator$1j(function() {
+    return _async_to_generator$1k(function() {
         var getFirestoreModels;
-        return _ts_generator$1j(this, function(_state) {
+        return _ts_generator$1k(this, function(_state) {
             getFirestoreModels = context.getFirestoreModels;
             if (getFirestoreModels == null) {
                 throw new CliError({
@@ -6159,7 +6304,7 @@ function requireModels(context) {
  *
  * @__NO_SIDE_EFFECTS__
  */ function cliReadResultMeta(source) {
-    return _object_spread$U({
+    return _object_spread$W({
         source: source.source,
         via: source.via,
         reason: source.reason
@@ -6183,9 +6328,9 @@ function requireModels(context) {
  * @returns `{ key, data }`, with `data: null` when the document does not exist.
  * @throws {CliError} When the key does not match the model's path shape.
  */ function getModelOverFirestore(input) {
-    return _async_to_generator$1j(function() {
+    return _async_to_generator$1k(function() {
         var models, modelType, key, service, data, _ref, e;
-        return _ts_generator$1j(this, function(_state) {
+        return _ts_generator$1k(this, function(_state) {
             switch(_state.label){
                 case 0:
                     models = input.models, modelType = input.modelType, key = input.key;
@@ -6244,9 +6389,9 @@ function requireModels(context) {
  * @returns `{ results, errors }`, key order preserved within each partition.
  * @throws {CliError} `INVALID_ARGUMENT` when `modelType` is not a registered model.
  */ function getMultipleModelsOverFirestore(input) {
-    return _async_to_generator$1j(function() {
+    return _async_to_generator$1k(function() {
         var models, modelType, keys, service, taskResult;
-        return _ts_generator$1j(this, function(_state) {
+        return _ts_generator$1k(this, function(_state) {
             switch(_state.label){
                 case 0:
                     models = input.models, modelType = input.modelType, keys = input.keys;
@@ -6258,8 +6403,8 @@ function requireModels(context) {
                         4,
                         performAsyncTasks(_to_consumable_array$U(keys), function(key) {
                             var _ref;
-                            return _async_to_generator$1j(function() {
-                                return _ts_generator$1j(this, function(_state) {
+                            return _async_to_generator$1k(function() {
+                                return _ts_generator$1k(this, function(_state) {
                                     switch(_state.label){
                                         case 0:
                                             return [
@@ -6318,10 +6463,10 @@ function requireModels(context) {
  * @returns The error entry for the `errors` partition.
  */ function asCliReadErrorEntry(error, modelType, key) {
     var mapped = asKeyShapeError(error, modelType, key);
-    return _object_spread$U({
+    return _object_spread$W({
         key: key,
         error: mapped.message
-    }, _instanceof$t(mapped, CliError) ? {
+    }, _instanceof$u(mapped, CliError) ? {
         code: mapped.code
     } : {});
 }
@@ -6338,19 +6483,19 @@ function requireModels(context) {
  * @returns A `CliError` for a key-shape mismatch, otherwise the original error.
  */ function asKeyShapeError(error, modelType, key) {
     var result;
-    if (_instanceof$t(error, Error) && /unexpected key\/path/i.test(error.message)) {
+    if (_instanceof$u(error, Error) && /unexpected key\/path/i.test(error.message)) {
         result = new CliError({
             message: 'Key "'.concat(key, '" does not match the path shape for model "').concat(modelType, '": ').concat(error.message),
             code: 'INVALID_ARGUMENT',
             suggestion: 'Nested models need their full parent path, e.g. "gb/<guestbookId>/gbe/<entryId>".'
         });
     } else {
-        result = _instanceof$t(error, Error) ? error : new Error(String(error));
+        result = _instanceof$u(error, Error) ? error : new Error(String(error));
     }
     return result;
 }
 
-function asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -6361,22 +6506,66 @@ function asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1i(fn) {
+function _async_to_generator$1j(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1j(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1i(thisArg, body) {
+function _define_property$W(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _object_spread$V(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$W(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$D(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$D(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    else {
+        ownKeys$D(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _ts_generator$1j(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -6529,9 +6718,9 @@ function _ts_generator$1i(thisArg, body) {
         }));
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$1i(function() {
+        return _async_to_generator$1j(function() {
             var context, _parseGetArgs, modelType, key, resolved, result, _tmp;
-            return _ts_generator$1i(this, function(_state) {
+            return _ts_generator$1j(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -6578,7 +6767,14 @@ function _ts_generator$1i(thisArg, body) {
                         _state.label = 5;
                     case 5:
                         result = _tmp;
-                        outputResult(result, cliReadResultMeta(resolved));
+                        // `--pick` names fields of the DOCUMENT, not of the `{ key, data }` read envelope.
+                        outputResult(result, cliReadResultMeta(resolved), {
+                            applyPick: function applyPick(r, pick) {
+                                return _object_spread_props$D(_object_spread$V({}, r), {
+                                    data: pick(r.data)
+                                });
+                            }
+                        });
                         return [
                             2
                         ];
@@ -6588,7 +6784,7 @@ function _ts_generator$1i(thisArg, body) {
     })
 };
 
-function asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -6599,22 +6795,66 @@ function asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1h(fn) {
+function _async_to_generator$1i(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1i(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1h(thisArg, body) {
+function _define_property$V(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _object_spread$U(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$V(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$C(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$C(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    else {
+        ownKeys$C(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _ts_generator$1i(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -6750,9 +6990,9 @@ function _ts_generator$1h(thisArg, body) {
         }).epilogue(CLI_READ_VIA_EPILOGUE);
     },
     handler: wrapCommandHandler(function(argv) {
-        return _async_to_generator$1h(function() {
+        return _async_to_generator$1i(function() {
             var context, firstArg, rest, resolvedFirst, resolvedRest, stdinKeys, _parseGetManyArgs, modelType, keys, resolved, result, _tmp;
-            return _ts_generator$1h(this, function(_state) {
+            return _ts_generator$1i(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         context = requireCliContext();
@@ -6817,7 +7057,18 @@ function _ts_generator$1h(thisArg, body) {
                         _state.label = 7;
                     case 7:
                         result = _tmp;
-                        outputResult(result, cliReadResultMeta(resolved));
+                        // `--pick` names fields of each DOCUMENT; `errors` entries carry no payload and pass through.
+                        outputResult(result, cliReadResultMeta(resolved), {
+                            applyPick: function applyPick(r, pick) {
+                                return _object_spread_props$C(_object_spread$U({}, r), {
+                                    results: r.results.map(function(entry) {
+                                        return _object_spread_props$C(_object_spread$U({}, entry), {
+                                            data: pick(entry.data)
+                                        });
+                                    })
+                                });
+                            }
+                        });
                         return [
                             2
                         ];
@@ -6827,7 +7078,7 @@ function _ts_generator$1h(thisArg, body) {
     })
 };
 
-function asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -6838,16 +7089,16 @@ function asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1g(fn) {
+function _async_to_generator$1h(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1h(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
@@ -6879,7 +7130,7 @@ function _object_spread$T(target) {
     }
     return target;
 }
-function _ts_generator$1g(thisArg, body) {
+function _ts_generator$1h(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7046,9 +7297,9 @@ function _ts_generator$1g(thisArg, body) {
  * @param input.updates - The partial {@link CliConfig} to merge on top of the existing on-disk config.
  * @returns The merged {@link CliConfig} that was just written.
  */ function mergeCliConfig(input) {
-    return _async_to_generator$1g(function() {
+    return _async_to_generator$1h(function() {
         var _ref, _input_updates_activeEnv, existing, merged;
-        return _ts_generator$1g(this, function(_state) {
+        return _ts_generator$1h(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -7173,7 +7424,7 @@ function mergeOutputCommandsConfig(existing, updates) {
     return result;
 }
 
-function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7184,22 +7435,22 @@ function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1f(fn) {
+function _async_to_generator$1g(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1g(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1f(thisArg, body) {
+function _ts_generator$1g(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7326,9 +7577,9 @@ function _ts_generator$1f(thisArg, body) {
  * @param input - Resolution inputs.
  * @returns The resolved env triple.
  */ function resolveCliEnv(input) {
-    return _async_to_generator$1f(function() {
+    return _async_to_generator$1g(function() {
         var _ref, _input_envVarName, _ref1, _input_flagEnv, _config_envs, _findCliEnvDefault, config, envVarName, envName, stored, defaultEnv, merged, env;
-        return _ts_generator$1f(this, function(_state) {
+        return _ts_generator$1g(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -7367,9 +7618,9 @@ function _ts_generator$1f(thisArg, body) {
     })();
 }
 function resolveCliEnvOrThrow(input) {
-    return _async_to_generator$1f(function() {
+    return _async_to_generator$1g(function() {
         var _ref, config, envName, env;
-        return _ts_generator$1f(this, function(_state) {
+        return _ts_generator$1g(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
@@ -7472,6 +7723,50 @@ function resolveCliEnvOrThrow(input) {
  * {@link isFirestoreSessionExpired}.
  */ var isCliFirestoreSessionExpired = isFirestoreSessionExpired;
 
+function _define_property$T(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _object_spread$S(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$T(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$B(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$B(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    else {
+        ownKeys$B(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
 /**
  * Creates a per-env token cache store backed by a single JSON file.
  *
@@ -7504,8 +7799,39 @@ function resolveCliEnvOrThrow(input) {
         now: new Date(nowMs)
     }).hasExpired();
 }
+/**
+ * Folds an OIDC refresh response into the cached entry it was obtained with.
+ *
+ * EVERY refresh must persist the result of this merge. A refresh CONSUMES the supplied refresh
+ * token whenever the grant rotates, so keeping the old entry leaves the cache holding a spent
+ * credential and strands the session on the next refresh — with replay detection on the provider
+ * side, reusing the spent token can revoke the whole grant. Centralized so the refresh call sites
+ * (auth middleware, `auth check`, `doctor`) cannot drift apart on this.
+ *
+ * @param input - The entry that was refreshed and the token response it produced.
+ * @returns The updated entry to persist. Fields the provider omits fall back to the previous entry.
+ */ function mergeRefreshedTokenEntry(input) {
+    var _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _refreshed_expires_in;
+    var entry = input.entry, refreshed = input.refreshed, _input_nowMs = input.nowMs, nowMs = _input_nowMs === void 0 ? Date.now() : _input_nowMs;
+    return _object_spread_props$B(_object_spread$S({}, entry), {
+        accessToken: refreshed.access_token,
+        refreshToken: (_refreshed_refresh_token = refreshed.refresh_token) !== null && _refreshed_refresh_token !== void 0 ? _refreshed_refresh_token : entry.refreshToken,
+        tokenType: (_refreshed_token_type = refreshed.token_type) !== null && _refreshed_token_type !== void 0 ? _refreshed_token_type : entry.tokenType,
+        scope: (_refreshed_scope = refreshed.scope) !== null && _refreshed_scope !== void 0 ? _refreshed_scope : entry.scope,
+        expiresAt: nowMs + ((_refreshed_expires_in = refreshed.expires_in) !== null && _refreshed_expires_in !== void 0 ? _refreshed_expires_in : 0) * 1000
+    });
+}
+/**
+ * Whether a refresh response rotated the refresh token it was obtained with.
+ *
+ * @param input - The entry that was refreshed and the token response it produced.
+ * @returns `true` when the provider issued a DIFFERENT refresh token, meaning the old one is spent.
+ */ function didRotateRefreshToken(input) {
+    var entry = input.entry, refreshed = input.refreshed;
+    return refreshed.refresh_token != null && refreshed.refresh_token !== entry.refreshToken;
+}
 
