@dereekb/dbx-components-mcp 13.43.0 → 14.0.1

package/dbx-components-mcp.js

@@ -10,7 +10,7 @@ var __export = (target, all) => {
 // packages/dbx-components-mcp/package.json
 var package_default = {
   name: "@dereekb/dbx-components-mcp",
-  version: "13.43.0",
+  version: "14.0.1",
   type: "module",
   bin: {
     "dbx-components-mcp": "dbx-components-mcp.js"
@@ -21,8 +21,8 @@ var package_default = {
     "ts-morph": "^21.0.0"
   },
   peerDependencies: {
-    "@dereekb/dbx-cli": "13.43.0",
-    "@dereekb/util": "13.43.0"
+    "@dereekb/dbx-cli": "14.0.1",
+    "@dereekb/util": "14.0.1"
   }
 };
 
@@ -706,7 +706,7 @@ function tallyProp(input) {
 }
 function scoreAgainstEntry(input, entry) {
   const tally = { matched: [], extraEntry: [], missingInput: [], weightedIntersect: 0, weightedUnion: 0 };
-  const allProps = /* @__PURE__ */ new Set([...input.keys(), ...entry.keys()]);
+  const allProps = /* @__PURE__ */ new Set([...Array.from(input.keys()), ...Array.from(entry.keys())]);
   for (const prop of allProps) {
     tallyProp({ tally, prop, inputValue: input.get(prop), entryValue: entry.get(prop) });
   }
@@ -2139,7 +2139,15 @@ var FIREBASE_MODELS = [
         converter: "optionalFirestoreDate()",
         tsType: "Maybe<Date>",
         optional: true,
-        description: "The date the space was submitted, if it was. Its presence IS the lock."
+        description: "The date the CURRENT submission was made, if the space is submitted. Its presence IS the lock."
+      },
+      {
+        name: "fsat",
+        longName: "firstSubmittedAt",
+        converter: "optionalFirestoreDate()",
+        tsType: "Maybe<Date>",
+        optional: true,
+        description: "The date the space was FIRST submitted, if it ever was."
       },
       {
         name: "cpat",
@@ -2156,6 +2164,46 @@ var FIREBASE_MODELS = [
         tsType: "Maybe<Date>",
         optional: true,
         description: "The date this space becomes eligible for the expiration sweep, if it expires at all."
+      },
+      {
+        name: "lat",
+        longName: "locksAt",
+        converter: "optionalFirestoreDate()",
+        tsType: "Maybe<Date>",
+        optional: true,
+        description: "The date reopening stops being possible \u2014 the instant the submission becomes FULLY LOCKED."
+      },
+      {
+        name: "lby",
+        longName: "lockedBy",
+        converter: "optionalFirestoreUID()",
+        tsType: "Maybe<FirebaseAuthUserId>",
+        optional: true,
+        description: "The user who locked the submission early, when a caller did rather than the deadline passing."
+      },
+      {
+        name: "rc",
+        longName: "reopenCount",
+        converter: "firestoreNumber({ default: 0 })",
+        tsType: "number",
+        optional: false,
+        description: "Monotonic count of times this space has been REOPENED after a submission."
+      },
+      {
+        name: "rat",
+        longName: "reopenedAt",
+        converter: "optionalFirestoreDate()",
+        tsType: "Maybe<Date>",
+        optional: true,
+        description: "The date the space was last reopened, if it ever was."
+      },
+      {
+        name: "rby",
+        longName: "reopenedBy",
+        converter: "optionalFirestoreUID()",
+        tsType: "Maybe<FirebaseAuthUserId>",
+        optional: true,
+        description: "The user who last reopened the space."
       }
     ],
     enums: [
@@ -2212,7 +2260,7 @@ var FIREBASE_MODELS = [
         description: "Processing state of a submitted {@link FormSpace}."
       }
     ],
-    detectionHints: ["t", "n", "ps", "m", "uc", "f", "pn", "pat", "uat", "sat", "cpat", "eat"],
+    detectionHints: ["t", "n", "ps", "m", "uc", "f", "pn", "pat", "uat", "sat", "fsat", "cpat", "eat", "lat", "lby", "rc", "rat", "rby"],
     description: "A type-registered container for a client-side form: its in-progress JSON, its uploads, and its submission state.",
     modelGroup: "FormSpace",
     collectionKind: "root",
@@ -10086,7 +10134,7 @@ function collectFromTypeReference(ref, context) {
     result = collectFromTypeNode(args[0], { ...context, forceOptional: false }).map((p) => ({ ...p, required: true }));
   } else if (refName === "Omit" && args.length === 2) {
     const keys = parseKeyUnion(args[1]);
-    const merged = /* @__PURE__ */ new Set([...context.omit, ...keys]);
+    const merged = /* @__PURE__ */ new Set([...Array.from(context.omit), ...Array.from(keys)]);
     result = collectFromTypeNode(args[0], { ...context, omit: merged });
   } else if (refName === "Pick" && args.length === 2) {
     const keys = parseKeyUnion(args[1]);
@@ -10121,6 +10169,7 @@ var PropertyAccumulator = class {
   constructor(context) {
     this.context = context;
   }
+  context;
   entries = [];
   index = /* @__PURE__ */ new Map();
   add(entry) {
@@ -11427,7 +11476,7 @@ function tryTransitiveResolution(input) {
     const calleeLine = resolved.decl.getStartLineNumber();
     warnings.push({ kind: "unannotated-query-helper", severity: "warning", name: factoryName, callee: calleeName, calleeFilePath, calleeLine, filePath, line: call.getStartLineNumber() });
   }
-  const nextVisited = /* @__PURE__ */ new Set([...visited, calleeKey]);
+  const nextVisited = new Set(visited).add(calleeKey);
   walkBodyInto({
     decl: resolved.decl,
     factoryName,
@@ -15407,13 +15456,21 @@ function formatBuildFailure(outcome) {
 }
 function formatWriteSummary(input) {
   const { outputPath, diff, generatedComposites, generatedFieldOverrides } = input;
-  const lines = [`generate-firestore-indexes: wrote ${outputPath}`, `  composites: ${generatedComposites} (added ${diff.added.length}, removed ${diff.removed.length}, unchanged ${diff.unchanged.length})`, `  fieldOverrides: ${generatedFieldOverrides} (added ${diff.fieldOverridesAdded.length}, removed ${diff.fieldOverridesRemoved.length}, unchanged ${diff.fieldOverridesUnchanged.length})`];
+  const lines = [
+    `generate-firestore-indexes: wrote ${outputPath}`,
+    `  composites: ${generatedComposites} (added ${diff.added.length}, removed ${diff.removed.length}, unchanged ${diff.unchanged.length})`,
+    `  fieldOverrides: ${generatedFieldOverrides} (added ${diff.fieldOverridesAdded.length}, removed ${diff.fieldOverridesRemoved.length}, unchanged ${diff.fieldOverridesUnchanged.length})`
+  ];
   return appendDiffSection(lines, diff).join("\n");
 }
 function formatCheckSummary(input) {
   const { drift, outputPath, diff, generatedComposites, generatedFieldOverrides } = input;
   const headline = drift ? `generate-firestore-indexes: drift detected against ${outputPath}` : `generate-firestore-indexes: in sync (${outputPath})`;
-  const lines = [headline, `  composites: ${generatedComposites} (added ${diff.added.length}, removed ${diff.removed.length}, unchanged ${diff.unchanged.length})`, `  fieldOverrides: ${generatedFieldOverrides} (added ${diff.fieldOverridesAdded.length}, removed ${diff.fieldOverridesRemoved.length}, unchanged ${diff.fieldOverridesUnchanged.length})`];
+  const lines = [
+    headline,
+    `  composites: ${generatedComposites} (added ${diff.added.length}, removed ${diff.removed.length}, unchanged ${diff.unchanged.length})`,
+    `  fieldOverrides: ${generatedFieldOverrides} (added ${diff.fieldOverridesAdded.length}, removed ${diff.fieldOverridesRemoved.length}, unchanged ${diff.fieldOverridesUnchanged.length})`
+  ];
   return appendDiffSection(lines, diff).join("\n");
 }
 function appendDiffSection(lines, diff) {
@@ -19767,7 +19824,7 @@ function registerResources(server, options = {}) {
   if (options.authRegistry !== void 0) {
     registerAuthResource(server, { registry: options.authRegistry });
   }
-  registerFirestoreRulesResource(server, { ...options.cwd === void 0 ? {} : { cwd: options.cwd } });
+  registerFirestoreRulesResource(server, options.cwd === void 0 ? {} : { cwd: options.cwd });
 }
 
 // packages/dbx-components-mcp/src/tools/lookup-form.tool.ts
@@ -19860,7 +19917,19 @@ function formatBrief(field) {
   const tierBits = formatTierBits(field);
   const arrayOptional = field.arrayOutput === "optional" ? " (single or array)" : "";
   const array = field.arrayOutput === "yes" ? " (array)" : arrayOptional;
-  return [`## ${field.factoryName}`, "", `**slug:** \`${field.slug}\` \xB7 **tier:** \`${field.tier}\` \xB7 **produces:** \`${field.produces}\`${array}${tierBits}`, "", field.description, "", "```ts", field.minimalExample, "```", "", `\u2192 Call \`dbx_form_lookup topic="${field.slug}" depth="full"\` for the config table and full example.`].join("\n");
+  return [
+    `## ${field.factoryName}`,
+    "",
+    `**slug:** \`${field.slug}\` \xB7 **tier:** \`${field.tier}\` \xB7 **produces:** \`${field.produces}\`${array}${tierBits}`,
+    "",
+    field.description,
+    "",
+    "```ts",
+    field.minimalExample,
+    "```",
+    "",
+    `\u2192 Call \`dbx_form_lookup topic="${field.slug}" depth="full"\` for the config table and full example.`
+  ].join("\n");
 }
 function formatFull(field) {
   const header = formatHeader(field);
@@ -20362,7 +20431,19 @@ function formatSearchResults(input) {
     const field = hit.entry;
     const optionalArray = field.arrayOutput === "optional" ? " *(single or array)*" : "";
     const array = field.arrayOutput === "yes" ? " *(array)*" : optionalArray;
-    lines.push(`## \`${field.slug}\` \xB7 form \xB7 score ${hit.score}`, "", `- **factory:** \`${field.factoryName}\``, `- **tier:** \`${field.tier}\``, `- **produces:** \`${field.produces}\`${array}`, `- **matched:** \`${hit.matchedTokens.join(", ")}\``, "", field.description, "", `\u2192 \`dbx_form_lookup topic="${field.slug}"\` for full docs.`, "");
+    lines.push(
+      `## \`${field.slug}\` \xB7 form \xB7 score ${hit.score}`,
+      "",
+      `- **factory:** \`${field.factoryName}\``,
+      `- **tier:** \`${field.tier}\``,
+      `- **produces:** \`${field.produces}\`${array}`,
+      `- **matched:** \`${hit.matchedTokens.join(", ")}\``,
+      "",
+      field.description,
+      "",
+      `\u2192 \`dbx_form_lookup topic="${field.slug}"\` for full docs.`,
+      ""
+    );
   }
   return lines.join("\n").trimEnd();
 }
@@ -21414,7 +21495,19 @@ function formatSearchResults2(options) {
   } else {
     const lines = [`# Search: \`${query}\``, "", `Tokens: \`${tokenDisplay}\`${scopeLabel} \xB7 ${hits.length} result${hits.length === 1 ? "" : "s"}`, ""];
     for (const hit of hits) {
-      lines.push(`## \`${hit.entry.slug}\` \xB7 ${hit.entry.category} \xB7 score ${hit.score}`, "", `- **class:** \`${hit.entry.className}\``, `- **kind:** \`${hit.entry.kind}\``, `- **selector:** \`${hit.entry.selector}\``, `- **matched:** \`${hit.matchedTokens.join(", ")}\``, "", hit.entry.description, "", `\u2192 \`dbx_ui_lookup topic="${hit.entry.slug}"\` for full docs.`, "");