-function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7516,22 +7842,22 @@ function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1e(fn) {
+function _async_to_generator$1f(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1f(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$T(obj, key, value) {
+function _define_property$S(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -7542,13 +7868,13 @@ function _define_property$T(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$s(left, right) {
+function _instanceof$t(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
     } else return left instanceof right;
 }
-function _object_spread$S(target) {
+function _object_spread$R(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -7558,12 +7884,12 @@ function _object_spread$S(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$T(target, key, source[key]);
+            _define_property$S(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$C(object, enumerableOnly) {
+function ownKeys$A(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -7571,17 +7897,17 @@ function ownKeys$C(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$C(target, source) {
+function _object_spread_props$A(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$C(Object(source)).forEach(function(key) {
+        ownKeys$A(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _ts_generator$1e(thisArg, body) {
+function _ts_generator$1f(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -7736,9 +8062,9 @@ var cliOidcFetch = function cliOidcFetch(input, init) {
  * @returns A {@link CliError} for relying-party errors, otherwise the original value.
  */ function oidcRelyingPartyErrorToCliError(error) {
     var result = error;
-    if (_instanceof$s(error, OidcRelyingPartyError)) {
+    if (_instanceof$t(error, OidcRelyingPartyError)) {
         var mapped = OIDC_ERROR_CODE_MAP[error.code];
-        result = new CliError(_object_spread$S({
+        result = new CliError(_object_spread$R({
             message: error.message,
             code: mapped.code
         }, mapped.suggestion ? {
@@ -7748,9 +8074,9 @@ var cliOidcFetch = function cliOidcFetch(input, init) {
     return result;
 }
 function withCliErrors(fn) {
-    return _async_to_generator$1e(function() {
+    return _async_to_generator$1f(function() {
         var e;
-        return _ts_generator$1e(this, function(_state) {
+        return _ts_generator$1f(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -7786,7 +8112,7 @@ function withCliErrors(fn) {
  * @returns The parsed {@link OidcDiscoveryMetadata}. Throws a {@link CliError} (`OIDC_DISCOVERY_FAILED`) when every candidate fails.
  */ function discoverOidcMetadata(input) {
     return withCliErrors(function() {
-        return discoverOidcMetadata$1(_object_spread_props$C(_object_spread$S({}, input), {
+        return discoverOidcMetadata$1(_object_spread_props$A(_object_spread$R({}, input), {
             fetch: cliOidcFetch
         }));
     });
@@ -7798,7 +8124,7 @@ function withCliErrors(fn) {
  * @returns The parsed {@link OidcTokenResponse} with access/refresh tokens.
  */ function exchangeAuthorizationCode(input) {
     return withCliErrors(function() {
-        return exchangeAuthorizationCode$1(_object_spread_props$C(_object_spread$S({}, input), {
+        return exchangeAuthorizationCode$1(_object_spread_props$A(_object_spread$R({}, input), {
             fetch: cliOidcFetch
         }));
     });
@@ -7810,7 +8136,7 @@ function withCliErrors(fn) {
  * @returns The parsed {@link OidcTokenResponse} with the refreshed access token.
  */ function refreshAccessToken(input) {
     return withCliErrors(function() {
-        return refreshAccessToken$1(_object_spread_props$C(_object_spread$S({}, input), {
+        return refreshAccessToken$1(_object_spread_props$A(_object_spread$R({}, input), {
             fetch: cliOidcFetch
         }));
     });
@@ -7822,7 +8148,7 @@ function withCliErrors(fn) {
  * @returns Resolves when the server returns a non-error status. Throws a {@link CliError} (`TOKEN_REVOCATION_FAILED`) on error.
  */ function revokeToken(input) {
     return withCliErrors(function() {
-        return revokeToken$1(_object_spread_props$C(_object_spread$S({}, input), {
+        return revokeToken$1(_object_spread_props$A(_object_spread$R({}, input), {
             fetch: cliOidcFetch
         }));
     });
@@ -7834,7 +8160,7 @@ function withCliErrors(fn) {
  * @returns The parsed userinfo claims. Throws a {@link CliError} (`USERINFO_FAILED`) on a non-OK response.
  */ function fetchUserInfo(input) {
     return withCliErrors(function() {
-        return fetchUserInfo$1(_object_spread_props$C(_object_spread$S({}, input), {
+        return fetchUserInfo$1(_object_spread_props$A(_object_spread$R({}, input), {
             fetch: cliOidcFetch
         }));
     });
@@ -7846,13 +8172,13 @@ function withCliErrors(fn) {
  * @returns The parsed {@link OidcSessionInfo}. Throws a {@link CliError} (`SESSION_INFO_FAILED`) on a non-OK response.
  */ function fetchSessionInfo(input) {
     return withCliErrors(function() {
-        return fetchSessionInfo$1(_object_spread_props$C(_object_spread$S({}, input), {
+        return fetchSessionInfo$1(_object_spread_props$A(_object_spread$R({}, input), {
             fetch: cliOidcFetch
         }));
     });
 }
 
-function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -7863,22 +8189,22 @@ function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1d(fn) {
+function _async_to_generator$1e(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1e(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _ts_generator$1d(thisArg, body) {
+function _ts_generator$1e(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -8004,9 +8330,9 @@ function _ts_generator$1d(thisArg, body) {
  * @returns The parsed {@link CliHandoffBundle}.
  * @throws {CliError} `AUTH_HANDOFF_FAILED` when the code is rejected or the response is unusable.
  */ function claimCliHandoff(input) {
-    return _async_to_generator$1d(function() {
+    return _async_to_generator$1e(function() {
         var endpoint, response, e, bundle;
-        return _ts_generator$1d(this, function(_state) {
+        return _ts_generator$1e(this, function(_state) {
             switch(_state.label){
                 case 0:
                     endpoint = buildCliHandoffClaimEndpoint(input.oidcIssuer);
@@ -8072,9 +8398,9 @@ function _ts_generator$1d(thisArg, body) {
     })();
 }
 function readJsonSafely(response) {
-    return _async_to_generator$1d(function() {
+    return _async_to_generator$1e(function() {
         var result;
-        return _ts_generator$1d(this, function(_state) {
+        return _ts_generator$1e(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -8110,7 +8436,7 @@ function readJsonSafely(response) {
     })();
 }
 
-function _define_property$S(obj, key, value) {
+function _define_property$R(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -8121,7 +8447,7 @@ function _define_property$S(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$R(target) {
+function _object_spread$Q(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -8131,12 +8457,12 @@ function _object_spread$R(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$S(target, key, source[key]);
+            _define_property$R(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$B(object, enumerableOnly) {
+function ownKeys$z(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -8144,11 +8470,11 @@ function ownKeys$B(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$B(target, source) {
+function _object_spread_props$z(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$B(Object(source)).forEach(function(key) {
+        ownKeys$z(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -8169,7 +8495,7 @@ function _object_spread_props$B(target, source) {
  */ function buildAuthorizationUrl(input) {
     try {
         var _input_scopes;
-        return buildAuthorizationUrl$1(_object_spread_props$B(_object_spread$R({}, input), {
+        return buildAuthorizationUrl$1(_object_spread_props$z(_object_spread$Q({}, input), {
             scopes: (_input_scopes = input.scopes) !== null && _input_scopes !== void 0 ? _input_scopes : DEFAULT_CLI_OIDC_SCOPES
         }));
     } catch (e) {
@@ -8199,7 +8525,7 @@ function _object_spread_props$B(target, source) {
     }
 }
 
-function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -8210,28 +8536,28 @@ function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1c(fn) {
+function _async_to_generator$1d(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1d(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _instanceof$r(left, right) {
+function _instanceof$s(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
     } else return left instanceof right;
 }
-function _ts_generator$1c(thisArg, body) {
+function _ts_generator$1d(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -8428,9 +8754,9 @@ function _ts_generator$1c(thisArg, body) {
  * @returns The started {@link LoopbackRedirectCapture}.
  * @throws {CliError} `AUTH_REDIRECT_LISTEN_FAILED` when the port cannot be bound.
  */ function startLoopbackRedirectCapture(input) {
-    return _async_to_generator$1c(function() {
+    return _async_to_generator$1d(function() {
         var target, sockets, resolveRedirect, redirect, handleRequest, hostnames, bindings, servers, close;
-        return _ts_generator$1c(this, function(_state) {
+        return _ts_generator$1d(this, function(_state) {
             switch(_state.label){
                 case 0:
                     target = input.target;
@@ -8513,7 +8839,7 @@ function _ts_generator$1c(thisArg, body) {
                 case 1:
                     bindings = _state.sent();
                     servers = bindings.filter(function(x) {
-                        return !_instanceof$r(x, CliError);
+                        return !_instanceof$s(x, CliError);
                     });
                     if (servers.length === 0) {
                         // Both families failing is one failure to report; the first is the representative one.
@@ -8780,7 +9106,7 @@ var KEY_DEL = ''; // DEL
     return result;
 }
 