+      lines.push(
+        `## \`${hit.entry.slug}\` \xB7 ${hit.entry.category} \xB7 score ${hit.score}`,
+        "",
+        `- **class:** \`${hit.entry.className}\``,
+        `- **kind:** \`${hit.entry.kind}\``,
+        `- **selector:** \`${hit.entry.selector}\``,
+        `- **matched:** \`${hit.matchedTokens.join(", ")}\``,
+        "",
+        hit.entry.description,
+        "",
+        `\u2192 \`dbx_ui_lookup topic="${hit.entry.slug}"\` for full docs.`,
+        ""
+      );
     }
     appendRelatedExamples(lines, hits, examplesRegistry);
     result = lines.join("\n").trimEnd();
@@ -21510,7 +21603,6 @@ import { DbxActionConfirmConfig } from '@dereekb/dbx-web';
 
 @Component({
   selector: 'app-danger-zone',
-  standalone: true,
   imports: [DbxCardBoxComponent, DbxBarDirective, DbxButtonComponent, DbxActionDirective, DbxActionConfirmDirective],
   template: \`
     <dbx-card-box header="Danger zone" icon="warning">
@@ -21527,8 +21619,7 @@ import { DbxActionConfirmConfig } from '@dereekb/dbx-web';
         </dbx-button>
       </dbx-bar>
     </dbx-card-box>
-  \`,
-  changeDetection: ChangeDetectionStrategy.OnPush
+  \`
 })
 export class DangerZoneComponent {
   readonly deleteAccountAction = /* DbxActionContextStoreSourceInstance<...> */ null;
@@ -21579,7 +21670,6 @@ interface Item {
 
 @Component({
   selector: 'app-items-page',
-  standalone: true,
   imports: [DbxSectionPageComponent, DbxListComponent, DbxListEmptyContentComponent, DbxPagebarComponent, DbxButtonComponent, DbxActionDirective],
   template: \`
     <dbx-section-page header="Items" icon="list" scroll="body">
@@ -21594,8 +21684,7 @@ interface Item {
         </dbx-list-empty-content>
       </dbx-list>
     </dbx-section-page>
-  \`,
-  changeDetection: ChangeDetectionStrategy.OnPush
+  \`
 })
 export class ItemsPageComponent {
   readonly items$: Observable<ListLoadingState<Item>> = /* ... */ null!;
@@ -21641,7 +21730,6 @@ interface Item {
 
 @Component({
   selector: 'app-items-loaded',
-  standalone: true,
   imports: [CommonModule, DbxLoadingComponent, DbxListComponent, DbxListEmptyContentComponent, DbxIntroActionSectionComponent],
   template: \`
     <dbx-loading [state]="state$ | async" text="Loading items...">
@@ -21657,8 +21745,7 @@ interface Item {
         </dbx-list>
       </dbx-intro-action-section>
     </dbx-loading>
-  \`,
-  changeDetection: ChangeDetectionStrategy.OnPush
+  \`
 })
 export class ItemsLoadedComponent {
   readonly state$: Observable<ListLoadingState<Item>> = /* ... */ null!;
@@ -21707,7 +21794,6 @@ import { MatInputModule } from '@angular/material/input';
 
 @Component({
   selector: 'app-account-settings',
-  standalone: true,
   imports: [DbxSectionComponent, DbxBarDirective, DbxButtonComponent, DbxButtonSpacerDirective, DbxActionDirective, ReactiveFormsModule, MatFormFieldModule, MatInputModule],
   template: \`
     <dbx-section header="Account" icon="person" hint="Update your profile">
@@ -21724,8 +21810,7 @@ import { MatInputModule } from '@angular/material/input';
         <dbx-button text="Cancel" stroked (btnClick)="cancel()"></dbx-button>
       </dbx-bar>
     </dbx-section>
-  \`,
-  changeDetection: ChangeDetectionStrategy.OnPush
+  \`
 })
 export class AccountSettingsComponent {
   private readonly fb = inject(FormBuilder);
@@ -21762,7 +21847,6 @@ import { UIRouterModule } from '@uirouter/angular';
 
 @Component({
   selector: 'app-shell',
-  standalone: true,
   imports: [DbxSidenavPageComponent, DbxSidenavComponent, DbxContentPageDirective, UIRouterModule],
   template: \`
     <dbx-sidenav-page>
@@ -21771,8 +21855,7 @@ import { UIRouterModule } from '@uirouter/angular';
         <ui-view></ui-view>
       </div>
     </dbx-sidenav-page>
-  \`,
-  changeDetection: ChangeDetectionStrategy.OnPush
+  \`
 })
 export class AppShellComponent {
   readonly navAnchors: ClickableAnchor[] = [
@@ -21823,7 +21906,6 @@ interface Member {
 
 @Component({
   selector: 'app-members-page',
-  standalone: true,
   imports: [CommonModule, MatButtonModule, MatIconModule, DbxSectionPageComponent, DbxTwoColumnComponent, DbxTwoColumnRightComponent, DbxListComponent],
   template: \`
     <dbx-section-page header="Members" icon="group" scroll="body">
@@ -21835,8 +21917,7 @@ interface Member {
         </dbx-two-column-right>
       </dbx-two-column>
     </dbx-section-page>
-  \`,
-  changeDetection: ChangeDetectionStrategy.OnPush
+  \`
 })
 export class MembersPageComponent {
   readonly members$: Observable<ListLoadingState<Member>> = /* ... */ null!;
@@ -25365,6 +25446,96 @@ var RULE_CATALOG = [
     whenItApplies: "When a key on `<app>SystemStateStoredDataConverterMap` is neither a local `<NAME>_SYSTEM_STATE_TYPE` constant nor an imported identifier.",
     whenItDoesNotApply: "Keys imported from upstream packages \u2014 those are detected via `importedIdentifiers` and skipped.",
     canonicalFix: "Either declare the missing constant locally or import it from the upstream package that owns it."
+  },
+  {
+    code: "WORKSPACE_DEPLOY_ENVIRONMENT_FILE_MISSING",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "A configuration's file-replacement or esbuild-config path does not exist on disk",
+    whatItFlags: "A configuration's file-replacement or esbuild-config path does not exist on disk.",
+    whenItApplies: "When a `fileReplacements` `replace` / `with` path, or a configuration's `esbuildConfig` path, names a file that is absent from the working tree.",
+    whenItDoesNotApply: "Generated files produced by an earlier target in the same pipeline \u2014 declare them as that target's `outputs` so the dependency is explicit, or the reference is genuinely broken.",
+    canonicalFix: "Create the missing file or correct the path. An Angular build fails loudly on a missing replacement, but an esbuild `additionalProperties: true` schema accepts a bad path silently."
+  },
+  {
+    code: "WORKSPACE_DEPLOY_ENVIRONMENT_FILE_UNREFERENCED",
+    source: "dbx_workspace_validate",
+    severity: "warning",
+    title: "An `environment.<name>.ts` file exists but no build configuration references it",
+    whatItFlags: "An `environment.<name>.ts` file exists but no build configuration references it.",
+    whenItApplies: "When a file matching `environment.*.ts` sits in a project's `src/environments/` directory and appears in no configuration's `fileReplacements`, and no `esbuildConfig` file references it.",
+    whenItDoesNotApply: "The base `environment.ts` (always the replacement source, never a target), and environment files imported directly by application code rather than swapped in by the build.",
+    canonicalFix: "Add the configuration that consumes it, or delete the file. An unreachable environment file reads as a working deploy lane that does not exist \u2014 the file is edited, reviewed, and never compiled."
+  },
+  {
+    code: "WORKSPACE_DEPLOY_HOSTING_TARGET_MISSING",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "A deploy command targets a firebase hosting target that `firebase.json` does not declare",
+    whatItFlags: "A deploy command targets a firebase hosting target that `firebase.json` does not declare.",
+    whenItApplies: "When a deploy command runs `firebase deploy --only hosting:<target>` and `<target>` matches no `target` (or `site`) entry under `hosting` in `firebase.json`.",
+    whenItDoesNotApply: "Workspaces that resolve hosting targets through `.firebaserc` target aliases the scanner does not read \u2014 verify manually if this misfires.",
+    canonicalFix: "Add the hosting entry to `firebase.json`, or point the command at a declared target. `firebase deploy` fails on an unknown hosting target, so this breaks the lane outright."
+  },
+  {
+    code: "WORKSPACE_DEPLOY_LANE_ASYMMETRIC",
+    source: "dbx_workspace_validate",
+    severity: "warning",
+    title: "A deploy lane is wired on one side of the app/api pair but not the other",
+    whatItFlags: "A deploy lane is wired on one side of the app/api pair but not the other.",
+    whenItApplies: "When one project in the workspace declares `ci-deploy-<lane>` and a sibling project that declares at least one other `ci-deploy-*` lane does not declare this one.",
+    whenItDoesNotApply: "Projects deliberately deployed on their own cadence, and workspaces with a single deployable project. Suppress by giving the sibling the lane, or accept the warning.",
+    canonicalFix: "Add the missing `ci-deploy-<lane>` target to the sibling project. A lane present on the API but not the web app (or vice versa) deploys half an application and leaves the two halves on different builds."
+  },
+  {
+    code: "WORKSPACE_DEPLOY_LANE_NO_ENVIRONMENT_SELECTION",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "A deploy lane builds a configuration that selects no environment file",
+    whatItFlags: "A deploy lane builds a configuration that selects no environment file.",
+    whenItApplies: "When a `ci-deploy-<lane>` target builds a configuration that provides no environment-selection mechanism for its executor \u2014 no `fileReplacements` for an Angular `application` build, or no lane-specific `esbuildConfig` for an `@nx/esbuild:esbuild` build.",
+    whenItDoesNotApply: "Non-deploy configurations such as `development`, which are expected to compile the base `environment.ts`. Only configurations reachable from a `ci-deploy-*` target are checked.",
+    canonicalFix: "Add the `fileReplacements` entry (or the lane's `esbuildConfig`) to the configuration. Without it the lane deploys the unreplaced `environment.ts` \u2014 localhost URLs, dev credentials, and any developer-only function map \u2014 to a live project."
+  },
+  {
+    code: "WORKSPACE_TARGET_OUTPUT_ESCAPES_ROOT",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "A target's `outputs` entry resolves outside the workspace root",
+    whatItFlags: "A target's `outputs` entry resolves outside the workspace root.",
+    whenItApplies: 'When an `outputs` entry \u2014 after `{options.<name>}` substitution from the target\'s own options \u2014 resolves to a path above the workspace root. The common shape is `outputs: ["{options.reportsDirectory}"]` with a `../../`-relative option value.',
+    whenItDoesNotApply: "Entries anchored by `{workspaceRoot}` or `{projectRoot}`, and entries whose `{options.<name>}` token has no resolvable value (skipped rather than guessed).",
+    canonicalFix: 'Anchor the entry explicitly, e.g. `"{workspaceRoot}/coverage/{projectRoot}"`. Nx refuses to cache an output it cannot place inside the workspace and will report the task as flaky instead of failing loudly.'
+  },
+  {
+    code: "WORKSPACE_TARGET_REF_CONFIGURATION_MISSING",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "An `nx run <project>:<target>:<configuration>` reference names a configuration the target does not declare",
+    whatItFlags: "An `nx run <project>:<target>:<configuration>` reference names a configuration the target does not declare.",
+    whenItApplies: "Whenever a reference carries a configuration segment and the target's `configurations` map has no such key.",
+    whenItDoesNotApply: "Targets that declare no `configurations` at all \u2014 Nx tolerates a configuration argument there, so it is not reported.",
+    canonicalFix: "Rename the reference to a declared configuration (a `prod` / `production` mismatch is the usual cause), or add the configuration to the target. Nx does NOT error on an unknown configuration: `create-task-graph.js` silently substitutes `defaultConfiguration`, so a mismatch here ships whatever that default builds \u2014 and ships the base options with no configuration merged at all when no default is set."
+  },
+  {
+    code: "WORKSPACE_TARGET_REF_PROJECT_MISSING",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "An `nx run <project>:...` reference names a project that does not exist in the workspace",
+    whatItFlags: "An `nx run <project>:...` reference names a project that does not exist in the workspace.",
+    whenItApplies: "When a target reference in a `project.json` command, CI config, shell script, or npm script names a project with no matching entry in the workspace project graph.",
+    whenItDoesNotApply: "References built from shell variables or CI interpolation the scanner cannot resolve \u2014 those are skipped rather than reported.",
+    canonicalFix: "Create the project, or update the reference to the project's real name. A renamed or deleted project leaves these references behind and they only fail at deploy time."
+  },
+  {
+    code: "WORKSPACE_TARGET_REF_TARGET_MISSING",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "An `nx run <project>:<target>` reference names a target the project does not declare",
+    whatItFlags: "An `nx run <project>:<target>` reference names a target the project does not declare.",
+    whenItApplies: "When the referenced project exists but has no target by that name (after `nx.json` `targetDefaults` are accounted for).",
+    whenItDoesNotApply: "Targets contributed by an inferred-target plugin the scanner does not evaluate \u2014 declare the plugin's targets explicitly if this misfires.",
+    canonicalFix: "Add the target to the project, or point the reference at an existing one. This is the single most common way a CI lane silently stops doing anything."
   }
 ];
 
@@ -25426,7 +25597,31 @@ function attachRemediation(code17) {
 
 // packages/dbx-cli/validate/src/lib/_core/rule-catalog/format.ts
 function formatRuleAsMarkdown(entry) {
-  const lines = [`# \`${entry.code}\``, "", `**${entry.title}**`, "", `- **Severity:** \`${entry.severity}\``, `- **Source tool:** \`${entry.source}\``, "", "## What it flags", "", entry.whatItFlags, "", "## When it applies", "", entry.whenItApplies, "", "## When it does NOT apply", "", entry.whenItDoesNotApply, "", "## Canonical fix", "", entry.canonicalFix, ""];
+  const lines = [
+    `# \`${entry.code}\``,
+    "",
+    `**${entry.title}**`,
+    "",
+    `- **Severity:** \`${entry.severity}\``,
+    `- **Source tool:** \`${entry.source}\``,
+    "",
+    "## What it flags",
+    "",
+    entry.whatItFlags,
+    "",
+    "## When it applies",
+    "",
+    entry.whenItApplies,
+    "",
+    "## When it does NOT apply",
+    "",
+    entry.whenItDoesNotApply,
+    "",
+    "## Canonical fix",
+    "",
+    entry.canonicalFix,
+    ""
+  ];
   if (entry.canonicalFixTemplate) {
     lines.push("## Fix template", "", entry.canonicalFixTemplate, "");
   }
@@ -35767,7 +35962,15 @@ function appendGroupSection(lines, apiRel, group) {
 function appendFileTable(lines, group) {
   lines.push("", "| File | Kind | Subgroups | Canonical | Rename suggestion |", "|---|---|---|---|---|");
   for (const file of group.files) {
-    lines.push("| " + [code3(file.filename), KIND_LABEL[file.classification.kind], file.classification.subgroups.length === 0 ? "\u2014" : code3(file.classification.subgroups.join(".")), file.classification.isCanonical ? "\u2713" : "\u2717", file.classification.recommendedRename === void 0 ? "\u2014" : code3(file.classification.recommendedRename)].join(" | ") + " |");
+    lines.push(
+      "| " + [
+        code3(file.filename),
+        KIND_LABEL[file.classification.kind],
+        file.classification.subgroups.length === 0 ? "\u2014" : code3(file.classification.subgroups.join(".")),
+        file.classification.isCanonical ? "\u2713" : "\u2717",
+        file.classification.recommendedRename === void 0 ? "\u2014" : code3(file.classification.recommendedRename)
+      ].join(" | ") + " |"
+    );
   }
 }
 function appendWhereToAddSection(lines, apiRel, group) {
@@ -35783,7 +35986,17 @@ function appendRecommendation(lines, rec, group) {
   lines.push("", `- **${rec.label}** \u2192 \`${rec.canonicalPath}\` ${status}`, `  ${rec.summary}`);
 }
 function appendConventionLegend(lines) {
-  lines.push("", "## Naming convention", "", "- `<group>.crud.spec.ts` \u2014 non-scenario CRUD tests.", "- `<group>.crud.<sub>[.<sub>...].spec.ts` \u2014 focused CRUD sub-test.", "- `<group>.scenario.spec.ts` \u2014 generic multi-step scenario tests.", "- `<group>.scenario.<sub>[.<sub>...].spec.ts` \u2014 focused scenario sub-bucket.", "", "Drift forms are still parsed but flagged \u2014 see the `Rename suggestion` column.");
+  lines.push(
+    "",
+    "## Naming convention",
+    "",
+    "- `<group>.crud.spec.ts` \u2014 non-scenario CRUD tests.",
+    "- `<group>.crud.<sub>[.<sub>...].spec.ts` \u2014 focused CRUD sub-test.",
+    "- `<group>.scenario.spec.ts` \u2014 generic multi-step scenario tests.",
+    "- `<group>.scenario.<sub>[.<sub>...].spec.ts` \u2014 focused scenario sub-bucket.",
+    "",
+    "Drift forms are still parsed but flagged \u2014 see the `Rename suggestion` column."
+  );
 }
 function appendDriftSummary(lines, catalog) {
   const driftFiles = [];
@@ -35929,7 +36142,14 @@ function stringify(value) {
 
 // packages/dbx-cli/model-test/src/lib/fixture/format.markdown.ts
 function formatListAsMarkdown(extraction) {
-  const lines = [`# App fixtures \u2014 ${extraction.fixturePath}`, "", `Detected workspace prefix: \`${extraction.prefix ?? "(none)"}\``, `Identity imports: ${extraction.identityImports.length === 0 ? "_None._" : extraction.identityImports.map((s) => "`" + s + "`").join(", ")}`, "", `## Fixtures (${extraction.entries.length})`];
+  const lines = [
+    `# App fixtures \u2014 ${extraction.fixturePath}`,
+    "",
+    `Detected workspace prefix: \`${extraction.prefix ?? "(none)"}\``,
+    `Identity imports: ${extraction.identityImports.length === 0 ? "_None._" : extraction.identityImports.map((s) => "`" + s + "`").join(", ")}`,
+    "",
+    `## Fixtures (${extraction.entries.length})`
+  ];
   if (extraction.entries.length === 0) {
     lines.push("", "_No model fixtures found._");
   } else {
@@ -35986,7 +36206,15 @@ function nonModelDescription(entry) {
   return "Non-Firestore-model fixture.";
 }
 function appendLookupTriplet(lines, entry) {
-  lines.push("## Triplet", "", `- Fixture: \`${entry.fixtureClassName}\` (lines ${entry.fixtureLine}-${entry.fixtureEndLine})`, `- Instance: \`${entry.instanceClassName}\` (lines ${entry.instanceLine}-${entry.instanceEndLine})`, `- Params: \`${entry.paramsTypeName}\``, `- Factory: \`${entry.factoryName ?? "\u2014"}\``, `- Singleton: \`${entry.singletonName ?? "\u2014"}\``);
+  lines.push(
+    "## Triplet",
+    "",
+    `- Fixture: \`${entry.fixtureClassName}\` (lines ${entry.fixtureLine}-${entry.fixtureEndLine})`,
+    `- Instance: \`${entry.instanceClassName}\` (lines ${entry.instanceLine}-${entry.instanceEndLine})`,
+    `- Params: \`${entry.paramsTypeName}\``,
+    `- Factory: \`${entry.factoryName ?? "\u2014"}\``,
+    `- Singleton: \`${entry.singletonName ?? "\u2014"}\``
+  );
 }
 function appendLookupGenerics(lines, entry) {
   if (entry.fixtureExtendsGenerics.length > 0) {
@@ -36156,11 +36384,19 @@ function renderParamsBlock(input, paramsTypeName, todos) {
 }
 function renderInstanceBlock(input) {
   input.todos.push(`Add instance methods to \`${input.instanceClassName}\`.`);
-  return [`export class ${input.instanceClassName}<F extends FirebaseAdminFunctionTestContextInstance = FirebaseAdminFunctionTestContextInstance> extends ModelTestContextInstance<${input.model}, ${input.modelDocumentTypeName}, ${input.prefix}FunctionContextFixtureInstance<F>> {`, "  // TODO: implement instance-side methods (these own the real logic).", "}"].join("\n");
+  return [
+    `export class ${input.instanceClassName}<F extends FirebaseAdminFunctionTestContextInstance = FirebaseAdminFunctionTestContextInstance> extends ModelTestContextInstance<${input.model}, ${input.modelDocumentTypeName}, ${input.prefix}FunctionContextFixtureInstance<F>> {`,
+    "  // TODO: implement instance-side methods (these own the real logic).",
+    "}"
+  ].join("\n");
 }
 function renderFixtureBlock(input) {
   input.todos.push(`Add forwarder methods to \`${input.fixtureClassName}\` after defining instance methods.`);
-  return [`export class ${input.fixtureClassName}<F extends FirebaseAdminFunctionTestContextInstance = FirebaseAdminFunctionTestContextInstance> extends ModelTestContextFixture<${input.model}, ${input.modelDocumentTypeName}, ${input.prefix}FunctionContextFixtureInstance<F>, ${input.prefix}FunctionContextFixture<F>, ${input.instanceClassName}<F>> {`, "  // TODO: forward instance methods. Run `dbx_model_fixture_forward` after adding instance methods.", "}"].join("\n");
+  return [
+    `export class ${input.fixtureClassName}<F extends FirebaseAdminFunctionTestContextInstance = FirebaseAdminFunctionTestContextInstance> extends ModelTestContextFixture<${input.model}, ${input.modelDocumentTypeName}, ${input.prefix}FunctionContextFixtureInstance<F>, ${input.prefix}FunctionContextFixture<F>, ${input.instanceClassName}<F>> {`,
+    "  // TODO: forward instance methods. Run `dbx_model_fixture_forward` after adding instance methods.",
+    "}"
+  ].join("\n");
 }
 function renderFactoryBlock(input) {
   const generics = renderFactoryGenerics(input);
@@ -36180,7 +36416,15 @@ function renderFactoryBlock(input) {
   return lines.join("\n");
 }
 function renderFactoryGenerics(input) {
-  const baseGenerics = [input.model, input.modelDocumentTypeName, input.paramsTypeName, `${input.prefix}FunctionContextFixtureInstance<FirebaseAdminFunctionTestContextInstance>`, `${input.prefix}FunctionContextFixture<FirebaseAdminFunctionTestContextInstance>`, `${input.instanceClassName}<FirebaseAdminFunctionTestContextInstance>`, `${input.fixtureClassName}<FirebaseAdminFunctionTestContextInstance>`];
+  const baseGenerics = [
+    input.model,
+    input.modelDocumentTypeName,
+    input.paramsTypeName,
+    `${input.prefix}FunctionContextFixtureInstance<FirebaseAdminFunctionTestContextInstance>`,
+    `${input.prefix}FunctionContextFixture<FirebaseAdminFunctionTestContextInstance>`,
+    `${input.instanceClassName}<FirebaseAdminFunctionTestContextInstance>`,
+    `${input.fixtureClassName}<FirebaseAdminFunctionTestContextInstance>`
+  ];
   if (input.collectionGenericArg) {
     return [...baseGenerics, input.collectionGenericArg];
   }
@@ -36202,10 +36446,13 @@ function renderFactoryCallbacks(input) {
   } else {
     callbacks.push(`getCollection: (fi) => fi.${defaultCollectionsAccessor(input.prefix)}.${camelInitial(input.model)}Collection`);
   }
-  callbacks.push(`makeInstance: (delegate, ref, testInstance) => new ${input.instanceClassName}(delegate, ref, testInstance)`, `makeRef: async (collection, params, _p) => {
+  callbacks.push(
+    `makeInstance: (delegate, ref, testInstance) => new ${input.instanceClassName}(delegate, ref, testInstance)`,
+    `makeRef: async (collection, params, _p) => {
       // TODO: choose the correct ref strategy (auto id vs deterministic id).