-function asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -8791,22 +9117,22 @@ function asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1b(fn) {
+function _async_to_generator$1c(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1c(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$R(obj, key, value) {
+function _define_property$Q(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -8817,7 +9143,7 @@ function _define_property$R(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$Q(target) {
+function _object_spread$P(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -8827,30 +9153,12 @@ function _object_spread$Q(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$R(target, key, source[key]);
+            _define_property$Q(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$A(object, enumerableOnly) {
-    var keys = Object.keys(object);
-    if (Object.getOwnPropertySymbols) {
-        var symbols = Object.getOwnPropertySymbols(object);
-        keys.push.apply(keys, symbols);
-    }
-    return keys;
-}
-function _object_spread_props$A(target, source) {
-    source = source != null ? source : {};
-    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
-    else {
-        ownKeys$A(Object(source)).forEach(function(key) {
-            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
-        });
-    }
-    return target;
-}
-function _ts_generator$1b(thisArg, body) {
+function _ts_generator$1c(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -8957,9 +9265,9 @@ function _ts_generator$1b(thisArg, body) {
  * since the fallback costs the user the whole flow again.
  */ var DEFAULT_AUTH_LOGIN_LISTEN_FOR = '5m';
 function resolveAuthSetupPrompt(input) {
-    return _async_to_generator$1b(function() {
+    return _async_to_generator$1c(function() {
         var argvValue, existingValue, prompt, mask, result, answer;
-        return _ts_generator$1b(this, function(_state) {
+        return _ts_generator$1c(this, function(_state) {
             switch(_state.label){
                 case 0:
                     argvValue = input.argvValue, existingValue = input.existingValue, prompt = input.prompt, mask = input.mask;
@@ -9034,9 +9342,9 @@ function resolveAuthSetupPrompt(input) {
  * @param input.accessToken - The Bearer access token.
  * @returns The {@link OidcSessionInfo}, or `undefined` on any failure.
  */ function loadSessionInfoSafely(input) {
-    return _async_to_generator$1b(function() {
+    return _async_to_generator$1c(function() {
         var result;
-        return _ts_generator$1b(this, function(_state) {
+        return _ts_generator$1c(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -9085,9 +9393,9 @@ function resolveAuthSetupPrompt(input) {
  * @param input.accessToken - The Bearer access token.
  * @returns The parsed claims, or `undefined` on any failure.
  */ function loadUserInfoSafely(input) {
-    return _async_to_generator$1b(function() {
+    return _async_to_generator$1c(function() {
         var result;
-        return _ts_generator$1b(this, function(_state) {
+        return _ts_generator$1c(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
@@ -9213,9 +9521,9 @@ function resolveAuthSetupPrompt(input) {
  * @returns The trimmed claim code.
  * @throws {CliError} `AUTH_HANDOFF_NO_CODE` when no code was supplied by any route.
  */ function resolveHandoffCode(input) {
-    return _async_to_generator$1b(function() {
+    return _async_to_generator$1c(function() {
         var argvCode, result, _process_env_input_envVarName;
-        return _ts_generator$1b(this, function(_state) {
+        return _ts_generator$1c(this, function(_state) {
             switch(_state.label){
                 case 0:
                     argvCode = input.argvCode;
@@ -9332,9 +9640,9 @@ function resolveAuthSetupPrompt(input) {
             });
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1b(function() {
+            return _async_to_generator$1c(function() {
                 var _ref, _ref1, _argv_env, _ref2, _ref3, _argv_appClientUrl, _argv_tokenEndpointAuthMethod, _ref4, _ref5, _argv_scopes, _config_envs, _findCliEnvDefault, config, envName, stored, defaultEnv, existing, apiBaseUrl, oidcIssuer, appClientUrl, clientId, tokenEndpointAuthMethod, publicClient, clientSecret, _tmp, redirectUri, scopes, nextEnv, merged;
-                return _ts_generator$1b(this, function(_state) {
+                return _ts_generator$1c(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             return [
@@ -9443,7 +9751,7 @@ function resolveAuthSetupPrompt(input) {
                                     code: 'AUTH_SETUP_INCOMPLETE'
                                 });
                             }
-                            nextEnv = _object_spread$Q({
+                            nextEnv = _object_spread$P({
                                 apiBaseUrl: apiBaseUrl,
                                 oidcIssuer: oidcIssuer,
                                 clientId: clientId,
@@ -9462,8 +9770,8 @@ function resolveAuthSetupPrompt(input) {
                                 mergeCliConfig({
                                     configFilePath: paths.configFilePath,
                                     configDir: paths.configDir,
-                                    updates: _object_spread$Q({
-                                        envs: _define_property$R({}, envName, nextEnv)
+                                    updates: _object_spread$P({
+                                        envs: _define_property$Q({}, envName, nextEnv)
                                     }, argv.setActive ? {
                                         activeEnv: envName
                                     } : {})
@@ -9523,9 +9831,9 @@ function resolveAuthSetupPrompt(input) {
             });
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1b(function() {
+            return _async_to_generator$1c(function() {
                 var _argv_listenFor, _ref, _tokenResponse_expires_in, _ref1, _ref2, envName, env, meta, _ref3, codeVerifier, codeChallenge, state, requestedScopes, requestedSessionTtlSeconds, ms, listenForMs, suppliedCode, shouldListen, loopbackTarget, capture, e, suggestedRedirectUri, redirectUri, url, _tmp, pasted, controller, prompt, redirected, e1, code, tokenResponse, expiresAt, sessionInfo, sessionExpiresAt, rotationDisabled, entry, sessionSummary;
-                return _ts_generator$1b(this, function(_state) {
+                return _ts_generator$1c(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             return [
@@ -9811,7 +10119,7 @@ function resolveAuthSetupPrompt(input) {
                             sessionInfo = _state.sent();
                             sessionExpiresAt = (_ref1 = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.expiresAt) !== null && _ref1 !== void 0 ? _ref1 : undefined;
                             rotationDisabled = sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.rotationDisabled;
-                            entry = _object_spread$Q({
+                            entry = _object_spread$P({
                                 accessToken: tokenResponse.access_token,
                                 refreshToken: tokenResponse.refresh_token,
                                 idToken: tokenResponse.id_token,
@@ -9868,9 +10176,9 @@ function resolveAuthSetupPrompt(input) {
             });
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1b(function() {
+            return _async_to_generator$1c(function() {
                 var _ref, envName, env, entry, meta;
-                return _ts_generator$1b(this, function(_state) {
+                return _ts_generator$1c(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             return [
@@ -9989,9 +10297,9 @@ function resolveAuthSetupPrompt(input) {
             });
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1b(function() {
+            return _async_to_generator$1c(function() {
                 var _ref, _argv_env, _ref1, _argv_oidcIssuer, _ref2, _ref3, _ref4, _ref5, _bundle_apiBaseUrl, _ref6, _config_envs, _findCliEnvDefault, _soleDefaultEnv_env, _config_envs1, _findCliEnvDefault1, config, requestedEnvName, issuerLookupEnvName, issuerLookupEnv, soleDefaultEnv, oidcIssuer, code, bundle, envName, existing, nextEnv, merged, sessionExpiresAt, entry, remainingMinutes;
-                return _ts_generator$1b(this, function(_state) {
+                return _ts_generator$1c(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             return [
@@ -10067,7 +10375,7 @@ function resolveAuthSetupPrompt(input) {
                             }
                             // The bundle carries everything a machine with no prior `auth setup` needs, so the env is
                             // created/updated from it rather than requiring a separate setup pass.
-                            nextEnv = _object_spread$Q({
+                            nextEnv = _object_spread$P({
                                 apiBaseUrl: (_ref5 = (_bundle_apiBaseUrl = bundle.apiBaseUrl) !== null && _bundle_apiBaseUrl !== void 0 ? _bundle_apiBaseUrl : existing === null || existing === void 0 ? void 0 : existing.apiBaseUrl) !== null && _ref5 !== void 0 ? _ref5 : '',
                                 oidcIssuer: bundle.issuer || oidcIssuer,
                                 clientId: bundle.clientId,
@@ -10092,8 +10400,8 @@ function resolveAuthSetupPrompt(input) {
                                 mergeCliConfig({
                                     configFilePath: paths.configFilePath,
                                     configDir: paths.configDir,
-                                    updates: _object_spread$Q({
-                                        envs: _define_property$R({}, envName, nextEnv)
+                                    updates: _object_spread$P({
+                                        envs: _define_property$Q({}, envName, nextEnv)
                                     }, argv.setActive ? {
                                         activeEnv: envName
                                     } : {})
@@ -10150,9 +10458,9 @@ function resolveAuthSetupPrompt(input) {
             return withEnv(yargs);
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1b(function() {
+            return _async_to_generator$1c(function() {
                 var _ref, envName, env, entry, _ref1, _ref2, expired, sessionInfo, sessionExpiresAt, rotationDisabled, session, meta, userinfoEndpoint, claims, _tmp;
-                return _ts_generator$1b(this, function(_state) {
+                return _ts_generator$1c(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             return [
@@ -10266,9 +10574,9 @@ function resolveAuthSetupPrompt(input) {
             return withEnv(yargs);
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1b(function() {
+            return _async_to_generator$1c(function() {
                 var _ref, envName, env, entry;
-                return _ts_generator$1b(this, function(_state) {
+                return _ts_generator$1c(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             return [
@@ -10323,9 +10631,9 @@ function resolveAuthSetupPrompt(input) {
             return withEnv(yargs);
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$1b(function() {
-                var _refreshed_expires_in, _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _ref, envName, env, entry, meta, refreshed, expiresAt;
-                return _ts_generator$1b(this, function(_state) {
+            return _async_to_generator$1c(function() {
+                var _ref, envName, env, entry, meta, refreshed, updated;
+                return _ts_generator$1c(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             return [
@@ -10373,23 +10681,20 @@ function resolveAuthSetupPrompt(input) {
                             ];
                         case 4:
                             refreshed = _state.sent();
-                            expiresAt = Date.now() + ((_refreshed_expires_in = refreshed.expires_in) !== null && _refreshed_expires_in !== void 0 ? _refreshed_expires_in : 0) * 1000;
+                            updated = mergeRefreshedTokenEntry({
+                                entry: entry,
+                                refreshed: refreshed
+                            });
                             return [
                                 4,
-                                tokens.set(envName, _object_spread_props$A(_object_spread$Q({}, entry), {
-                                    accessToken: refreshed.access_token,
-                                    refreshToken: (_refreshed_refresh_token = refreshed.refresh_token) !== null && _refreshed_refresh_token !== void 0 ? _refreshed_refresh_token : entry.refreshToken,
-                                    tokenType: (_refreshed_token_type = refreshed.token_type) !== null && _refreshed_token_type !== void 0 ? _refreshed_token_type : entry.tokenType,
-                                    scope: (_refreshed_scope = refreshed.scope) !== null && _refreshed_scope !== void 0 ? _refreshed_scope : entry.scope,
-                                    expiresAt: expiresAt
-                                }))
+                                tokens.set(envName, updated)
                             ];
                         case 5:
                             _state.sent();
                             outputResult({
                                 env: envName,
                                 refreshed: true,
-                                expiresAt: expiresAt
+                                expiresAt: updated.expiresAt
                             });
                             return [
                                 2
@@ -10505,7 +10810,7 @@ function _array_like_to_array$13(arr, len) {
 function _array_with_holes$k(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _define_property$Q(obj, key, value) {
+function _define_property$P(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -10516,7 +10821,7 @@ function _define_property$Q(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$q(left, right) {
+function _instanceof$r(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -10653,15 +10958,15 @@ var TAG_KEYS = new Set([
  */ function encodeValue(value, seen) {
     var result;
     if (value === undefined) {
-        result = _define_property$Q({}, UNDEFINED_TAG, 1);
+        result = _define_property$P({}, UNDEFINED_TAG, 1);
     } else if (value === null) {
         result = null;
     } else if (typeof value === 'number') {
-        result = Number.isFinite(value) ? value : _define_property$Q({}, NUMBER_TAG, String(value));
+        result = Number.isFinite(value) ? value : _define_property$P({}, NUMBER_TAG, String(value));
     } else if (typeof value === 'string' || typeof value === 'boolean') {
         result = value;
     } else if ((typeof value === "undefined" ? "undefined" : _type_of$4(value)) === 'bigint') {
-        result = _define_property$Q({}, BIGINT_TAG, value.toString());
+        result = _define_property$P({}, BIGINT_TAG, value.toString());
     } else if (typeof value === 'function' || (typeof value === "undefined" ? "undefined" : _type_of$4(value)) === 'symbol') {
         throw new CliError({
             message: "A cached value contains a ".concat(typeof value === "undefined" ? "undefined" : _type_of$4(value), ", which cannot be persisted."),
@@ -10690,21 +10995,21 @@ var TAG_KEYS = new Set([
     }
     seen.add(value);
     var result;
-    if (_instanceof$q(value, Date)) {
+    if (_instanceof$r(value, Date)) {
         var time = value.getTime();
         // an Invalid Date would make toISOString() throw; it is still a real value a bad stored ISO
         // string can produce, so it round-trips as null rather than exploding the whole cache write
-        result = _define_property$Q({}, DATE_TAG, Number.isNaN(time) ? null : value.toISOString());
-    } else if (_instanceof$q(value, Map)) {
-        result = _define_property$Q({}, MAP_TAG, Array.from(value.entries()).map(function(param) {
+        result = _define_property$P({}, DATE_TAG, Number.isNaN(time) ? null : value.toISOString());
+    } else if (_instanceof$r(value, Map)) {
+        result = _define_property$P({}, MAP_TAG, Array.from(value.entries()).map(function(param) {
             var _param = _sliced_to_array$k(param, 2), key = _param[0], entryValue = _param[1];
             return [
                 encodeValue(key, seen),
                 encodeValue(entryValue, seen)
             ];
         }));
-    } else if (_instanceof$q(value, Set)) {
-        result = _define_property$Q({}, SET_TAG, Array.from(value.values()).map(function(member) {
+    } else if (_instanceof$r(value, Set)) {
+        result = _define_property$P({}, SET_TAG, Array.from(value.values()).map(function(member) {
             return encodeValue(member, seen);
         }));
     } else if (Array.isArray(value)) {
@@ -10735,7 +11040,7 @@ var TAG_KEYS = new Set([
         }
         // a user object shaped exactly like a tag (`{ $d: … }`) is wrapped so decoding cannot read it
         // back as one; this is the only case the escape is needed for
-        result = tagKeyOf(encoded) === undefined ? encoded : _define_property$Q({}, ESCAPE_TAG, encoded);
+        result = tagKeyOf(encoded) === undefined ? encoded : _define_property$P({}, ESCAPE_TAG, encoded);
     }
     seen.delete(value);
     return result;
@@ -10850,7 +11155,7 @@ function _array_like_to_array$12(arr, len) {
 function _array_with_holes$j(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _instanceof$p(left, right) {
+function _instanceof$q(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -10922,7 +11227,7 @@ function _unsupported_iterable_to_array$12(o, minLen) {
     var result;
     if (filter === null || filter === undefined || filter === '') {
         result = undefined;
-    } else if (_instanceof$p(filter, Date)) {
+    } else if (_instanceof$q(filter, Date)) {
         var time = filter.getTime();
         result = Number.isNaN(time) ? undefined : filter.toISOString();
     } else if (Array.isArray(filter)) {
@@ -11176,7 +11481,7 @@ function _array_like_to_array$11(arr, len) {
 function _array_with_holes$i(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -11187,22 +11492,22 @@ function asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$1a(fn) {
+function _async_to_generator$1b(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1b(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$P(obj, key, value) {
+function _define_property$O(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -11240,7 +11545,7 @@ function _iterable_to_array_limit$i(arr, i) {
 function _non_iterable_rest$i() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$P(target) {
+function _object_spread$O(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -11250,12 +11555,12 @@ function _object_spread$P(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$P(target, key, source[key]);
+            _define_property$O(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$z(object, enumerableOnly) {
+function ownKeys$y(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -11263,11 +11568,11 @@ function ownKeys$z(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$z(target, source) {
+function _object_spread_props$y(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$z(Object(source)).forEach(function(key) {
+        ownKeys$y(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -11276,7 +11581,7 @@ function _object_spread_props$z(target, source) {
 function _sliced_to_array$i(arr, i) {
     return _array_with_holes$i(arr) || _iterable_to_array_limit$i(arr, i) || _unsupported_iterable_to_array$11(arr, i) || _non_iterable_rest$i();
 }
-function _ts_generator$1a(thisArg, body) {
+function _ts_generator$1b(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -11449,8 +11754,8 @@ function _unsupported_iterable_to_array$11(o, minLen) {
         return join(dataCacheDir, cliDataCachePathSegment(env), cliDataCachePathSegment(dataset), "".concat(fingerprint, ".json"));
     }
     function removeEntryAt(key, entry) {
-        return _async_to_generator$1a(function() {
-            return _ts_generator$1a(this, function(_state) {
+        return _async_to_generator$1b(function() {
+            return _ts_generator$1b(this, function(_state) {
                 switch(_state.label){
                     case 0:
                         return [
@@ -11481,9 +11786,9 @@ function _unsupported_iterable_to_array$11(o, minLen) {
     var cache = {
         dataCacheDir: dataCacheDir,
         listEntries: function listEntries(filter) {
-            return _async_to_generator$1a(function() {
+            return _async_to_generator$1b(function() {
                 var nowMs, entries, _;
-                return _ts_generator$1a(this, function(_state) {
+                return _ts_generator$1b(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             nowMs = Date.now();
@@ -11509,9 +11814,9 @@ function _unsupported_iterable_to_array$11(o, minLen) {
             })();
         },
         loadData: function loadData(loadInput) {
-            return _async_to_generator$1a(function() {
+            return _async_to_generator$1b(function() {
                 var dataset, datasetVersion, env, filter, maxAgeMs, fingerprint, key, entry, result, file, _loadInput_codec, codec;
-                return _ts_generator$1a(this, function(_state) {
+                return _ts_generator$1b(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             dataset = loadInput.dataset, datasetVersion = loadInput.datasetVersion, env = loadInput.env, filter = loadInput.filter, maxAgeMs = loadInput.maxAgeMs;
@@ -11576,9 +11881,9 @@ function _unsupported_iterable_to_array$11(o, minLen) {
             })();
         },
         saveData: function saveData(saveInput) {
-            return _async_to_generator$1a(function() {
+            return _async_to_generator$1b(function() {
                 var _saveInput_codec, _normalizeCliCacheFilter, dataset, datasetVersion, env, filter, data, fingerprint, codec, file, builtAt, payloadFile, bytes, entry;
-                return _ts_generator$1a(this, function(_state) {
+                return _ts_generator$1b(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             dataset = saveInput.dataset, datasetVersion = saveInput.datasetVersion, env = saveInput.env, filter = saveInput.filter, data = saveInput.data;
@@ -11606,7 +11911,7 @@ function _unsupported_iterable_to_array$11(o, minLen) {
                             ];
                         case 1:
                             bytes = _state.sent();
-                            entry = _object_spread$P(_object_spread_props$z(_object_spread$P({
+                            entry = _object_spread$O(_object_spread_props$y(_object_spread$O({
                                 dataset: dataset,
                                 datasetVersion: datasetVersion,
                                 env: env,
@@ -11640,9 +11945,9 @@ function _unsupported_iterable_to_array$11(o, minLen) {
             })();
         },
         removeEntries: function removeEntries(filter) {
-            return _async_to_generator$1a(function() {
+            return _async_to_generator$1b(function() {
                 var nowMs, all, removed, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, _step_value, key, entry, err;
-                return _ts_generator$1a(this, function(_state) {
+                return _ts_generator$1b(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             nowMs = Date.now();
@@ -11741,9 +12046,9 @@ function _unsupported_iterable_to_array$11(o, minLen) {
  * @param payloadFile - The envelope to write.
  * @returns The number of bytes written.
  */ function writeCliDataCachePayloadFile(filePath, payloadFile) {
-    return _async_to_generator$1a(function() {
+    return _async_to_generator$1b(function() {
         var serialized;
-        return _ts_generator$1a(this, function(_state) {
+        return _ts_generator$1b(this, function(_state) {
             switch(_state.label){
                 case 0:
                     serialized = JSON.stringify(payloadFile);
@@ -11804,9 +12109,9 @@ function _unsupported_iterable_to_array$11(o, minLen) {
  * @param input - The lookup + build inputs.
  * @returns The data plus where it came from.
  */ function loadOrBuildCliCachedData(input) {
-    return _async_to_generator$1a(function() {
+    return _async_to_generator$1b(function() {
         var _input_options, cache, dataset, datasetVersion, env, filter, build, options, codec, hit, _tmp, result, data, itemCount, built, _tmp1, builtAt;
-        return _ts_generator$1a(this, function(_state) {
+        return _ts_generator$1b(this, function(_state) {
             switch(_state.label){
                 case 0:
                     cache = input.cache, dataset = input.dataset, datasetVersion = input.datasetVersion, env = input.env, filter = input.filter, build = input.build;
@@ -11883,7 +12188,7 @@ function _unsupported_iterable_to_array$11(o, minLen) {
                     _state.label = 7;
                 case 7:
                     built = _tmp1;
-                    result = _object_spread$P({
+                    result = _object_spread$O({
                         data: data,
                         fromCache: false,
                         dataset: dataset,
@@ -11899,7 +12204,7 @@ function _unsupported_iterable_to_array$11(o, minLen) {
                     ];
                 case 8:
                     builtAt = new Date(hit.entry.builtAt);
-                    result = _object_spread$P({
+                    result = _object_spread$O({
                         data: hit.data,
                         fromCache: true,
                         dataset: dataset,
@@ -11931,7 +12236,7 @@ function _unsupported_iterable_to_array$11(o, minLen) {
  * @__NO_SIDE_EFFECTS__
  */ function cliDataCacheMeta(results) {
     var asMeta = function asMeta(result) {
-        return _object_spread$P({
+        return _object_spread$O({
             dataset: result.dataset,
             fingerprint: result.fingerprint,
             fromCache: result.fromCache,
@@ -11946,7 +12251,7 @@ function _unsupported_iterable_to_array$11(o, minLen) {
     };
 }
 
-function asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -11957,22 +12262,22 @@ function asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$19(fn) {
+function _async_to_generator$1a(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$1a(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$O(obj, key, value) {
+function _define_property$N(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -11983,7 +12288,7 @@ function _define_property$O(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$O(target) {
+function _object_spread$N(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -11993,12 +12298,12 @@ function _object_spread$O(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$O(target, key, source[key]);
+            _define_property$N(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$y(object, enumerableOnly) {
+function ownKeys$x(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -12006,17 +12311,17 @@ function ownKeys$y(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$y(target, source) {
+function _object_spread_props$x(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$y(Object(source)).forEach(function(key) {
+        ownKeys$x(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
-function _ts_generator$19(thisArg, body) {
+function _ts_generator$1a(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -12253,7 +12558,7 @@ function _ts_generator$19(thisArg, body) {
     var _input_commandName, _input_cache;
     var commandName = (_input_commandName = input.commandName) !== null && _input_commandName !== void 0 ? _input_commandName : DEFAULT_CLI_DATA_CACHE_COMMAND_NAME;
     var cliBuildStamp = input.cliBuildStamp;
-    var cache = (_input_cache = input.cache) !== null && _input_cache !== void 0 ? _input_cache : createCliDataCache(_object_spread$O({
+    var cache = (_input_cache = input.cache) !== null && _input_cache !== void 0 ? _input_cache : createCliDataCache(_object_spread$N({
         dataCacheDir: buildCliPaths({
             cliName: input.cliName
         }).dataCacheDir
@@ -12277,9 +12582,9 @@ function _ts_generator$19(thisArg, body) {
             });
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$19(function() {
+            return _async_to_generator$1a(function() {
                 var entries;
-                return _ts_generator$19(this, function(_state) {
+                return _ts_generator$1a(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             return [
@@ -12293,7 +12598,7 @@ function _ts_generator$19(thisArg, body) {
                             entries = _state.sent();
                             if (argv.json) {
                                 outputResult(entries.map(function(entry) {
-                                    return _object_spread_props$y(_object_spread$O({}, entry), {
+                                    return _object_spread_props$x(_object_spread$N({}, entry), {
                                         ageMs: entryAgeMs(entry)
                                     });
                                 }));
@@ -12328,9 +12633,9 @@ function _ts_generator$19(thisArg, body) {
             });
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$19(function() {
+            return _async_to_generator$1a(function() {
                 var entries, entry, meta, hit;
-                return _ts_generator$19(this, function(_state) {
+                return _ts_generator$1a(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             return [
@@ -12351,7 +12656,7 @@ function _ts_generator$19(thisArg, body) {
                                     suggestion: "Run `".concat(input.cliName, " ").concat(commandName, " list` to see what has been recorded.")
                                 });
                             }
-                            meta = _object_spread_props$y(_object_spread$O({}, entry), {
+                            meta = _object_spread_props$x(_object_spread$N({}, entry), {
                                 ageMs: entryAgeMs(entry),
                                 otherMatches: entries.length - 1
                             });
@@ -12370,7 +12675,7 @@ function _ts_generator$19(thisArg, body) {
                             ];
                         case 2:
                             hit = _state.sent();
-                            outputResult(_object_spread_props$y(_object_spread$O({}, meta), {
+                            outputResult(_object_spread_props$x(_object_spread$N({}, meta), {
                                 data: hit === null || hit === void 0 ? void 0 : hit.data
                             }));
                             return [
@@ -12413,9 +12718,9 @@ function _ts_generator$19(thisArg, body) {
             });
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$19(function() {
+            return _async_to_generator$1a(function() {
                 var removed;
-                return _ts_generator$19(this, function(_state) {
+                return _ts_generator$1a(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             return [
@@ -12462,9 +12767,9 @@ function _ts_generator$19(thisArg, body) {
             });
         },
         handler: wrapCommandHandler(function(argv) {
-            return _async_to_generator$19(function() {
+            return _async_to_generator$1a(function() {
                 var olderThanHours, removed;
-                return _ts_generator$19(this, function(_state) {
+                return _ts_generator$1a(this, function(_state) {
                     switch(_state.label){
                         case 0:
                             olderThanHours = Number(argv.olderThan);
@@ -12516,7 +12821,7 @@ function _array_like_to_array$10(arr, len) {
 function _array_with_holes$h(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _define_property$N(obj, key, value) {
+function _define_property$M(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -12554,7 +12859,7 @@ function _iterable_to_array_limit$h(arr, i) {
 function _non_iterable_rest$h() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$N(target) {
+function _object_spread$M(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -12564,12 +12869,12 @@ function _object_spread$N(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$N(target, key, source[key]);
+            _define_property$M(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$x(object, enumerableOnly) {
+function ownKeys$w(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -12577,11 +12882,11 @@ function ownKeys$x(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$x(target, source) {
+function _object_spread_props$w(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$x(Object(source)).forEach(function(key) {
+        ownKeys$w(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -12645,7 +12950,7 @@ function _unsupported_iterable_to_array$10(o, minLen) {
             var _step_value = _sliced_to_array$h(_step.value, 2), packageName = _step_value[0], builtAgainst = _step_value[1];
             var resolved = resolveVersion(packageName);
             if (resolved !== builtAgainst) {
-                drift.push(_object_spread$N({
+                drift.push(_object_spread$M({
                     packageName: packageName,
                     builtAgainst: builtAgainst
                 }, resolved == null ? {} : {
@@ -12681,11 +12986,11 @@ function _unsupported_iterable_to_array$10(o, minLen) {
     } else if (noneResolvable) {
         reason = 'framework-not-resolvable';
     }
-    return _object_spread_props$x(_object_spread$N(_object_spread_props$x(_object_spread$N({
+    return _object_spread_props$w(_object_spread$M(_object_spread_props$w(_object_spread$M({
         ok: (drift.length === 0 || noneResolvable) && !manifestGeneratorDrift
     }, reason == null ? {} : {
         reason: reason
-    }, artifactPackage == null ? {} : _object_spread$N({
+    }, artifactPackage == null ? {} : _object_spread$M({
         artifactPackagePath: artifactPackage.path
     }, artifactPackage.version == null ? {} : {
         artifactVersion: artifactPackage.version
@@ -12737,7 +13042,7 @@ function _unsupported_iterable_to_array$10(o, minLen) {
     if (packageJsonPath != null) {
         try {
             var contents = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
-            result = _object_spread_props$x(_object_spread$N({
+            result = _object_spread_props$w(_object_spread$M({
                 path: packageJsonPath
             }, typeof contents.name === 'string' ? {
                 name: contents.name
@@ -12746,7 +13051,7 @@ function _unsupported_iterable_to_array$10(o, minLen) {
             } : {}), {
                 // peers first so a `dependencies` entry wins on a conflict: an app that pins a framework
                 // package as a real dependency is the more specific declaration
-                frameworkVersions: _object_spread$N({}, exactFrameworkVersions(contents.peerDependencies), exactFrameworkVersions(contents.dependencies))
+                frameworkVersions: _object_spread$M({}, exactFrameworkVersions(contents.peerDependencies), exactFrameworkVersions(contents.dependencies))
             });
         } catch (unused) {
             // an unparsable or unreadable artifact package.json is indistinguishable from an absent one
@@ -12829,7 +13134,7 @@ function _unsupported_iterable_to_array$10(o, minLen) {
     return result;
 }
 
-function asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -12840,22 +13145,22 @@ function asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$18(fn) {
+function _async_to_generator$19(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$19(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$M(obj, key, value) {
+function _define_property$L(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -12866,7 +13171,7 @@ function _define_property$M(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$M(target) {
+function _object_spread$L(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -12876,12 +13181,12 @@ function _object_spread$M(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$M(target, key, source[key]);
+            _define_property$L(target, key, source[key]);
         });
     }
     return target;
 }
-function _ts_generator$18(thisArg, body) {
+function _ts_generator$19(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -12999,14 +13304,14 @@ function _ts_generator$18(thisArg, body) {
  */ function createCliBuildDriftDoctorCheck() {
     var input = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
     return function() {
-        return _async_to_generator$18(function() {
+        return _async_to_generator$19(function() {
             var report, description;
-            return _ts_generator$18(this, function(_state) {
+            return _ts_generator$19(this, function(_state) {
                 report = inspectCliBuildDrift(input);
                 description = cliBuildDriftDescription(report);
                 return [
                     2,
-                    _object_spread$M({
+                    _object_spread$L({
                         name: BUILD_DRIFT_DOCTOR_CHECK_NAME,
                         ok: report.ok,
                         detail: report
@@ -13019,15 +13324,7 @@ function _ts_generator$18(thisArg, body) {
     };
 }
 