       return collection.documentAccessor().newDocument().documentRef;
-    }`);
+    }`
+  );
   if (input.withInitDocument) {
     callbacks.push(`initDocument: async (instance, params) => {
       // TODO: seed the new document with sensible defaults from \`params\`.
@@ -37405,7 +37652,18 @@ function formatReportAsJson4(report) {
 // packages/dbx-cli/validate/src/lib/dbx-asset-list-app/format.markdown.ts
 function formatReportAsMarkdown4(report) {
   const basename12 = report.componentDir.split("/").pop() ?? report.componentDir;
-  const lines = [`# App assets \u2014 ${basename12}`, "", `Component: \`${report.componentDir}\``, `App: \`${report.apiDir}\``, "", `\`src/lib/assets.ts\`: ${formatBool(report.assetsFileExists)}`, `Barrel re-exports \`./assets\`: ${formatBool(report.barrelReExportsAssets)}`, `\`provideDbxAssetLoader()\` called in \`src/root.app.config.ts\`: ${formatBool(report.providerWiredInApp)}`, "", `## Assets (${report.assets.length})`];
+  const lines = [
+    `# App assets \u2014 ${basename12}`,
+    "",
+    `Component: \`${report.componentDir}\``,
+    `App: \`${report.apiDir}\``,
+    "",
+    `\`src/lib/assets.ts\`: ${formatBool(report.assetsFileExists)}`,
+    `Barrel re-exports \`./assets\`: ${formatBool(report.barrelReExportsAssets)}`,
+    `\`provideDbxAssetLoader()\` called in \`src/root.app.config.ts\`: ${formatBool(report.providerWiredInApp)}`,
+    "",
+    `## Assets (${report.assets.length})`
+  ];
   if (report.assets.length === 0) {
     lines.push("", "_None found._");
   } else {
@@ -37796,7 +38054,18 @@ function formatReportAsJson6(report) {
 function formatReportAsMarkdown6(report) {
   const basename12 = report.componentDir.split("/").pop() ?? report.componentDir;
   const uploadServiceFactoryText = report.uploadServiceFactoryName ? code7(report.uploadServiceFactoryName) : "_Not defined._";
-  const lines = [`# App storagefiles \u2014 ${basename12}`, "", `Component: \`${report.componentDir}\``, `API: \`${report.apiDir}\``, "", `Upload service factory: ${uploadServiceFactoryText}`, `Wired via \`StorageFileInitializeFromUploadService\` provider: ${formatBool3(report.uploadServiceWiredInApi)}`, `Processing handler call present: ${formatBool3(report.processingHandlerWiredInApi)}`, "", `## Purposes (${report.purposes.length})`];
+  const lines = [
+    `# App storagefiles \u2014 ${basename12}`,
+    "",
+    `Component: \`${report.componentDir}\``,
+    `API: \`${report.apiDir}\``,
+    "",
+    `Upload service factory: ${uploadServiceFactoryText}`,
+    `Wired via \`StorageFileInitializeFromUploadService\` provider: ${formatBool3(report.uploadServiceWiredInApi)}`,
+    `Processing handler call present: ${formatBool3(report.processingHandlerWiredInApi)}`,
+    "",
+    `## Purposes (${report.purposes.length})`
+  ];
   if (report.purposes.length === 0) {
     lines.push("", "_None found._");
   } else {
@@ -38745,11 +39014,12 @@ function matchKindForRadius(exact, raw) {
   if (exact.defaults.light === raw || exact.defaults.dark === raw) return "(exact-match design-system corner token).";
   return "(idiomatic full / pill radius \u2014 design system token).";
 }
-function findExactRoleToken(registry, raw, role) {
+function findExactRoleToken(params) {
+  const { registry, raw, role, isAllowed } = params;
   const candidates = registry.byRole.get(role) ?? [];
   let result;
   for (const entry of candidates) {
-    if (entry.defaults.light === raw || entry.defaults.dark === raw) {
+    if ((entry.defaults.light === raw || entry.defaults.dark === raw) && (isAllowed === void 0 || isAllowed(entry))) {
       result = entry;
       break;
     }
@@ -38894,7 +39164,7 @@ var hardcodedRadius = (input) => {
     const colonIndex = input.scss.indexOf(":", match.index);
     if (colonIndex !== -1 && isInsideScssVarDeclaration(input.scss, colonIndex)) continue;
     const raw = match[1];
-    let exact = findExactRoleToken(input.tokenRegistry, raw, "radius");
+    let exact = findExactRoleToken({ registry: input.tokenRegistry, raw, role: "radius" });
     if (exact === void 0 && FULL_RADIUS_SYNONYMS.has(raw)) {
       exact = input.tokenRegistry.findByCssVariable("--mat-sys-corner-full");
     }
@@ -38925,7 +39195,7 @@ var hardcodedShadow = (input) => {
     if (match.index === void 0) continue;
     const raw = match[1].trim();
     if (raw.startsWith("var(") || raw === "none") continue;
-    const exact = findExactRoleToken(input.tokenRegistry, raw, "elevation");
+    const exact = findExactRoleToken({ registry: input.tokenRegistry, raw, role: "elevation" });
     const fix = exact === void 0 ? 'Hardcoded `box-shadow:` declarations should map to one of the `--mat-sys-level0..5` elevation tokens, or wrap the surface in `<dbx-content-box [elevate]="true">` so the shadow comes from the design system.' : `Replace this hardcoded shadow with \`box-shadow: var(${exact.cssVariable})\` or use \`<dbx-content-box [elevate]="true">\` to apply the elevation through the wrapper component.`;
     matches.push({
       id: "hardcoded-shadow",
@@ -38970,12 +39240,13 @@ var hardcodedHintColor = (input) => {
   return matches;
 };
 var HARDCODED_PADDING_RE = /(?:padding|margin)\s*(?:-(?:top|right|bottom|left))?\s*:\s*(\d+(?:\.\d+)?px)(?!\s*\))/gi;
+var DBX_PADDING_SCALE_RE = /^--dbx-padding-\d+$/;
 var hardcodedPadding = (input) => {
   const matches = [];
   for (const match of input.scss.matchAll(HARDCODED_PADDING_RE)) {
     if (match.index === void 0) continue;
     const raw = match[1];
-    const exact = findExactRoleToken(input.tokenRegistry, raw, "spacing");
+    const exact = findExactRoleToken({ registry: input.tokenRegistry, raw, role: "spacing", isAllowed: (entry) => DBX_PADDING_SCALE_RE.test(entry.cssVariable) });
     if (exact !== void 0) {
       const utility = exact.utilityClasses?.[0];
       const fix = ["Replace `" + match[0].trim() + "` with `var(" + exact.cssVariable + ")`" + (utility === void 0 ? "" : ` (or use the \`${utility}\` utility class on the host element)`) + "."].join("\n");
@@ -41473,7 +41744,14 @@ function rootDocumentStoreBody(args) {
   if (args.functionsClass !== void 0) {
     packageImports.push(args.functionsClass);
   }
-  const lines = [`import { Injectable, inject } from '@angular/core';`, `import { ${joinUnique(dbxFirebaseImports)} } from '@dereekb/dbx-firebase';`, `import { ${joinUnique(packageImports)} } from '${args.firebasePackage}';`, "", `@Injectable()`, `export class ${storeClass} extends ${baseClass}<${args.modelName}, ${docType}> {`];
+  const lines = [
+    `import { Injectable, inject } from '@angular/core';`,
+    `import { ${joinUnique(dbxFirebaseImports)} } from '@dereekb/dbx-firebase';`,
+    `import { ${joinUnique(packageImports)} } from '${args.firebasePackage}';`,
+    "",
+    `@Injectable()`,
+    `export class ${storeClass} extends ${baseClass}<${args.modelName}, ${docType}> {`
+  ];
   if (args.functionsClass !== void 0) {
     lines.push(`  readonly ${functionsFieldName(args.functionsClass)} = inject(${args.functionsClass});`, "");
   }
@@ -41516,11 +41794,29 @@ function subDocumentStoreBody(args) {
   if (args.functionsClass !== void 0) {
     packageImports.push(args.functionsClass);
   }
-  const lines = [`import { Injectable, inject } from '@angular/core';`, `import { ${joinUnique(dbxFirebaseImports)} } from '@dereekb/dbx-firebase';`, `import { ${joinUnique(packageImports)} } from '${args.firebasePackage}';`, `import { ${parentStore} } from './${parentBaseFile}.document.store';`, "", `@Injectable()`, `export class ${storeClass} extends ${baseClass}<${args.modelName}, ${parent.name}, ${docType}, ${parent.documentType}> {`];
+  const lines = [
+    `import { Injectable, inject } from '@angular/core';`,
+    `import { ${joinUnique(dbxFirebaseImports)} } from '@dereekb/dbx-firebase';`,
+    `import { ${joinUnique(packageImports)} } from '${args.firebasePackage}';`,
+    `import { ${parentStore} } from './${parentBaseFile}.document.store';`,
+    "",
+    `@Injectable()`,
+    `export class ${storeClass} extends ${baseClass}<${args.modelName}, ${parent.name}, ${docType}, ${parent.documentType}> {`
+  ];
   if (args.functionsClass !== void 0) {
     lines.push(`  readonly ${functionsFieldName(args.functionsClass)} = inject(${args.functionsClass});`, "");
   }
-  lines.push(`  constructor() {`, `    const collections = inject(${collections});`, `    super({ collectionFactory: collections.${args.factoryAccessor}, firestoreCollectionLike: collections.${args.groupAccessor} });`, `    const parent = inject(${parentStore}, { optional: true });`, "", `    if (parent) {`, `      this.setParentStore(parent);`, `    }`, `  }`);
+  lines.push(
+    `  constructor() {`,
+    `    const collections = inject(${collections});`,
+    `    super({ collectionFactory: collections.${args.factoryAccessor}, firestoreCollectionLike: collections.${args.groupAccessor} });`,
+    `    const parent = inject(${parentStore}, { optional: true });`,
+    "",
+    `    if (parent) {`,
+    `      this.setParentStore(parent);`,
+    `    }`,
+    `  }`
+  );
   const crudLines = renderCrudLines(args, "this");
   if (crudLines.length > 0) {
     lines.push("", ...crudLines);
@@ -41565,7 +41861,14 @@ function systemStateAccessorBody(args) {
   if (args.functionsClass !== void 0) {
     packageImports.push(args.functionsClass);
   }
-  const lines = [`import { Injectable, inject } from '@angular/core';`, `import { ${joinUnique(dbxFirebaseImports)} } from '@dereekb/dbx-firebase';`, `import { ${joinUnique(packageImports)} } from '${args.firebasePackage}';`, "", `@Injectable()`, `export class ${accessorClass} extends AbstractSystemStateDocumentStoreAccessor<${dataType}> {`];
+  const lines = [
+    `import { Injectable, inject } from '@angular/core';`,
+    `import { ${joinUnique(dbxFirebaseImports)} } from '@dereekb/dbx-firebase';`,
+    `import { ${joinUnique(packageImports)} } from '${args.firebasePackage}';`,
+    "",
+    `@Injectable()`,
+    `export class ${accessorClass} extends AbstractSystemStateDocumentStoreAccessor<${dataType}> {`
+  ];
   if (args.functionsClass !== void 0) {
     lines.push(`  readonly ${functionsFieldName(args.functionsClass)} = inject(${args.functionsClass});`, "");
   }
@@ -42148,7 +42451,17 @@ var ForwardArgsType = type62({
 });
 var TOOL8 = {
   name: "dbx_model_fixture_forward",
-  description: ["Insert the missing Fixture forwarder methods for one model in `<apiDir>/src/test/fixture.ts`. Every public Instance method that lacks a Fixture method gains a thin wrapper:", "", "```ts", "async <name>(<paramText>): <returnType> {", "  return this.instance.<name>(<args>);", "}", "```", "", "Existing forwarders are left untouched (idempotent). Pass `methods` to limit the run to specific method names; omit to forward everything that's missing."].join("\n"),
+  description: [
+    "Insert the missing Fixture forwarder methods for one model in `<apiDir>/src/test/fixture.ts`. Every public Instance method that lacks a Fixture method gains a thin wrapper:",
+    "",
+    "```ts",
+    "async <name>(<paramText>): <returnType> {",
+    "  return this.instance.<name>(<args>);",
+    "}",
+    "```",
+    "",
+    "Existing forwarders are left untouched (idempotent). Pass `methods` to limit the run to specific method names; omit to forward everything that's missing."
+  ].join("\n"),
   inputSchema: {
     type: "object",
     properties: {
@@ -42627,7 +42940,11 @@ function bucketSummary(group, bucket) {
   }
   return "Multi-step scenarios using fixture chains (mirrors real workflows). Add focused buckets as `" + group + ".scenario.<sub>.spec.ts` (chain subgroups freely, e.g. `.scenario.requirement.worker.spec.ts`).";
 }
-var DRIFT_RULES = ["`<group>.<sub>.crud.spec.ts` \u2192 rename to `<group>.crud.<sub>.spec.ts` (`crud` belongs directly after the group name).", "`<group>.<sub>.scenario.spec.ts` \u2192 rename to `<group>.scenario.<sub>.spec.ts` (`scenario` belongs directly after the group name).", "`<group>.<rest>.spec.ts` with no `crud` / `scenario` segment \u2192 add one (default to `scenario` when in doubt)."];
+var DRIFT_RULES = [
+  "`<group>.<sub>.crud.spec.ts` \u2192 rename to `<group>.crud.<sub>.spec.ts` (`crud` belongs directly after the group name).",
+  "`<group>.<sub>.scenario.spec.ts` \u2192 rename to `<group>.scenario.<sub>.spec.ts` (`scenario` belongs directly after the group name).",
+  "`<group>.<rest>.spec.ts` with no `crud` / `scenario` segment \u2192 add one (default to `scenario` when in doubt)."
+];
 function formatMarkdown(report) {
   const lines = [];
   lines.push(`# Spec convention for \`${report.group}\``, "", `Tests live under \`${report.apiDir}/src/app/function/${report.group}/\`. Canonical name segments:`, "");
@@ -43407,7 +43724,14 @@ var ARCHETYPE_RECOMMEND_TOOL = {
 import { type as type70 } from "arktype";
 var DBX_MODEL_ARCHETYPE_LOOKUP_TOOL = {
   name: "dbx_model_archetype_lookup",
-  description: ["Look up an archetype in the model-archetype catalog. Accepts:", '  \u2022 a slug (`"root-entity"`, `"denormalised-aggregate"`, \u2026);', '  \u2022 the literal `"list"` for the full catalog grouped by family.', "", "Optional inputs:", '  \u2022 `axes`: optional axis filter (`{ "subPurpose": "private" }`) \u2014 when set, the description shifts to focus on the matched axis.'].join("\n"),
+  description: [
+    "Look up an archetype in the model-archetype catalog. Accepts:",
+    '  \u2022 a slug (`"root-entity"`, `"denormalised-aggregate"`, \u2026);',
+    '  \u2022 the literal `"list"` for the full catalog grouped by family.',
+    "",
+    "Optional inputs:",
+    '  \u2022 `axes`: optional axis filter (`{ "subPurpose": "private" }`) \u2014 when set, the description shifts to focus on the matched axis.'
+  ].join("\n"),
   inputSchema: {
     type: "object",
     properties: {
@@ -44800,7 +45124,18 @@ function formatStateInteraction(entry) {
   return result;
 }
 function formatDirectiveEntry(entry, depth) {
-  const lines = [`# ${entry.className}`, "", entry.description, "", bullet("selector", `\`${entry.selector}\``), bullet("module", `\`${entry.module}\``), bullet("slug", `\`${entry.slug}\``), bullet("produces context", entry.producesContext ? "yes (provides `ActionContextStore` via DI)" : "no"), bullet("consumes context", entry.consumesContext ? "yes (injects `DbxActionContextStoreSourceInstance`)" : "no"), ""];
+  const lines = [
+    `# ${entry.className}`,
+    "",
+    entry.description,
+    "",
+    bullet("selector", `\`${entry.selector}\``),
+    bullet("module", `\`${entry.module}\``),
+    bullet("slug", `\`${entry.slug}\``),
+    bullet("produces context", entry.producesContext ? "yes (provides `ActionContextStore` via DI)" : "no"),
+    bullet("consumes context", entry.consumesContext ? "yes (injects `DbxActionContextStoreSourceInstance`)" : "no"),
+    ""
+  ];
   if (depth === "full") {
     lines.push("## Inputs", "", entry.inputs.length > 0 ? formatInputsTable2(entry.inputs) : "_No inputs._", "");
     if (entry.outputs.length > 0) {
@@ -45205,8 +45540,7 @@ import { type Work } from '@dereekb/rxjs';
         dbxActionForm
         [dbxFormSource]="settings$"></my-settings-form>
     </div>
-  \`,
-  standalone: true
+  \`
 })
 export class SettingsAutosaveComponent {
   private readonly store = inject(SettingsDocumentStore);
@@ -45250,8 +45584,7 @@ import { type Work } from '@dereekb/rxjs';
         icon="delete"
         dbxActionButton></dbx-button>
     </ng-container>
-  \`,
-  standalone: true
+  \`
 })
 export class DeleteAccountButtonComponent {
   private readonly accountStore = inject(AccountDocumentStore);
@@ -45315,8 +45648,7 @@ import { type Work } from '@dereekb/rxjs';
         <dbx-button text="Archive" dbxActionButton></dbx-button>
       </ng-container>
     </div>
-  \`,
-  standalone: true
+  \`
 })
 export class ContentToolbarComponent {
   private readonly store = inject(ArticleDocumentStore);
@@ -45370,8 +45702,7 @@ import { type WorkUsingContext } from '@dereekb/rxjs';
       <dbx-button [raised]="true" text="Save" dbxActionButton></dbx-button>
       <dbx-error dbxActionError></dbx-error>
     </form>
-  \`,
-  standalone: true
+  \`
 })
 export class EditProfilePageComponent {
   private readonly profileStore = inject(ProfileDocumentStore);
@@ -45441,8 +45772,7 @@ type ConsentDecision = { readonly outcome: 'approved'; readonly value: ConsentFo
         }
       </div>
     }
-  \`,
-  standalone: true
+  \`
 })
 export class ConsentPageComponent {
   readonly defaults$ = this.store.defaults$;
@@ -45489,8 +45819,7 @@ import { DbxActionContextMachine } from '@dereekb/dbx-core';
     <div [dbxActionSource]="actionSource()">
       <child-component></child-component>
     </div>
-  \`,
-  standalone: true
+  \`
 })
 export class ParentComponent {
   readonly machine = new DbxActionContextMachine<MyValue, MyResult>();
@@ -45510,8 +45839,7 @@ export class ParentComponent {
     <ng-container dbxAction dbxActionValue="hello">
       <dbx-button [raised]="true" text="Submit" dbxActionButton></dbx-button>
     </ng-container>
-  \`,
-  standalone: true
+  \`
 })
 export class ChildComponent {}`
   },
@@ -45554,8 +45882,7 @@ import { type IsEqualFunction } from '@dereekb/rxjs';
       <my-tag-form #form></my-tag-form>
       <dbx-button text="Save" dbxActionButton></dbx-button>
     </div>
-  \`,
-  standalone: true
+  \`
 })
 export class TagEditorComponent {
   private readonly store = inject(TagCollectionStore);
@@ -45571,7 +45898,15 @@ export class TagEditorComponent {
 };
 
 // packages/dbx-components-mcp/src/tools/data/patterns/action-patterns.ts
-var ACTION_EXAMPLE_PATTERNS = [ACTION_PATTERN_BUTTON_CONFIRM_DELETE, ACTION_PATTERN_FORM_SUBMIT, ACTION_PATTERN_FORM_WITH_SECONDARY, ACTION_PATTERN_AUTO_TRIGGER_ON_MODIFY, ACTION_PATTERN_DISABLED_BY_KEY, ACTION_PATTERN_VALUE_GETTER_ON_TRIGGER, ACTION_PATTERN_PROVIDE_CONTEXT_UP];
+var ACTION_EXAMPLE_PATTERNS = [
+  ACTION_PATTERN_BUTTON_CONFIRM_DELETE,
+  ACTION_PATTERN_FORM_SUBMIT,
+  ACTION_PATTERN_FORM_WITH_SECONDARY,
+  ACTION_PATTERN_AUTO_TRIGGER_ON_MODIFY,
+  ACTION_PATTERN_DISABLED_BY_KEY,
+  ACTION_PATTERN_VALUE_GETTER_ON_TRIGGER,
+  ACTION_PATTERN_PROVIDE_CONTEXT_UP
+];
 function getActionExamplePattern(slug) {
   const lowered = slug.trim().toLowerCase();
   return ACTION_EXAMPLE_PATTERNS.find((p) => p.slug === lowered);
@@ -45895,7 +46230,27 @@ function renderScaffold3(args) {
   const directivesUsed = buildDirectivesUsed(args);
   const examplePattern = relatedExamplePattern(args);
   const lines = [];
-  lines.push(`# Action scaffold \u2014 ${args.useCase}`, "", `Trigger: \`${args.trigger}\` \xB7 Confirm: \`${args.confirm}\` \xB7 Success feedback: \`${args.successFeedback}\` \xB7 Context: \`${args.contextProvider}\``, "", "## Template", "", "```html", template, "```", "", "## Component class", "", "```ts", handler, "```", "", "## Imports", "", "```ts");
+  lines.push(
+    `# Action scaffold \u2014 ${args.useCase}`,
+    "",
+    `Trigger: \`${args.trigger}\` \xB7 Confirm: \`${args.confirm}\` \xB7 Success feedback: \`${args.successFeedback}\` \xB7 Context: \`${args.contextProvider}\``,
+    "",
+    "## Template",
+    "",
+    "```html",
+    template,
+    "```",
+    "",
+    "## Component class",
+    "",
+    "```ts",
+    handler,
+    "```",
+    "",
+    "## Imports",
+    "",
+    "```ts"
+  );
   for (const line of imports) {
     lines.push(line);
   }
@@ -46339,7 +46694,13 @@ function formatMissingRouteModelLine(param) {
 // packages/dbx-components-mcp/src/tools/route-lookup.tool.ts
 var DBX_ROUTE_LOOKUP_TOOL = {
   name: "dbx_route_lookup",
-  description: ["Look up a single UIRouter state by name, full URL, or component class name. Returns the state's URL, component, parent chain, params, resolves, siblings, and children.", "", "Provide at least one of `sources` / `paths` / `glob` to point the tool at the source set, plus a `topic`.", "", "Resolution order: exact state name \u2192 URL path \u2192 component class name \u2192 fuzzy substring (returns up to 5 candidates)."].join("\n"),
+  description: [
+    "Look up a single UIRouter state by name, full URL, or component class name. Returns the state's URL, component, parent chain, params, resolves, siblings, and children.",
+    "",
+    "Provide at least one of `sources` / `paths` / `glob` to point the tool at the source set, plus a `topic`.",
+    "",
+    "Resolution order: exact state name \u2192 URL path \u2192 component class name \u2192 fuzzy substring (returns up to 5 candidates)."