-function _array_like_to_array$$(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_without_holes$T(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$$(arr);
-}
-function asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, key, arg) {
+function asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -13038,65 +13335,357 @@ function asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$17(fn) {
+function _async_to_generator$18(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$18(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$L(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else obj[key] = value;
-    return obj;
-}
-function _instanceof$o(left, right) {
+function _instanceof$p(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
     } else return left instanceof right;
 }
-function _iterable_to_array$T(iter) {
-    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
-        return Array.from(iter);
-    }
-}
-function _non_iterable_spread$T() {
-    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _object_spread$L(target) {
-    for(var i = 1; i < arguments.length; i++){
-        var source = arguments[i] != null ? arguments[i] : {};
-        var ownKeys = Object.keys(source);
-        if (typeof Object.getOwnPropertySymbols === "function") {
-            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
-            }));
-        }
-        ownKeys.forEach(function(key) {
-            _define_property$L(target, key, source[key]);
-        });
-    }
-    return target;
-}
-function _to_consumable_array$T(arr) {
-    return _array_without_holes$T(arr) || _iterable_to_array$T(arr) || _unsupported_iterable_to_array$$(arr) || _non_iterable_spread$T();
-}
-function _ts_generator$17(thisArg, body) {
+function _ts_generator$18(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Name reported by the check {@link createTokenRefreshDoctorCheck} builds.
+ */ var TOKEN_REFRESH_DOCTOR_CHECK_NAME = 'token-refresh-round-trip';
+/**
+ * Builds the doctor check that proves the cached refresh token still works.
+ *
+ * The round-trip is a REAL refresh, so on a rotating grant it consumes the cached refresh token and
+ * the response must be written back — see `mergeRefreshedTokenEntry`. Discarding it (as this check
+ * once did) leaves the cache holding a spent credential: the very next refresh fails
+ * `invalid_grant`, and a provider doing replay detection revokes the whole grant. The symptom is
+ * maximally confusing because the session dies only AFTER the cached access token lapses, so the
+ * damage surfaces well away from the `doctor` run that caused it.
+ *
+ * @param overrides - Optional test seams; production passes none.
+ * @returns The {@link DoctorCheck}.
+ * @__NO_SIDE_EFFECTS__
+ */ function createTokenRefreshDoctorCheck() {
+    var overrides = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
+    var _overrides_discoverOidcMetadata, _overrides_refreshAccessToken, _overrides_tokenStoreForCli;
+    var discoverMetadata = (_overrides_discoverOidcMetadata = overrides.discoverOidcMetadata) !== null && _overrides_discoverOidcMetadata !== void 0 ? _overrides_discoverOidcMetadata : discoverOidcMetadata;
+    var refresh = (_overrides_refreshAccessToken = overrides.refreshAccessToken) !== null && _overrides_refreshAccessToken !== void 0 ? _overrides_refreshAccessToken : refreshAccessToken;
+    var tokenStoreForCli = (_overrides_tokenStoreForCli = overrides.tokenStoreForCli) !== null && _overrides_tokenStoreForCli !== void 0 ? _overrides_tokenStoreForCli : function(cliName) {
+        return createCliTokenCacheStore({
+            tokenCachePath: buildCliPaths({
+                cliName: cliName
+            }).tokenCachePath
+        });
+    };
+    return function(param) {
+        var cliName = param.cliName, envName = param.envName, env = param.env;
+        return _async_to_generator$18(function() {
+            var result, tokens, entry, meta, refreshed, e;
+            return _ts_generator$18(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        if (!(!envName || !(env === null || env === void 0 ? void 0 : env.clientId))) return [
+                            3,
+                            1
+                        ];
+                        result = {
+                            name: TOKEN_REFRESH_DOCTOR_CHECK_NAME,
+                            ok: false,
+                            suggestion: 'Env credentials are incomplete.'
+                        };
+                        return [
+                            3,
+                            10
+                        ];
+                    case 1:
+                        tokens = tokenStoreForCli(cliName);
+                        return [
+                            4,
+                            tokens.get(envName)
+                        ];
+                    case 2:
+                        entry = _state.sent();
+                        if (!(entry === null || entry === void 0 ? void 0 : entry.refreshToken)) return [
+                            3,
+                            9
+                        ];
+                        _state.label = 3;
+                    case 3:
+                        _state.trys.push([
+                            3,
+                            7,
+                            ,
+                            8
+                        ]);
+                        return [
+                            4,
+                            discoverMetadata({
+                                issuer: env.oidcIssuer,
+                                fallbackBaseUrl: env.apiBaseUrl
+                            })
+                        ];
+                    case 4:
+                        meta = _state.sent();
+                        return [
+                            4,
+                            refresh({
+                                tokenEndpoint: meta.token_endpoint,
+                                clientId: env.clientId,
+                                clientSecret: env.clientSecret,
+                                refreshToken: entry.refreshToken
+                            })
+                        ];
+                    case 5:
+                        refreshed = _state.sent();
+                        // MUST persist: the round-trip consumed the cached refresh token when the grant rotates.
+                        // A diagnostic command must never break the thing it is diagnosing.
+                        return [
+                            4,
+                            tokens.set(envName, mergeRefreshedTokenEntry({
+                                entry: entry,
+                                refreshed: refreshed
+                            }))
+                        ];
+                    case 6:
+                        _state.sent();
+                        result = {
+                            name: TOKEN_REFRESH_DOCTOR_CHECK_NAME,
+                            ok: true,
+                            detail: {
+                                rotated: didRotateRefreshToken({
+                                    entry: entry,
+                                    refreshed: refreshed
+                                })
+                            }
+                        };
+                        return [
+                            3,
+                            8
+                        ];
+                    case 7:
+                        e = _state.sent();
+                        result = {
+                            name: TOKEN_REFRESH_DOCTOR_CHECK_NAME,
+                            ok: false,
+                            detail: {
+                                error: _instanceof$p(e, Error) ? e.message : String(e)
+                            },
+                            suggestion: "Run `".concat(cliName, " auth login --env ").concat(envName, "`.")
+                        };
+                        return [
+                            3,
+                            8
+                        ];
+                    case 8:
+                        return [
+                            3,
+                            10
+                        ];
+                    case 9:
+                        result = {
+                            name: TOKEN_REFRESH_DOCTOR_CHECK_NAME,
+                            ok: false,
+                            detail: {
+                                reason: 'no-refresh-token'
+                            },
+                            suggestion: 'No refresh token cached for env "'.concat(envName, '". Run `').concat(cliName, " auth login --env ").concat(envName, "` — if the env's scopes omit `offline_access`, the OIDC provider may not issue one.")
+                        };
+                        _state.label = 10;
+                    case 10:
+                        return [
+                            2,
+                            result
+                        ];
+                }
+            });
+        })();
+    };
+}
+
+function _array_like_to_array$$(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$T(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$$(arr);
+}
+function asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
+}
+function _async_to_generator$17(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$17(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _define_property$K(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _instanceof$o(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else return left instanceof right;
+}
+function _iterable_to_array$T(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
+        return Array.from(iter);
+    }
+}
+function _non_iterable_spread$T() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread$K(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$K(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function _to_consumable_array$T(arr) {
+    return _array_without_holes$T(arr) || _iterable_to_array$T(arr) || _unsupported_iterable_to_array$$(arr) || _non_iterable_spread$T();
+}
+function _ts_generator$17(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -13221,7 +13810,7 @@ function _unsupported_iterable_to_array$$(o, minLen) {
                 return _ts_generator$17(this, function(_state) {
                     return [
                         2,
-                        _object_spread$L({
+                        _object_spread$K({
                             name: 'config-file-present',
                             ok: !!config
                         }, config ? {} : {
@@ -13237,7 +13826,7 @@ function _unsupported_iterable_to_array$$(o, minLen) {
                 return _ts_generator$17(this, function(_state) {
                     return [
                         2,
-                        _object_spread$L({
+                        _object_spread$K({
                             name: 'active-env-resolved',
                             ok: !!envName && !!env,
                             detail: {
@@ -13356,7 +13945,7 @@ function _unsupported_iterable_to_array$$(o, minLen) {
                             entry = _state.sent();
                             if (entry) {
                                 expired = isTokenExpired(entry);
-                                result = _object_spread$L({
+                                result = _object_spread$K({
                                     name: 'token-cache-fresh',
                                     ok: !expired,
                                     detail: {
@@ -13393,117 +13982,7 @@ function _unsupported_iterable_to_array$$(o, minLen) {
                 });
             })();
         },
-        function(param) {
-            var cliName = param.cliName, envName = param.envName, env = param.env;
-            return _async_to_generator$17(function() {
-                var result, paths, tokens, entry, meta, e;
-                return _ts_generator$17(this, function(_state) {
-                    switch(_state.label){
-                        case 0:
-                            if (!(!envName || !(env === null || env === void 0 ? void 0 : env.clientId))) return [
-                                3,
-                                1
-                            ];
-                            result = {
-                                name: 'token-refresh-round-trip',
-                                ok: false,
-                                suggestion: 'Env credentials are incomplete.'
-                            };
-                            return [
-                                3,
-                                9
-                            ];
-                        case 1:
-                            paths = buildCliPaths({
-                                cliName: cliName
-                            });
-                            tokens = createCliTokenCacheStore({
-                                tokenCachePath: paths.tokenCachePath
-                            });
-                            return [
-                                4,
-                                tokens.get(envName)
-                            ];
-                        case 2:
-                            entry = _state.sent();
-                            if (!(entry === null || entry === void 0 ? void 0 : entry.refreshToken)) return [
-                                3,
-                                8
-                            ];
-                            _state.label = 3;
-                        case 3:
-                            _state.trys.push([
-                                3,
-                                6,
-                                ,
-                                7
-                            ]);
-                            return [
-                                4,
-                                discoverOidcMetadata({
-                                    issuer: env.oidcIssuer,
-                                    fallbackBaseUrl: env.apiBaseUrl
-                                })
-                            ];
-                        case 4:
-                            meta = _state.sent();
-                            return [
-                                4,
-                                refreshAccessToken({
-                                    tokenEndpoint: meta.token_endpoint,
-                                    clientId: env.clientId,
-                                    clientSecret: env.clientSecret,
-                                    refreshToken: entry.refreshToken
-                                })
-                            ];
-                        case 5:
-                            _state.sent();
-                            result = {
-                                name: 'token-refresh-round-trip',
-                                ok: true
-                            };
-                            return [
-                                3,
-                                7
-                            ];
-                        case 6:
-                            e = _state.sent();
-                            result = {
-                                name: 'token-refresh-round-trip',
-                                ok: false,
-                                detail: {
-                                    error: _instanceof$o(e, Error) ? e.message : String(e)
-                                },
-                                suggestion: "Run `".concat(cliName, " auth login --env ").concat(envName, "`.")
-                            };
-                            return [
-                                3,
-                                7
-                            ];
-                        case 7:
-                            return [
-                                3,
-                                9
-                            ];
-                        case 8:
-                            result = {
-                                name: 'token-refresh-round-trip',
-                                ok: false,
-                                detail: {
-                                    reason: 'no-refresh-token'
-                                },
-                                suggestion: 'No refresh token cached for env "'.concat(envName, '". Run `').concat(cliName, " auth login --env ").concat(envName, "` — if the env's scopes omit `offline_access`, the OIDC provider may not issue one.")
-                            };
-                            _state.label = 9;
-                        case 9:
-                            return [
-                                2,
-                                result
-                            ];
-                    }
-                });
-            })();
-        },
+        createTokenRefreshDoctorCheck(),
         function(param) {
             var env = param.env;
             return _async_to_generator$17(function() {
@@ -13737,7 +14216,7 @@ function _unsupported_iterable_to_array$$(o, minLen) {
     };
 }
 