+  ].join("\n"),
   inputSchema: {
     type: "object",
     properties: {
@@ -46599,7 +46960,11 @@ var ROUTE_LOOKUP_TOOL = {
 import { type as type82 } from "arktype";
 var DBX_ROUTE_SEARCH_TOOL = {
   name: "dbx_route_search",
-  description: ["Search the UIRouter state tree of a dbx-components app. Matches against state names, full URLs, component class names, resolve keys, and source-file paths. Returns the top 10 results with state name, URL, component, and source location.", "", "Provide at least one of `sources` / `paths` / `glob` plus a `query`. `scope` narrows to a single axis (`name`, `url`, `component`, `resolve`)."].join("\n"),
+  description: [
+    "Search the UIRouter state tree of a dbx-components app. Matches against state names, full URLs, component class names, resolve keys, and source-file paths. Returns the top 10 results with state name, URL, component, and source location.",
+    "",
+    "Provide at least one of `sources` / `paths` / `glob` plus a `query`. `scope` narrows to a single axis (`name`, `url`, `component`, `resolve`)."
+  ].join("\n"),
   inputSchema: {
     type: "object",
     properties: {
@@ -47691,7 +48056,25 @@ function formatScaffold2(args) {
   if (args.presetKeys.length > 0) {
     lines.push("## Presets", "", "```ts", renderPresetConstants(args), "```", "");
   }
-  lines.push("## Template", "", "```html", renderTemplate(args), "```", "", "## Component class", "", "```ts", ...renderImports(args), "", renderClass(args), "```", "", "## Notes", "", "- The outer `[dbxFilterSourceConnector]` provides both `FilterSource` and `FilterSourceConnector`. Children that own the form use `[dbxFilterSource]` + `[dbxFilterConnectSource]` to wire up.");
+  lines.push(
+    "## Template",
+    "",
+    "```html",
+    renderTemplate(args),
+    "```",
+    "",
+    "## Component class",
+    "",
+    "```ts",
+    ...renderImports(args),
+    "",
+    renderClass(args),
+    "```",
+    "",
+    "## Notes",
+    "",
+    "- The outer `[dbxFilterSourceConnector]` provides both `FilterSource` and `FilterSourceConnector`. Children that own the form use `[dbxFilterSource]` + `[dbxFilterConnectSource]` to wire up."
+  );
   if (args.presetKeys.length > 0) {
     lines.push("- Each `ClickableFilterPreset` listed in the preset array becomes a chip; clicking sets `presetValue` on the filter source.");
   }
@@ -47758,7 +48141,20 @@ function formatArgsTable(args) {
   return lines.join("\n");
 }
 function formatEntry4(entry, depth) {
-  const lines = [`# ${entry.className}`, "", entry.description, "", bullet3("slug", `\`${entry.slug}\``), bullet3("pipe", `\`${entry.pipeName}\``), bullet3("category", `\`${entry.category}\``), bullet3("purity", `\`${entry.purity}\``), bullet3("input", `\`${entry.inputType}\``), bullet3("output", `\`${entry.outputType}\``), bullet3("module", `\`${entry.module}\``), ""];
+  const lines = [
+    `# ${entry.className}`,
+    "",
+    entry.description,
+    "",
+    bullet3("slug", `\`${entry.slug}\``),
+    bullet3("pipe", `\`${entry.pipeName}\``),
+    bullet3("category", `\`${entry.category}\``),
+    bullet3("purity", `\`${entry.purity}\``),
+    bullet3("input", `\`${entry.inputType}\``),
+    bullet3("output", `\`${entry.outputType}\``),
+    bullet3("module", `\`${entry.module}\``),
+    ""
+  ];
   if (depth === "full") {
     if (entry.args.length > 0) {
       lines.push("## Args", "", formatArgsTable(entry.args), "");
@@ -47920,7 +48316,20 @@ function formatSearchResults5(input) {
   const lines = [`# Search: \`${query}\``, "", `Tokens: \`${tokenDisplay}\` \xB7 ${hits.length} result${hits.length === 1 ? "" : "s"}`, ""];
   for (const hit of hits) {
     const entry = hit.entry;
-    lines.push(`## \`${entry.slug}\` \xB7 ${entry.category} \xB7 score ${hit.score}`, "", `- **pipe:** \`${entry.pipeName}\``, `- **class:** \`${entry.className}\``, `- **input:** \`${entry.inputType}\``, `- **output:** \`${entry.outputType}\``, `- **matched:** \`${hit.matchedTokens.join(", ")}\``, "", entry.description, "", `\u2192 \`dbx_pipe_lookup topic="${entry.slug}"\` for full docs.`, "");
+    lines.push(
+      `## \`${entry.slug}\` \xB7 ${entry.category} \xB7 score ${hit.score}`,
+      "",
+      `- **pipe:** \`${entry.pipeName}\``,
+      `- **class:** \`${entry.className}\``,
+      `- **input:** \`${entry.inputType}\``,
+      `- **output:** \`${entry.outputType}\``,
+      `- **matched:** \`${hit.matchedTokens.join(", ")}\``,
+      "",
+      entry.description,
+      "",
+      `\u2192 \`dbx_pipe_lookup topic="${entry.slug}"\` for full docs.`,
+      ""
+    );
   }
   return lines.join("\n").trimEnd();
 }
@@ -48196,7 +48605,20 @@ function formatCatalogHit(input) {
   const tagDisplay = entry.tags.length > 0 ? `
 - **tags:** ${tagBadges}` : "";
   const badge = options.headerBadge ?? "";
-  return [`## \`${entry.slug}\` \xB7 \`${entry.name}\` \xB7 ${entry.kind}${badge} \xB7 score ${hit.score}`, "", `- **module:** \`${entry.module}\``, `- **category:** \`${entry.category}\``, `- **subpath:** \`${entry.subpath}\``, `- **signature:** \`${entry.signature}\``, `- **matched:** \`${hit.matchedTokens.join(", ")}\`${tagDisplay}`, "", entry.description.split("\n")[0], "", `\u2192 \`${options.lookupTool} topic="${entry.slug}"\` for full docs.`, ""];
+  return [
+    `## \`${entry.slug}\` \xB7 \`${entry.name}\` \xB7 ${entry.kind}${badge} \xB7 score ${hit.score}`,
+    "",
+    `- **module:** \`${entry.module}\``,
+    `- **category:** \`${entry.category}\``,
+    `- **subpath:** \`${entry.subpath}\``,
+    `- **signature:** \`${entry.signature}\``,
+    `- **matched:** \`${hit.matchedTokens.join(", ")}\`${tagDisplay}`,
+    "",
+    entry.description.split("\n")[0],
+    "",
+    `\u2192 \`${options.lookupTool} topic="${entry.slug}"\` for full docs.`,
+    ""
+  ];
 }
 function formatCatalogSearchResults(input) {
   const { query, tokens, hits, filters, entityLabel, emptyHint, hitOptions } = input;
@@ -48372,7 +48794,20 @@ function appendFullEntrySections2(lines, entry) {
 }
 function formatEntry6(entry, depth) {
   const heading = `# ${entry.name}`;
-  const lines = [heading, "", entry.description, "", bullet5("slug", `\`${entry.slug}\``), bullet5("kind", `\`${entry.kind}\``), bullet5("category", `\`${entry.category}\``), bullet5("module", `\`${entry.module}\``), bullet5("subpath", `\`${entry.subpath}\``), bullet5("optional", entry.optional ? "yes (use this for `Maybe<T>` fields)" : "no (required)"), bullet5("signature", `\`${entry.signature}\``), ""];
+  const lines = [
+    heading,
+    "",
+    entry.description,
+    "",
+    bullet5("slug", `\`${entry.slug}\``),
+    bullet5("kind", `\`${entry.kind}\``),
+    bullet5("category", `\`${entry.category}\``),
+    bullet5("module", `\`${entry.module}\``),
+    bullet5("subpath", `\`${entry.subpath}\``),
+    bullet5("optional", entry.optional ? "yes (use this for `Maybe<T>` fields)" : "no (required)"),
+    bullet5("signature", `\`${entry.signature}\``),
+    ""
+  ];
   appendDeprecationNotice2(lines, entry);
   if (depth === "full") {
     appendFullEntrySections2(lines, entry);
@@ -49702,7 +50137,14 @@ function appendTaggedSections(lines, tagged) {
 }
 function appendUntaggedSection(lines, untagged) {
   if (untagged.length === 0) return;
-  lines.push("## Untagged candidates", "", "Exported functions returning `FirestoreQueryConstraint[]` without an `@dbxModelFirebaseIndex` block. Tag them so the validator can verify their indexes \u2014 or annotate with `@dbxModelFirebaseIndexSkip` to record that they were considered.", "", "| Function | File |", "| --- | --- |");
+  lines.push(
+    "## Untagged candidates",
+    "",
+    "Exported functions returning `FirestoreQueryConstraint[]` without an `@dbxModelFirebaseIndex` block. Tag them so the validator can verify their indexes \u2014 or annotate with `@dbxModelFirebaseIndexSkip` to record that they were considered.",
+    "",
+    "| Function | File |",
+    "| --- | --- |"
+  );
   for (const candidate of untagged) {
     lines.push(`| \`${candidate.name}\` | \`${candidate.subpath}:${candidate.line}\` |`);
   }
@@ -50402,7 +50844,14 @@ function formatReportAsMarkdown17(report) {
   } else {
     lines.push("## \u2705 In sync", "");
   }
-  lines.push(`- generated composites: ${report.generatedComposites}`, `- existing composites: ${report.existingComposites}`, `- generated fieldOverrides: ${report.generatedFieldOverrides}`, `- existing fieldOverrides: ${report.existingFieldOverrides}`, `- ${report.errorCount} error(s), ${report.warningCount} warning(s)`, "");
+  lines.push(
+    `- generated composites: ${report.generatedComposites}`,
+    `- existing composites: ${report.existingComposites}`,
+    `- generated fieldOverrides: ${report.generatedFieldOverrides}`,
+    `- existing fieldOverrides: ${report.existingFieldOverrides}`,
+    `- ${report.errorCount} error(s), ${report.warningCount} warning(s)`,
+    ""
+  );
   if (report.violations.length > 0) {
     appendViolationSection(
       lines,
@@ -50820,7 +51269,10 @@ function renderStorageFilePurpose(input, ctx) {
     tokens: ctx.tokens,
     files: [componentFile, handlerFile],
     wiring,
-    summary: applyTokens(`Scaffolds a new \`<<SCREAMING>>_PURPOSE\` storage-file purpose end-to-end: component-side constants + path helpers (append to \`storagefile.ts\`) and an API-side upload-initializer factory in \`handlers/\`. After applying, run \`dbx_validate_app_storagefiles\` and \`dbx_validate_storagefile_folder\` against your project \u2014 both should PASS.`, ctx)
+    summary: applyTokens(
+      `Scaffolds a new \`<<SCREAMING>>_PURPOSE\` storage-file purpose end-to-end: component-side constants + path helpers (append to \`storagefile.ts\`) and an API-side upload-initializer factory in \`handlers/\`. After applying, run \`dbx_validate_app_storagefiles\` and \`dbx_validate_storagefile_folder\` against your project \u2014 both should PASS.`,
+      ctx
+    )
   };