-function _define_property$K(obj, key, value) {
+function _define_property$J(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -13748,7 +14227,7 @@ function _define_property$K(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$K(target) {
+function _object_spread$J(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -13758,12 +14237,12 @@ function _object_spread$K(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$K(target, key, source[key]);
+            _define_property$J(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$w(object, enumerableOnly) {
+function ownKeys$v(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -13771,11 +14250,11 @@ function ownKeys$w(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$w(target, source) {
+function _object_spread_props$v(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$w(Object(source)).forEach(function(key) {
+        ownKeys$v(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -13809,7 +14288,7 @@ function _object_spread_props$w(target, source) {
  * @__NO_SIDE_EFFECTS__
  */ function cliFirestoreQueryModeForRules(input) {
     var scope = input.scope, isNested = input.isNested, collectionGroup = input.collectionGroup, list = input.list, parentPaths = input.parentPaths;
-    var base = _object_spread$K({
+    var base = _object_spread$J({
         list: list,
         collectionGroup: collectionGroup
     }, parentPaths && parentPaths.length > 0 ? {
@@ -13820,21 +14299,21 @@ function _object_spread_props$w(target, source) {
         var reason = list === 'denied' ? 'list-denied' : 'list-unmatched';
         result = {
             mode: 'unavailable',
-            rules: _object_spread_props$w(_object_spread$K({}, base), {
+            rules: _object_spread_props$v(_object_spread$J({}, base), {
                 reason: reason
             })
         };
     } else if (scope === 'COLLECTION_GROUP' && !collectionGroup) {
         result = {
             mode: isNested ? 'parent-child' : 'unavailable',
-            rules: _object_spread_props$w(_object_spread$K({}, base), {
+            rules: _object_spread_props$v(_object_spread$J({}, base), {
                 reason: 'no-collection-group-rule'
             })
         };
     } else if (scope === 'COLLECTION' && isNested) {
         result = {
             mode: 'parent-child',
-            rules: _object_spread_props$w(_object_spread$K({}, base), {
+            rules: _object_spread_props$v(_object_spread$J({}, base), {
                 reason: 'nested-collection-scope'
             })
         };
@@ -14026,7 +14505,7 @@ function _async_to_generator$16(fn) {
         });
     };
 }
-function _define_property$J(obj, key, value) {
+function _define_property$I(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -14043,7 +14522,7 @@ function _instanceof$n(left, right) {
         return !!right[Symbol.hasInstance](left);
     } else return left instanceof right;
 }
-function _object_spread$J(target) {
+function _object_spread$I(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -14053,12 +14532,12 @@ function _object_spread$J(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$J(target, key, source[key]);
+            _define_property$I(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$v(object, enumerableOnly) {
+function ownKeys$u(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -14066,11 +14545,11 @@ function ownKeys$v(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$v(target, source) {
+function _object_spread_props$u(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$v(Object(source)).forEach(function(key) {
+        ownKeys$u(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -14269,7 +14748,7 @@ function _type_of$2(obj) {
      * @param firebaseConfigComplete - Whether the env carries a complete Firebase client config.
      * @returns The result with `detail.readRouting` attached.
      */ function withReadRouting(result, firebaseConfigComplete) {
-        var readRouting = buildFirestoreSessionDoctorReadRouting(_object_spread_props$v(_object_spread$J({}, input.firestore === undefined ? {} : {
+        var readRouting = buildFirestoreSessionDoctorReadRouting(_object_spread_props$u(_object_spread$I({}, input.firestore === undefined ? {} : {
             firestore: input.firestore
         }, input.modelManifest === undefined ? {} : {
             modelManifest: input.modelManifest
@@ -14279,8 +14758,8 @@ function _type_of$2(obj) {
             firebaseConfigComplete: firebaseConfigComplete,
             sessionOpened: result.ok
         }));
-        return _object_spread_props$v(_object_spread$J({}, result), {
-            detail: _object_spread_props$v(_object_spread$J({}, _type_of$2(result.detail) === 'object' && result.detail != null ? result.detail : {}), {
+        return _object_spread_props$u(_object_spread$I({}, result), {
+            detail: _object_spread_props$u(_object_spread$I({}, _type_of$2(result.detail) === 'object' && result.detail != null ? result.detail : {}), {
                 readRouting: readRouting
             })
         });
@@ -14455,7 +14934,7 @@ function runFirestoreSessionProbe(input) {
                     result = {
                         name: FIRESTORE_SESSION_DOCTOR_CHECK_NAME,
                         ok: false,
-                        detail: _object_spread_props$v(_object_spread$J({}, baseDetail), {
+                        detail: _object_spread_props$u(_object_spread$I({}, baseDetail), {
                             stage: FIRESTORE_SDK_IDENTITY_STAGE,
                             code: FIRESTORE_SDK_INSTANCE_MISMATCH_CODE,
                             probe: 'not-attempted'
@@ -14490,7 +14969,7 @@ function runFirestoreSessionProbe(input) {
                     result = {
                         name: FIRESTORE_SESSION_DOCTOR_CHECK_NAME,
                         ok: true,
-                        detail: _object_spread_props$v(_object_spread$J({}, baseDetail), {
+                        detail: _object_spread_props$u(_object_spread$I({}, baseDetail), {
                             probe: probeName !== null && probeName !== void 0 ? probeName : 'ok',
                             probeResult: probeResult
                         })
@@ -14504,7 +14983,7 @@ function runFirestoreSessionProbe(input) {
                     result = {
                         name: FIRESTORE_SESSION_DOCTOR_CHECK_NAME,
                         ok: false,
-                        detail: _object_spread_props$v(_object_spread$J({}, baseDetail), {
+                        detail: _object_spread_props$u(_object_spread$I({}, baseDetail), {
                             stage: 'rules-protected-read',
                             probe: probeName,
                             error: _instanceof$n(e1, Error) ? e1.message : String(e1)
@@ -14524,7 +15003,7 @@ function runFirestoreSessionProbe(input) {
                     result = {
                         name: FIRESTORE_SESSION_DOCTOR_CHECK_NAME,
                         ok: true,
-                        detail: _object_spread_props$v(_object_spread$J({}, baseDetail), {
+                        detail: _object_spread_props$u(_object_spread$I({}, baseDetail), {
                             probe: 'not-configured'
                         }),
                         suggestion: 'Signed in, but no rules-protected read was attempted. Pass a `probe` to `createFirestoreSessionDoctorCheck` so the check can prove App Check is accepted and rules pass.'
@@ -14695,7 +15174,7 @@ function _async_to_generator$15(fn) {
         });
     };
 }
-function _define_property$I(obj, key, value) {
+function _define_property$H(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -14739,7 +15218,7 @@ function _iterable_to_array_limit$g(arr, i) {
 function _non_iterable_rest$g() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$I(target) {
+function _object_spread$H(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -14749,12 +15228,12 @@ function _object_spread$I(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$I(target, key, source[key]);
+            _define_property$H(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$u(object, enumerableOnly) {
+function ownKeys$t(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -14762,11 +15241,11 @@ function ownKeys$u(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$u(target, source) {
+function _object_spread_props$t(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$u(Object(source)).forEach(function(key) {
+        ownKeys$t(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -14975,7 +15454,7 @@ function resolveEnvWithDefault(input) {
                                         storedEnv: env,
                                         defaultEnvs: defaultEnvs
                                     });
-                                    return _object_spread$I({
+                                    return _object_spread$H({
                                         name: name,
                                         active: name === config.activeEnv
                                     }, (resolved === null || resolved === void 0 ? void 0 : resolved.defaultName) ? {
@@ -14983,9 +15462,9 @@ function resolveEnvWithDefault(input) {
                                     } : {}, maskEnv((_ref = resolved === null || resolved === void 0 ? void 0 : resolved.env) !== null && _ref !== void 0 ? _ref : env));
                                 }),
                                 defaults: defaultEnvs === null || defaultEnvs === void 0 ? void 0 : defaultEnvs.map(function(d) {
-                                    return _object_spread$I({
+                                    return _object_spread$H({
                                         names: d.names
-                                    }, maskEnv(_object_spread$I({
+                                    }, maskEnv(_object_spread$H({
                                         apiBaseUrl: '',
                                         oidcIssuer: ''
                                     }, d.env)));
@@ -15090,7 +15569,7 @@ function resolveEnvWithDefault(input) {
                     switch(_state.label){
                         case 0:
                             firebase = cliFirebaseConfigFromArgv(argv);
-                            stored = _object_spread$I({
+                            stored = _object_spread$H({
                                 apiBaseUrl: (_argv_apiBaseUrl = argv.apiBaseUrl) !== null && _argv_apiBaseUrl !== void 0 ? _argv_apiBaseUrl : '',
                                 oidcIssuer: (_argv_oidcIssuer = argv.oidcIssuer) !== null && _argv_oidcIssuer !== void 0 ? _argv_oidcIssuer : '',
                                 appClientUrl: argv.appClientUrl,
@@ -15103,8 +15582,8 @@ function resolveEnvWithDefault(input) {
                                 mergeCliConfig({
                                     configFilePath: paths.configFilePath,
                                     configDir: paths.configDir,
-                                    updates: _object_spread$I({
-                                        envs: _define_property$I({}, argv.name, stored)
+                                    updates: _object_spread$H({
+                                        envs: _define_property$H({}, argv.name, stored)
                                     }, argv.setActive ? {
                                         activeEnv: argv.name
                                     } : {})
@@ -15117,7 +15596,7 @@ function resolveEnvWithDefault(input) {
                                 storedEnv: stored,
                                 defaultEnvs: defaultEnvs
                             });
-                            outputResult(_object_spread_props$u(_object_spread$I({
+                            outputResult(_object_spread_props$t(_object_spread$H({
                                 added: argv.name,
                                 activeEnv: merged.activeEnv
                             }, (resolved === null || resolved === void 0 ? void 0 : resolved.defaultName) ? {
@@ -15174,7 +15653,7 @@ function resolveEnvWithDefault(input) {
                                     code: 'ENV_NOT_FOUND'
                                 });
                             }
-                            outputResult(_object_spread$I({
+                            outputResult(_object_spread$H({
                                 name: name,
                                 active: name === config.activeEnv
                             }, resolved.defaultName ? {
@@ -15217,10 +15696,10 @@ function resolveEnvWithDefault(input) {
                                     code: 'ENV_NOT_FOUND'
                                 });
                             }
-                            nextEnvs = _object_spread$I({}, config.envs);
+                            nextEnvs = _object_spread$H({}, config.envs);
                             delete nextEnvs[argv.name];
                             nextActive = config.activeEnv === argv.name ? undefined : config.activeEnv;
-                            next = _object_spread_props$u(_object_spread$I({}, config), {
+                            next = _object_spread_props$t(_object_spread$H({}, config), {
                                 envs: nextEnvs,
                                 activeEnv: nextActive
                             });
@@ -15260,7 +15739,7 @@ function resolveEnvWithDefault(input) {
                                 6
                             ];
                         case 6:
-                            outputResult(_object_spread$I({
+                            outputResult(_object_spread$H({
                                 removed: argv.name,
                                 activeEnv: nextActive
                             }, tokenRemovalWarning ? {
@@ -15784,7 +16263,7 @@ function sortedUnique(values) {
     return unique(_to_consumable_array$S(values)).sort(compareStrings);
 }
 
-function _define_property$H(obj, key, value) {
+function _define_property$G(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -15795,7 +16274,7 @@ function _define_property$H(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$H(target) {
+function _object_spread$G(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -15805,12 +16284,12 @@ function _object_spread$H(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$H(target, key, source[key]);
+            _define_property$G(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$t(object, enumerableOnly) {
+function ownKeys$s(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -15818,11 +16297,11 @@ function ownKeys$t(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$t(target, source) {
+function _object_spread_props$s(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$t(Object(source)).forEach(function(key) {
+        ownKeys$s(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -15944,12 +16423,12 @@ function _object_without_properties_loose(source, excluded) {
     var factory = entry.factory, rest = _object_without_properties(entry, [
         "factory"
     ]);
-    return _object_spread_props$t(_object_spread$H({}, rest), {
+    return _object_spread_props$s(_object_spread$G({}, rest), {
         invocable: factory != null
     });
 }
 