   return result;
 }
@@ -50828,19 +51280,28 @@ function renderNotificationTemplate(input, ctx) {
   const componentFile = {
     status: "append",
     path: applyTokens("<<componentDir>>/src/lib/model/notification/notification.ts", ctx),
-    description: applyTokens(`Append the \`<<Pascal>>\` notification block to \`notification.ts\`: type constant + info + data interface + template factory. Reuses the file's existing imports \u2014 no new top-level imports required as long as \`NotificationTemplateType\`, \`NotificationTemplateTypeInfo\`, \`CreateNotificationTemplate\`, \`createNotificationTemplate\`, \`FirebaseAuthUserId\`, \`profileIdentity\`, and \`ProfileDocument\` are already in scope.`, ctx),
+    description: applyTokens(
+      `Append the \`<<Pascal>>\` notification block to \`notification.ts\`: type constant + info + data interface + template factory. Reuses the file's existing imports \u2014 no new top-level imports required as long as \`NotificationTemplateType\`, \`NotificationTemplateTypeInfo\`, \`CreateNotificationTemplate\`, \`createNotificationTemplate\`, \`FirebaseAuthUserId\`, \`profileIdentity\`, and \`ProfileDocument\` are already in scope.`,
+      ctx
+    ),
     content: applyTokens(NOTIFICATION_TEMPLATE_COMPONENT_TEMPLATE, ctx)
   };
   const factoryFile = {
     status: "append",
     path: applyTokens("<<apiDir>>/src/app/common/model/notification/notification.factory.ts", ctx),
-    description: applyTokens(`Append the \`<<appCamel>><<Pascal>>NotificationFactory\` to \`notification.factory.ts\`. Reuses the file's existing imports for \`NotificationMessageFunctionFactoryConfig\`, \`NotificationMessageInputContext\`, \`NotificationMessageContent\`, \`NotificationMessage\`, \`notificationMessageFunction\`, and \`NotificationTemplateServiceTypeConfig\`.`, ctx),
+    description: applyTokens(
+      `Append the \`<<appCamel>><<Pascal>>NotificationFactory\` to \`notification.factory.ts\`. Reuses the file's existing imports for \`NotificationMessageFunctionFactoryConfig\`, \`NotificationMessageInputContext\`, \`NotificationMessageContent\`, \`NotificationMessage\`, \`notificationMessageFunction\`, and \`NotificationTemplateServiceTypeConfig\`.`,
+      ctx
+    ),
     content: applyTokens(NOTIFICATION_TEMPLATE_FACTORY_TEMPLATE, ctx)
   };
   const wiring = [
     {
       file: applyTokens("<<apiDir>>/src/app/common/model/notification/notification.factory.ts", ctx),
-      description: applyTokens(`Two registrations are required: (1) add a call to \`<<appCamel>><<Pascal>>NotificationFactory(context)\` in the existing configs-array factory return list (so the handler is reachable through the template service); (2) add \`<<SCREAMING>>_NOTIFICATION_TEMPLATE_TYPE_INFO\` to the \`*_NOTIFICATION_TEMPLATE_TYPE_INFO_RECORD\` aggregator in \`notification.ts\` so the metadata path is wired.`, ctx),
+      description: applyTokens(
+        `Two registrations are required: (1) add a call to \`<<appCamel>><<Pascal>>NotificationFactory(context)\` in the existing configs-array factory return list (so the handler is reachable through the template service); (2) add \`<<SCREAMING>>_NOTIFICATION_TEMPLATE_TYPE_INFO\` to the \`*_NOTIFICATION_TEMPLATE_TYPE_INFO_RECORD\` aggregator in \`notification.ts\` so the metadata path is wired.`,
+        ctx
+      ),
       snippet: applyTokens(NOTIFICATION_TEMPLATE_WIRING_SNIPPET, ctx)
     }
   ];
@@ -50849,7 +51310,10 @@ function renderNotificationTemplate(input, ctx) {
     tokens: ctx.tokens,
     files: [componentFile, factoryFile],
     wiring,
-    summary: applyTokens(`Scaffolds a new \`<<SCREAMING>>_NOTIFICATION_TEMPLATE_TYPE\` end-to-end: component-side type + info + data + template factory (append to \`notification.ts\`) and an API-side template-service factory (append to \`notification.factory.ts\`). After applying the wiring, run \`dbx_notification_m_validate_app\` and \`dbx_notification_m_validate_folder\` against your project \u2014 both should PASS.`, ctx)
+    summary: applyTokens(
+      `Scaffolds a new \`<<SCREAMING>>_NOTIFICATION_TEMPLATE_TYPE\` end-to-end: component-side type + info + data + template factory (append to \`notification.ts\`) and an API-side template-service factory (append to \`notification.factory.ts\`). After applying the wiring, run \`dbx_notification_m_validate_app\` and \`dbx_notification_m_validate_folder\` against your project \u2014 both should PASS.`,
+      ctx
+    )
   };
   return result;
 }
@@ -50874,7 +51338,10 @@ function renderNotificationTask(input, ctx) {
   const wiring = [
     {
       file: applyTokens("<<apiDir>>/src/app/common/model/notification/notification.task.service.ts", ctx),
-      description: applyTokens(`Import the new factory, instantiate it bound to \`<<camel>>Handler\`, push that name into the existing \`handlers\` array, and add \`<<SCREAMING>>_NOTIFICATION_TASK_TYPE\` to the \`ALL_NOTIFICATION_TASK_TYPES\` aggregate in the component package's \`notification.task.ts\` so the validate-vs-handler parity check stays consistent.`, ctx),
+      description: applyTokens(
+        `Import the new factory, instantiate it bound to \`<<camel>>Handler\`, push that name into the existing \`handlers\` array, and add \`<<SCREAMING>>_NOTIFICATION_TASK_TYPE\` to the \`ALL_NOTIFICATION_TASK_TYPES\` aggregate in the component package's \`notification.task.ts\` so the validate-vs-handler parity check stays consistent.`,
+        ctx
+      ),
       snippet: applyTokens(NOTIFICATION_TASK_WIRING_SNIPPET, ctx)
     }
   ];
@@ -50883,7 +51350,10 @@ function renderNotificationTask(input, ctx) {
     tokens: ctx.tokens,
     files: [componentFile, handlerFile],
     wiring,
-    summary: applyTokens(`Scaffolds a new \`<<SCREAMING>>_NOTIFICATION_TASK_TYPE\` end-to-end: component-side type + checkpoint alias + data + template factory (append to \`notification.task.ts\`) and an API-side handler factory in \`handlers/\`. After applying the wiring (handlers array + ALL_NOTIFICATION_TASK_TYPES), run \`dbx_notification_m_validate_app\` and \`dbx_notification_m_validate_folder\` against your project \u2014 both should PASS.`, ctx)
+    summary: applyTokens(
+      `Scaffolds a new \`<<SCREAMING>>_NOTIFICATION_TASK_TYPE\` end-to-end: component-side type + checkpoint alias + data + template factory (append to \`notification.task.ts\`) and an API-side handler factory in \`handlers/\`. After applying the wiring (handlers array + ALL_NOTIFICATION_TASK_TYPES), run \`dbx_notification_m_validate_app\` and \`dbx_notification_m_validate_folder\` against your project \u2014 both should PASS.`,
+      ctx
+    )
   };
   return result;
 }
@@ -51148,7 +51618,11 @@ var STORAGEFILE_PURPOSE = {
       heading: "API upload handler",
       path: "<apiDir>/src/app/common/model/storagefile/handlers/upload.<name>.ts",
       altPaths: ["Inline in `<apiDir>/src/app/common/model/storagefile/storagefile.upload.service.ts` for tiny workspaces."],
-      body: ["**Required export:** `<camelName>StorageFileUploadInitializers(context): StorageFileInitializeFromUploadServiceInitializer[]`.", "", "**Wire into:** `<apiDir>/src/app/common/model/storagefile/storagefile.upload.service.ts` \u2014 spread into the `initializer: [...]` array passed to `storageFileInitializeFromUploadService({ initializer })`."].join("\n")
+      body: [
+        "**Required export:** `<camelName>StorageFileUploadInitializers(context): StorageFileInitializeFromUploadServiceInitializer[]`.",
+        "",
+        "**Wire into:** `<apiDir>/src/app/common/model/storagefile/storagefile.upload.service.ts` \u2014 spread into the `initializer: [...]` array passed to `storageFileInitializeFromUploadService({ initializer })`."
+      ].join("\n")
     },
     {
       heading: "API processor (only if subtasks declared)",
@@ -51210,12 +51684,27 @@ var STORAGEFILE_PROCESSOR = {
     {
       heading: "API processor handler",
       path: "<apiDir>/src/app/common/model/notification/handlers/storagefile/task.handler.storagefile.<name>.ts",
-      body: ["**Required shape:**", "```ts", "export function <camelName>ProcessingNotificationTaskHandler(context): StorageFileProcessingPurposeSubtaskProcessorConfig<<Name>SubtaskMetadata, <Name>ProcessingSubtask> {", "  const config: StorageFileProcessingPurposeSubtaskProcessorConfig<...> = {", "    target: <NAME>_PURPOSE,", "    flow: [", "      { subtask: <NAME>_PURPOSE_<DESC>_SUBTASK, fn: async (input) => ... }", "    ]", "  };", "  return config;", "}", "```"].join("\n")
+      body: [
+        "**Required shape:**",
+        "```ts",
+        "export function <camelName>ProcessingNotificationTaskHandler(context): StorageFileProcessingPurposeSubtaskProcessorConfig<<Name>SubtaskMetadata, <Name>ProcessingSubtask> {",
+        "  const config: StorageFileProcessingPurposeSubtaskProcessorConfig<...> = {",
+        "    target: <NAME>_PURPOSE,",
+        "    flow: [",
+        "      { subtask: <NAME>_PURPOSE_<DESC>_SUBTASK, fn: async (input) => ... }",
+        "    ]",
+        "  };",
+        "  return config;",
+        "}",
+        "```"
+      ].join("\n")
     },
     {
       heading: "Wire into processing handler",
       path: "<apiDir>/src/app/common/model/notification/handlers/task.handler.storagefile.ts",
-      body: ["Push the new processor config into the `processors: [...]` array passed to `storageFileProcessingNotificationTaskHandler({ processors })`. The surrounding handler is itself wired into `notificationTaskService({ handlers })` \u2014 already covered by the notification-task plumbing, so no further wiring needed here."].join("\n")
+      body: [
+        "Push the new processor config into the `processors: [...]` array passed to `storageFileProcessingNotificationTaskHandler({ processors })`. The surrounding handler is itself wired into `notificationTaskService({ handlers })` \u2014 already covered by the notification-task plumbing, so no further wiring needed here."