-function _define_property$G(obj, key, value) {
+function _define_property$F(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -15960,7 +16439,7 @@ function _define_property$G(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$G(target) {
+function _object_spread$F(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -15970,12 +16449,12 @@ function _object_spread$G(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$G(target, key, source[key]);
+            _define_property$F(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$s(object, enumerableOnly) {
+function ownKeys$r(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -15983,11 +16462,11 @@ function ownKeys$s(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$s(target, source) {
+function _object_spread_props$r(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$s(Object(source)).forEach(function(key) {
+        ownKeys$r(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -16029,7 +16508,7 @@ function _object_spread_props$s(target, source) {
         });
     }
     if (parentKey != null) {
-        assertCliFirestoreQueryParentKey(_object_spread$G({
+        assertCliFirestoreQueryParentKey(_object_spread$F({
             modelType: modelType,
             parentKey: parentKey
         }, parentPaths === undefined ? {} : {
@@ -16058,7 +16537,7 @@ function _object_spread_props$s(target, source) {
             result = override;
         }
     } catch (e) {
-        throw cliFirestoreWiringError(_object_spread_props$s(_object_spread$G({
+        throw cliFirestoreWiringError(_object_spread_props$r(_object_spread$F({
             error: e,
             operation: 'resolve the Firestore collection for this query',
             modelType: modelType
@@ -16167,7 +16646,7 @@ function _object_spread_props$s(target, source) {
         var parentRef = firestoreContext.drivers.firestoreAccessorDriver.docAtPath(firestoreContext.firestore, parentKey);
         // The spread is REQUIRED, not stylistic: `makeFirestoreCollectionGroup` mutates `config.cache`, so
         // reusing the object would rewrite the registered group's cache in place.
-        result = makeFirestoreCollectionGroup(_object_spread_props$s(_object_spread$G({}, group.config), {
+        result = makeFirestoreCollectionGroup(_object_spread_props$r(_object_spread$F({}, group.config), {
             queryLike: firestoreContext.subcollection(parentRef, collectionName)
         }));
     } catch (e) {
@@ -16515,7 +16994,7 @@ function _async_to_generator$13(fn) {
         });
     };
 }
-function _define_property$F(obj, key, value) {
+function _define_property$E(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -16534,7 +17013,7 @@ function _iterable_to_array$Q(iter) {
 function _non_iterable_spread$Q() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _object_spread$F(target) {
+function _object_spread$E(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -16544,12 +17023,12 @@ function _object_spread$F(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$F(target, key, source[key]);
+            _define_property$E(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$r(object, enumerableOnly) {
+function ownKeys$q(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -16557,11 +17036,11 @@ function ownKeys$r(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$r(target, source) {
+function _object_spread_props$q(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$r(Object(source)).forEach(function(key) {
+        ownKeys$q(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -16742,7 +17221,7 @@ function _unsupported_iterable_to_array$X(o, minLen) {
                         rawParams: rawParams,
                         limit: limit
                     });
-                    collection = cliFirestoreCollectionForQuery(_object_spread$F({
+                    collection = cliFirestoreCollectionForQuery(_object_spread$E({
                         models: models,
                         // the catalog records the COLLECTION NAME (`gb`) because that is what `firestore.indexes.json`
                         // keys on, while the app's model services are keyed by MODEL TYPE (`guestbook`) — the join goes
@@ -16755,7 +17234,7 @@ function _unsupported_iterable_to_array$X(o, minLen) {
                         parentPaths: entry.rules.parentPaths
                     }));
                     executable = (_collection = collection).queryDocument.apply(_collection, _to_consumable_array$Q(constraints));
-                    base = _object_spread_props$r(_object_spread$F({
+                    base = _object_spread_props$q(_object_spread$E({
                         slug: entry.slug,
                         model: entry.model,
                         collection: entry.collection,
@@ -16770,7 +17249,7 @@ function _unsupported_iterable_to_array$X(o, minLen) {
                         2
                     ];
                     _tmp = [
-                        _object_spread$F({}, base)
+                        _object_spread$E({}, base)
                     ];
                     _tmp1 = {};
                     return [
@@ -16778,7 +17257,7 @@ function _unsupported_iterable_to_array$X(o, minLen) {
                         executable.countDocs()
                     ];
                 case 1:
-                    result = _object_spread_props$r.apply(void 0, _tmp.concat([
+                    result = _object_spread_props$q.apply(void 0, _tmp.concat([
                         (_tmp1.count = _state.sent(), _tmp1)
                     ]));
                     return [
@@ -16801,7 +17280,7 @@ function _unsupported_iterable_to_array$X(o, minLen) {
                             data: pair.document.converter.fromFirestore(pair.snapshot)
                         };
                     });
-                    result = _object_spread_props$r(_object_spread$F({}, base), {
+                    result = _object_spread_props$q(_object_spread$E({}, base), {
                         rows: rows,
                         count: rows.length
                     });
@@ -16842,7 +17321,7 @@ function _async_to_generator$12(fn) {
         });
     };
 }
-function _define_property$E(obj, key, value) {
+function _define_property$D(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -16853,7 +17332,7 @@ function _define_property$E(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$E(target) {
+function _object_spread$D(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -16863,7 +17342,7 @@ function _object_spread$E(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$E(target, key, source[key]);
+            _define_property$D(target, key, source[key]);
         });
     }
     return target;
@@ -17128,7 +17607,7 @@ var EPILOGUE = [
                             ];
                         case 1:
                             cached = _state.sent();
-                            outputResult(cached.data, _object_spread$E({
+                            outputResult(cached.data, _object_spread$D({
                                 source: cached.fromCache ? 'cache' : 'firestore'
                             }, sessionFromCache === undefined ? {} : {
                                 sessionFromCache: sessionFromCache
@@ -17169,7 +17648,7 @@ function _async_to_generator$11(fn) {
         });
     };
 }
-function _define_property$D(obj, key, value) {
+function _define_property$C(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -17180,7 +17659,7 @@ function _define_property$D(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _object_spread$D(target) {
+function _object_spread$C(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
         var ownKeys = Object.keys(source);
@@ -17190,12 +17669,12 @@ function _object_spread$D(target) {
             }));
         }
         ownKeys.forEach(function(key) {
-            _define_property$D(target, key, source[key]);
+            _define_property$C(target, key, source[key]);
         });
     }
     return target;
 }
-function ownKeys$q(object, enumerableOnly) {
+function ownKeys$p(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -17203,11 +17682,11 @@ function ownKeys$q(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$q(target, source) {
+function _object_spread_props$p(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$q(Object(source)).forEach(function(key) {
+        ownKeys$p(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -17394,7 +17873,7 @@ function _ts_generator$11(thisArg, body) {
                         // so these stay drop-in and there remains exactly ONE implementation of it
                         return [
                             2,
-                            _object_spread_props$q(_object_spread$D({}, models), {
+                            _object_spread_props$p(_object_spread$C({}, models), {
                                 readModel: function readModel(modelType, key) {
                                     return getModelOverFirestore({
                                         models: models,
@@ -17773,50 +18252,6 @@ function _async_to_generator$10(fn) {
         });
     };
 }
-function _define_property$C(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else obj[key] = value;
-    return obj;
-}
-function _object_spread$C(target) {
-    for(var i = 1; i < arguments.length; i++){
-        var source = arguments[i] != null ? arguments[i] : {};
-        var ownKeys = Object.keys(source);
-        if (typeof Object.getOwnPropertySymbols === "function") {
-            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
-            }));
-        }
-        ownKeys.forEach(function(key) {
-            _define_property$C(target, key, source[key]);
-        });
-    }
-    return target;
-}
-function ownKeys$p(object, enumerableOnly) {
-    var keys = Object.keys(object);
-    if (Object.getOwnPropertySymbols) {
-        var symbols = Object.getOwnPropertySymbols(object);
-        keys.push.apply(keys, symbols);
-    }
-    return keys;
-}
-function _object_spread_props$p(target, source) {
-    source = source != null ? source : {};
-    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
-    else {
-        ownKeys$p(Object(source)).forEach(function(key) {
-            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
-        });
-    }
-    return target;
-}
 function _ts_generator$10(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -18100,7 +18535,7 @@ function _ts_generator$10(thisArg, body) {
  * @throws {CliError} When the entry is expired and has no refresh token.
  */ function refreshTokenEntry(input) {
     return _async_to_generator$10(function() {
-        var _refreshed_refresh_token, _refreshed_token_type, _refreshed_scope, _refreshed_expires_in, cliName, envName, env, tokens, entry, meta, suppliedRefreshToken, refreshed, updated;
+        var cliName, envName, env, tokens, entry, meta, refreshed, updated;
         return _ts_generator$10(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -18121,24 +18556,20 @@ function _ts_generator$10(thisArg, body) {
                     ];
                 case 1:
                     meta = _state.sent();
-                    suppliedRefreshToken = entry.refreshToken;
                     return [
                         4,
                         refreshAccessToken({
                             tokenEndpoint: meta.token_endpoint,
                             clientId: env.clientId,
                             clientSecret: env.clientSecret,
-                            refreshToken: suppliedRefreshToken
+                            refreshToken: entry.refreshToken
                         })
                     ];
                 case 2:
                     refreshed = _state.sent();
-                    updated = _object_spread_props$p(_object_spread$C({}, entry), {
-                        accessToken: refreshed.access_token,
-                        refreshToken: (_refreshed_refresh_token = refreshed.refresh_token) !== null && _refreshed_refresh_token !== void 0 ? _refreshed_refresh_token : entry.refreshToken,
-                        tokenType: (_refreshed_token_type = refreshed.token_type) !== null && _refreshed_token_type !== void 0 ? _refreshed_token_type : entry.tokenType,
-                        scope: (_refreshed_scope = refreshed.scope) !== null && _refreshed_scope !== void 0 ? _refreshed_scope : entry.scope,
-                        expiresAt: Date.now() + ((_refreshed_expires_in = refreshed.expires_in) !== null && _refreshed_expires_in !== void 0 ? _refreshed_expires_in : 0) * 1000
+                    updated = mergeRefreshedTokenEntry({
+                        entry: entry,
+                        refreshed: refreshed
                     });
                     if (!updated.fromEnv) return [
                         3,
@@ -18147,7 +18578,10 @@ function _ts_generator$10(thisArg, body) {
                     // Service tokens do not rotate, so a one-shot env-sourced invocation is durable without
                     // persisting. If a *rotating* refresh token was supplied, the rotation is lost on exit —
                     // warn that env credentials should be non-rotating service tokens.
-                    if (refreshed.refresh_token != null && refreshed.refresh_token !== suppliedRefreshToken) {
+                    if (didRotateRefreshToken({
+                        entry: entry,
+                        refreshed: refreshed
+                    })) {
                         process.stderr.write('Warning: the refresh token supplied via environment rotated on use; the rotated token cannot be persisted for a one-shot invocation. Use a non-rotating service token (auth login --service-token).\n');
                     }
                     return [
@@ -26827,6 +27261,10 @@ var FIREBASE_MODELS = [
         description: 'Root notification container for a model. The document ID is the two-way flat key of the model it represents (see {@link notificationBoxIdForModel} in `notification.id.ts`).',
         modelGroup: 'Notification',
         collectionKind: 'root',
+        compositeKey: {
+            from: '*',
+            encoding: 'two-way'
+        },
         archetypes: [
             'composite-key-root'
         ]
@@ -26914,6 +27352,10 @@ var FIREBASE_MODELS = [
         description: 'Aggregated notification feed for a specific model. Holds embedded {@link NotificationItem} entries that summarize recent notifications, similar to an activity feed.',
         modelGroup: 'Notification',
         collectionKind: 'root',
+        compositeKey: {
+            from: '*',
+            encoding: 'two-way'
+        },
         archetypes: [
             'root-singleton-aggregate',
             'composite-key-root'
@@ -65937,11 +66379,21 @@ function _unsupported_iterable_to_array$6(o, minLen) {
     if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
 }
 // MARK: Defaults
-var DEFAULT_BUNDLED_FILENAMES = [
+/**
+ * The bundled `@dereekb/*` utils manifests to load at startup. Must stay in step with the `utils.scan` entries in
+ * `dbx-mcp.config.json` — a generated manifest that is missing from this list is silently invisible to
+ * `dbx_util_lookup`/`dbx_util_search` no matter how well its exports are tagged.
+ *
+ * Loading is non-strict, so naming a file that a given workspace has not generated warns and skips rather than
+ * failing server startup.
+ */ var DEFAULT_BUNDLED_FILENAMES = [
     'dereekb-util.utils.mcp.generated.json',
+    'dereekb-util-fetch.utils.mcp.generated.json',
     'dereekb-date.utils.mcp.generated.json',
     'dereekb-rxjs.utils.mcp.generated.json',
-    'dereekb-model.utils.mcp.generated.json'
+    'dereekb-model.utils.mcp.generated.json',
+    'dereekb-firebase.utils.mcp.generated.json',
+    'dereekb-firebase-server.utils.mcp.generated.json'
 ];
 var DEFAULT_BUNDLED_PATHS = function DEFAULT_BUNDLED_PATHS() {
     var packageRoot = findPackageRoot(import.meta.url);
@@ -70016,4 +70468,4 @@ function printPaginatedOutput(input) {
     })();
 }
 
-export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILD_DRIFT_DOCTOR_CHECK_NAME, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER, CLI_CONFIG_FILE_MODE, CLI_DATA_CACHE_CYCLE_ERROR_CODE, CLI_DATA_CACHE_FINGERPRINT_LENGTH, CLI_DATA_CACHE_GLOBAL_OPTION_NAMES, CLI_DATA_CACHE_INDEX_FILE_NAME, CLI_DATA_CACHE_SCHEMA_VERSION, CLI_DATA_CACHE_UNSUPPORTED_VALUE_ERROR_CODE, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CLI_FIRESTORE_QUERY_DATASET_PREFIX, CLI_FIRESTORE_QUERY_DATASET_VERSION, CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS, CLI_FIRESTORE_SESSION_MAX_CACHE_MS, CLI_FRAMEWORK_PACKAGE_PREFIX, CLI_READ_VIA_EPILOGUE, CLI_READ_VIA_VALUES, CLI_TOKEN_CLAIM_ENDPOINT_PATH_PART, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_CODEC, DEFAULT_CLI_DATA_CACHE_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_MAX_AGE_HOURS, DEFAULT_CLI_DATA_CACHE_OPTIONS, DEFAULT_CLI_FIREBASE_EMULATOR_HOST, DEFAULT_CLI_HTTP_TIMEOUT_MS, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_READ_VIA, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FIRESTORE_GET_COMMAND_NAME, DEFAULT_FIRESTORE_QUERIES_COMMAND_NAME, DEFAULT_FIRESTORE_QUERY_COMMAND_NAME, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_HANDOFF_ENV_NAME, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DISABLED_CLI_DATA_CACHE_OPTIONS, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FIRESTORE_COLLECTION_UNRESOLVABLE_CODE, FIRESTORE_QUERY_PARENT_REQUIRED_CODE, FIRESTORE_QUERY_UNAVAILABLE_CODE, FIRESTORE_SDK_IDENTITY_STAGE, FIRESTORE_SDK_INSTANCE_MISMATCH_CODE, FIRESTORE_SESSION_DOCTOR_CHECK_NAME, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, LOOPBACK_REDIRECT_HOSTNAMES, LOOPBACK_REDIRECT_LISTEN_FAILED_ERROR_CODE, LOOPBACK_REDIRECT_TIMEOUT_ERROR_CODE, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_IS_SERVER_ONLY_CODE, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, ROUTE_MANIFEST_VERSION, ROUTE_MODEL_LIST_TAG, ROUTE_MODEL_TAG, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, STDIN_NOT_PIPED_ERROR_CODE, SUGGESTED_CLI_LOOPBACK_REDIRECT_PORT, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, appendCliErrorMapper, applyEnvVarOverrides, assertCliFirestoreQueryCanRun, assertCliFirestoreQueryParentKey, assertCliModelIsNotServerOnly, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliHandoffClaimEndpoint, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildFirestoreGetCommand, buildFirestoreQueriesCommand, buildFirestoreQueryCommand, buildFirestoreSessionDoctorReadRouting, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildPipesManifest, buildRouteManifest, buildRouteTree, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, canonicalCliCacheJson, checkCliDataCacheArgv, claimCliHandoff, clearDownstreamCatalogCache, cliBuildDriftDescription, cliCacheFingerprint, cliDataCacheKey, cliDataCacheMeta, cliDataCacheOptions, cliDataCachePathSegment, cliFirebaseEmulatorsInUse, cliFirestoreAccessorFactory, cliFirestoreBinding, cliFirestoreCollectionForQuery, cliFirestoreErrorMapper, cliFirestoreQueryConstraints, cliFirestoreQueryMode, cliFirestoreQueryModeForRules, cliFirestoreSdkIdentitySuggestion, cliFirestoreSessionEntryExpiresAt, cliFirestoreSessionErrorFactory, cliFirestoreSessionFetcher, cliFirestoreWiringError, cliIssuersMatch, cliLifecycleRunner, cliReadResultMeta, closeAllCliFirebaseApps, closeCliFirestoreSessionContext, coerceCliReadVia, collectClassPropertiesWithInheritance, computeRelativeSpecifiers, configureCliDataCacheOptions, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCacheCommand, createCallModelCommand, createCli, createCliBuildDriftDoctorCheck, createCliContext, createCliDataCache, createCliFirestoreModels, createCliFirestoreQueryRegistry, createCliFirestoreSessionCacheStore, createCliFirestoreSessionContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createFirestoreSessionDoctorCheck, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, describeCliFirestoreQueryMode, detectDataHelpFormat, detectHelpMode, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractComponentRouteModelTags, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFile, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUrlParamKeys, extractUtilEntries, fetchFirestoreSession, fetchSessionInfo, fetchUserInfo, filterCliFirestoreQueries, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, flattenList, formatGeneratedTs, fromCliCacheJson, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverFirestore, getModelOverHttp, getMultipleModelsOverFirestore, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, hasParamSegment, indentLines$1 as indentLines, inspectCliBuildDrift, inspectCliFirestoreSdkIdentity, isCliEnvConfigComplete, isCliFirebaseConfigComplete, isCliFirestoreQueryInvocable, isCliFirestoreSessionExpired, isCliVerbose, isCoreTopic, isEntryExpired, isExportedFromPackage, isStdinPositionalSentinel, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadOrBuildCliCachedData, loadPackageName, loadPipeManifests, loadPipeRegistry, loadRouteTree, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, matchUrlAgainstEntries, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeCliFirebaseConfig, mergeOutputConfig, normalizeCliCacheFilter, normalizePathname, oidcRelyingPartyErrorToCliError, openStreamingDump, openUrlInBrowser, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseFirestoreModelIdentityArgs, parseGetArgs, parseGetManyArgs, parseLoopbackRedirectUri, parsePastedRedirect, parseRouteModelTag, parseScanArgs, pickFields, promptLine, readAllStdin, readCliArtifactPackage, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderCliFirestoreQueryEntry, renderCliFirestoreQueryList, renderDecodedKey, renderGroupedImportLines, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, renderTable, requireCliContext, requireCliFirestoreContext, requireCliFirestoreModels, requireCliFirestoreSession, resolveActiveEnvName, resolveCliDataCacheOptions, resolveCliEnv, resolveCliEnvOrThrow, resolveCliFirestoreQueryArgs, resolveCliFirestoreQueryEntry, resolveCliModel, resolveCliReadSource, resolveComponentSourceFromSources, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveExtendsName, resolveModelArchetype, resolveOutputConfig, resolveOxfmtConfig, resolvePerModelGetKey, resolveRouteSources, revokeToken, runActionsScanCli, runCli, runCliFirestoreQuery, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, sanitizeTypeText, saveCliConfig, scanFactoryReferences, scoreCandidates, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliRawArgv, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, splitSegments, startLoopbackRedirectCapture, stripUrlQueryAndHash, toActionEntryInfo, toCliCacheJson, toFilterEntryInfo, toFormFieldInfo, tracedFetch, truncate, tryMatchSegments, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler, writeGeneratedTsFile };
+export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILD_DRIFT_DOCTOR_CHECK_NAME, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER, CLI_CONFIG_FILE_MODE, CLI_DATA_CACHE_CYCLE_ERROR_CODE, CLI_DATA_CACHE_FINGERPRINT_LENGTH, CLI_DATA_CACHE_GLOBAL_OPTION_NAMES, CLI_DATA_CACHE_INDEX_FILE_NAME, CLI_DATA_CACHE_SCHEMA_VERSION, CLI_DATA_CACHE_UNSUPPORTED_VALUE_ERROR_CODE, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CLI_FIRESTORE_QUERY_DATASET_PREFIX, CLI_FIRESTORE_QUERY_DATASET_VERSION, CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS, CLI_FIRESTORE_SESSION_MAX_CACHE_MS, CLI_FRAMEWORK_PACKAGE_PREFIX, CLI_READ_VIA_EPILOGUE, CLI_READ_VIA_VALUES, CLI_TOKEN_CLAIM_ENDPOINT_PATH_PART, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_BUNDLED_FILENAMES, DEFAULT_CLI_DATA_CACHE_CODEC, DEFAULT_CLI_DATA_CACHE_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_MAX_AGE_HOURS, DEFAULT_CLI_DATA_CACHE_OPTIONS, DEFAULT_CLI_FIREBASE_EMULATOR_HOST, DEFAULT_CLI_HTTP_TIMEOUT_MS, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_READ_VIA, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FIRESTORE_GET_COMMAND_NAME, DEFAULT_FIRESTORE_QUERIES_COMMAND_NAME, DEFAULT_FIRESTORE_QUERY_COMMAND_NAME, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_HANDOFF_ENV_NAME, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DISABLED_CLI_DATA_CACHE_OPTIONS, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FIRESTORE_COLLECTION_UNRESOLVABLE_CODE, FIRESTORE_QUERY_PARENT_REQUIRED_CODE, FIRESTORE_QUERY_UNAVAILABLE_CODE, FIRESTORE_SDK_IDENTITY_STAGE, FIRESTORE_SDK_INSTANCE_MISMATCH_CODE, FIRESTORE_SESSION_DOCTOR_CHECK_NAME, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, LOOPBACK_REDIRECT_HOSTNAMES, LOOPBACK_REDIRECT_LISTEN_FAILED_ERROR_CODE, LOOPBACK_REDIRECT_TIMEOUT_ERROR_CODE, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_IS_SERVER_ONLY_CODE, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, ROUTE_MANIFEST_VERSION, ROUTE_MODEL_LIST_TAG, ROUTE_MODEL_TAG, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, STDIN_NOT_PIPED_ERROR_CODE, SUGGESTED_CLI_LOOPBACK_REDIRECT_PORT, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_REFRESH_DOCTOR_CHECK_NAME, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, appendCliErrorMapper, applyEnvVarOverrides, assertCliFirestoreQueryCanRun, assertCliFirestoreQueryParentKey, assertCliModelIsNotServerOnly, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliHandoffClaimEndpoint, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildFirestoreGetCommand, buildFirestoreQueriesCommand, buildFirestoreQueryCommand, buildFirestoreSessionDoctorReadRouting, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildPipesManifest, buildRouteManifest, buildRouteTree, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, canonicalCliCacheJson, checkCliDataCacheArgv, claimCliHandoff, clearDownstreamCatalogCache, cliBuildDriftDescription, cliCacheFingerprint, cliDataCacheKey, cliDataCacheMeta, cliDataCacheOptions, cliDataCachePathSegment, cliFirebaseEmulatorsInUse, cliFirestoreAccessorFactory, cliFirestoreBinding, cliFirestoreCollectionForQuery, cliFirestoreErrorMapper, cliFirestoreQueryConstraints, cliFirestoreQueryMode, cliFirestoreQueryModeForRules, cliFirestoreSdkIdentitySuggestion, cliFirestoreSessionEntryExpiresAt, cliFirestoreSessionErrorFactory, cliFirestoreSessionFetcher, cliFirestoreWiringError, cliIssuersMatch, cliLifecycleRunner, cliReadResultMeta, closeAllCliFirebaseApps, closeCliFirestoreSessionContext, coerceCliReadVia, collectClassPropertiesWithInheritance, computeRelativeSpecifiers, configureCliDataCacheOptions, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCacheCommand, createCallModelCommand, createCli, createCliBuildDriftDoctorCheck, createCliContext, createCliDataCache, createCliFirestoreModels, createCliFirestoreQueryRegistry, createCliFirestoreSessionCacheStore, createCliFirestoreSessionContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createFirestoreSessionDoctorCheck, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRefreshDoctorCheck, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, decodeFirestoreModelKeySegments, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, describeCliFirestoreQueryMode, detectDataHelpFormat, detectHelpMode, didRotateRefreshToken, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractComponentRouteModelTags, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFile, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUrlParamKeys, extractUtilEntries, fetchFirestoreSession, fetchSessionInfo, fetchUserInfo, filterCliFirestoreQueries, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, findCompositeKeyModelsDerivedFrom, flattenList, formatGeneratedTs, fromCliCacheJson, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverFirestore, getModelOverHttp, getMultipleModelsOverFirestore, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, hasParamSegment, indentLines$1 as indentLines, inspectCliBuildDrift, inspectCliFirestoreSdkIdentity, isCliEnvConfigComplete, isCliFirebaseConfigComplete, isCliFirestoreQueryInvocable, isCliFirestoreSessionExpired, isCliVerbose, isCoreTopic, isEntryExpired, isExportedFromPackage, isStdinPositionalSentinel, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadOrBuildCliCachedData, loadPackageName, loadPipeManifests, loadPipeRegistry, loadRouteTree, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, matchUrlAgainstEntries, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeCliFirebaseConfig, mergeOutputConfig, mergeRefreshedTokenEntry, normalizeCliCacheFilter, normalizePathname, oidcRelyingPartyErrorToCliError, openStreamingDump, openUrlInBrowser, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseFirestoreModelIdentityArgs, parseGetArgs, parseGetManyArgs, parseLoopbackRedirectUri, parsePastedRedirect, parseRouteModelTag, parseScanArgs, pickFields, promptLine, readAllStdin, readCliArtifactPackage, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderCliFirestoreQueryEntry, renderCliFirestoreQueryList, renderDecodedKey, renderGroupedImportLines, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, renderTable, requireCliContext, requireCliFirestoreContext, requireCliFirestoreModels, requireCliFirestoreSession, resolveActiveEnvName, resolveCliDataCacheOptions, resolveCliEnv, resolveCliEnvOrThrow, resolveCliFirestoreQueryArgs, resolveCliFirestoreQueryEntry, resolveCliModel, resolveCliReadSource, resolveComponentSourceFromSources, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveExtendsName, resolveModelArchetype, resolveOutputConfig, resolveOxfmtConfig, resolvePerModelGetKey, resolveRouteSources, revokeToken, runActionsScanCli, runCli, runCliFirestoreQuery, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, sanitizeTypeText, saveCliConfig, scanFactoryReferences, scoreCandidates, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliRawArgv, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, splitSegments, startLoopbackRedirectCapture, stripUrlQueryAndHash, toActionEntryInfo, toCliCacheJson, toFilterEntryInfo, toFormFieldInfo, tracedFetch, truncate, tryMatchSegments, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler, writeGeneratedTsFile };