+      ].join("\n")
     }
   ],
   seeAlso: ["storagefile-purpose", "storagefile-processor-subtask", "notification-task"],
@@ -51229,7 +51718,12 @@ var STORAGEFILE_PROCESSOR_SUBTASK = {
     {
       heading: "Component declarations",
       path: "<componentDir>/src/lib/model/storagefile/storagefile.<name>.ts (the file that already declares the purpose)",
-      body: ["**Add:**", "- `<NAME>_PURPOSE_<DESC>_SUBTASK: StorageFileProcessingSubtask = '<descriptor>'` \u2014 the new subtask constant.", "- Extend the `<Name>ProcessingSubtask` union alias: `typeof <NAME>_PURPOSE_<DESC>_SUBTASK | ...existing`.", "- Optional: extend `<Name>ProcessingSubtaskMetadata` with any new fields the new subtask needs."].join("\n")
+      body: [
+        "**Add:**",
+        "- `<NAME>_PURPOSE_<DESC>_SUBTASK: StorageFileProcessingSubtask = '<descriptor>'` \u2014 the new subtask constant.",
+        "- Extend the `<Name>ProcessingSubtask` union alias: `typeof <NAME>_PURPOSE_<DESC>_SUBTASK | ...existing`.",
+        "- Optional: extend `<Name>ProcessingSubtaskMetadata` with any new fields the new subtask needs."
+      ].join("\n")
     },
     {
       heading: "API processor flow",
@@ -51261,13 +51755,19 @@ var NOTIFICATION_TEMPLATE = {
     {
       heading: "Component aggregator",
       path: "<componentDir>/src/lib/model/notification/notification.ts",
-      body: ["Add the new info to the call to `notificationTemplateTypeInfoRecord([...])` \u2014 either as a direct entry (`<NAME>_NOTIFICATION_TEMPLATE_TYPE_INFO`) or via a spread of the module aggregate (`...ALL_<MODULE>_NOTIFICATION_TEMPLATE_TYPE_INFOS`). The result constant is typically `<APP>_FIREBASE_NOTIFICATION_TEMPLATE_TYPE_INFO_RECORD`."].join("\n")
+      body: [
+        "Add the new info to the call to `notificationTemplateTypeInfoRecord([...])` \u2014 either as a direct entry (`<NAME>_NOTIFICATION_TEMPLATE_TYPE_INFO`) or via a spread of the module aggregate (`...ALL_<MODULE>_NOTIFICATION_TEMPLATE_TYPE_INFOS`). The result constant is typically `<APP>_FIREBASE_NOTIFICATION_TEMPLATE_TYPE_INFO_RECORD`."
+      ].join("\n")
     },
     {
       heading: "API handler factory",
       path: "<apiDir>/src/app/common/model/notification/notification.factory.ts",
       altPaths: ["<apiDir>/src/app/common/model/notification/notification.factory.<name>.ts (split per-template for larger workspaces)"],
-      body: ["**Required export:** A factory function returning a `NotificationTemplateServiceTypeConfig` with `{ type: <NAME>_NOTIFICATION_TEMPLATE_TYPE, factory: async (...) => ... }`.", "", "**Wire into:** the top-level `<app>NotificationTemplateServiceConfigsArrayFactory(context)` \u2014 call the new factory inside its returned array. The configs-array factory is itself bound via `NOTIFICATION_TEMPLATE_SERVICE_CONFIGS_ARRAY_TOKEN` in the notification module."].join("\n")
+      body: [
+        "**Required export:** A factory function returning a `NotificationTemplateServiceTypeConfig` with `{ type: <NAME>_NOTIFICATION_TEMPLATE_TYPE, factory: async (...) => ... }`.",
+        "",
+        "**Wire into:** the top-level `<app>NotificationTemplateServiceConfigsArrayFactory(context)` \u2014 call the new factory inside its returned array. The configs-array factory is itself bound via `NOTIFICATION_TEMPLATE_SERVICE_CONFIGS_ARRAY_TOKEN` in the notification module."
+      ].join("\n")
     }
   ],
   seeAlso: ["notification-task"],
@@ -51296,7 +51796,17 @@ var NOTIFICATION_TASK = {
       heading: "API handler config",
       path: "<apiDir>/src/app/common/model/notification/notification.task.service.ts",
       altPaths: ["<apiDir>/src/app/common/model/notification/handlers/task.handler.<name>.ts (per-task split for larger workspaces)"],
-      body: ["**Required shape:**", "```ts", "const <camelName>NotificationTaskHandler: NotificationTaskServiceTaskHandlerConfig<<Name>NotificationTaskData, <Name>NotificationTaskCheckpoint> = {", "  type: <NAME>_NOTIFICATION_TASK_TYPE,", "  flow: [", "    { checkpoint: 'part_a', fn: async (notificationTask) => ... }", "  ]", "};", "```"].join("\n")
+      body: [
+        "**Required shape:**",
+        "```ts",
+        "const <camelName>NotificationTaskHandler: NotificationTaskServiceTaskHandlerConfig<<Name>NotificationTaskData, <Name>NotificationTaskCheckpoint> = {",
+        "  type: <NAME>_NOTIFICATION_TASK_TYPE,",
+        "  flow: [",
+        "    { checkpoint: 'part_a', fn: async (notificationTask) => ... }",
+        "  ]",
+        "};",
+        "```"
+      ].join("\n")
     },
     {
       heading: "Wire into task service",
@@ -52219,7 +52729,12 @@ function formatFirestoreRulesScanReportAsMarkdown(report) {
   }
   lines.push("");
   if (report.serverOnly.length > 0) {
-    lines.push(`**Server-only (${report.serverOnly.length}):** ${report.serverOnly.map((c) => `\`${c}\``).join(", ")}`, "", "Each of these must carry `@dbxModelServerOnly` on its model interface AND `serverOnly: true` on its `firebaseModelServiceFactory` config, so the model API refuses the read instead of authorizing it via `roleMapForModel`.", "");
+    lines.push(
+      `**Server-only (${report.serverOnly.length}):** ${report.serverOnly.map((c) => `\`${c}\``).join(", ")}`,
+      "",
+      "Each of these must carry `@dbxModelServerOnly` on its model interface AND `serverOnly: true` on its `firebaseModelServiceFactory` config, so the model API refuses the read instead of authorizing it via `roleMapForModel`.",
+      ""
+    );
   }
   if (report.gettableNotListable.length > 0) {
     lines.push(`**Gettable but not listable (${report.gettableNotListable.length}):** ${report.gettableNotListable.map((c) => `\`${c}\``).join(", ")}`, "", "`firestore-get` works on these; `firestore-query` does not \u2014 the rules grant reads by id only.", "");
@@ -52457,7 +52972,15 @@ function validateModelServerOnly(input) {
   }
   for (const iface of input.interfaces) {
     if (iface.serverOnly && !iface.hasModelTag) {
-      violations.push(buildViolation({ code: "MODEL_SERVER_ONLY_TAG_WITHOUT_MODEL_TAG" /* MODEL_SERVER_ONLY_TAG_WITHOUT_MODEL_TAG */, severity: "warning", modelType: void 0, file: iface.file, message: `Interface \`${iface.name}\` carries \`@dbxModelServerOnly\` but no \`@dbxModel\` tag, so the model extractor skips it and \`serverOnly\` never lands on the generated model manifest.` }));
+      violations.push(
+        buildViolation({
+          code: "MODEL_SERVER_ONLY_TAG_WITHOUT_MODEL_TAG" /* MODEL_SERVER_ONLY_TAG_WITHOUT_MODEL_TAG */,
+          severity: "warning",
+          modelType: void 0,
+          file: iface.file,
+          message: `Interface \`${iface.name}\` carries \`@dbxModelServerOnly\` but no \`@dbxModel\` tag, so the model extractor skips it and \`serverOnly\` never lands on the generated model manifest.`
+        })
+      );
     }
   }
   const errorCount = violations.filter((v) => v.severity === "error").length;
@@ -52479,22 +53002,78 @@ function appendServiceViolations(input) {
   const { modelType, collection, tag, flag, rules } = reconciliation;
   const declared = tag === true || flag;
   if (collection == null) {
-    violations.push(buildViolation({ code: "MODEL_SERVER_ONLY_UNRESOLVED_IDENTITY" /* MODEL_SERVER_ONLY_UNRESOLVED_IDENTITY */, severity: "warning", modelType, file: service.exportName, message: `No \`firestoreModelIdentity(...)\` for model type \`${modelType}\` was found in the scanned dirs, so its collection name \u2014 and therefore the rules leg of the reconciliation \u2014 could not be resolved.` }));
+    violations.push(
+      buildViolation({
+        code: "MODEL_SERVER_ONLY_UNRESOLVED_IDENTITY" /* MODEL_SERVER_ONLY_UNRESOLVED_IDENTITY */,
+        severity: "warning",
+        modelType,
+        file: service.exportName,
+        message: `No \`firestoreModelIdentity(...)\` for model type \`${modelType}\` was found in the scanned dirs, so its collection name \u2014 and therefore the rules leg of the reconciliation \u2014 could not be resolved.`
+      })
+    );
   } else if (rules === true && !flag) {
-    violations.push(buildViolation({ code: "MODEL_SERVER_ONLY_MISSING_RUNTIME_FLAG" /* MODEL_SERVER_ONLY_MISSING_RUNTIME_FLAG */, severity: "error", modelType, file: service.exportName, message: `\`${collection}\` has no client read grant in the rules (get=${reconciliation.rulesGet}, list=${reconciliation.rulesList}) but \`${service.exportName}\` does not set \`serverOnly: true\`, so the model API will hand a client a document the rules would refuse.` }));
+    violations.push(
+      buildViolation({
+        code: "MODEL_SERVER_ONLY_MISSING_RUNTIME_FLAG" /* MODEL_SERVER_ONLY_MISSING_RUNTIME_FLAG */,
+        severity: "error",
+        modelType,
+        file: service.exportName,
+        message: `\`${collection}\` has no client read grant in the rules (get=${reconciliation.rulesGet}, list=${reconciliation.rulesList}) but \`${service.exportName}\` does not set \`serverOnly: true\`, so the model API will hand a client a document the rules would refuse.`
+      })
+    );
   } else if (rules === false && declared) {
-    violations.push(buildViolation({ code: "MODEL_SERVER_ONLY_RULES_ALLOW_READ" /* MODEL_SERVER_ONLY_RULES_ALLOW_READ */, severity: "error", modelType, file: service.exportName, message: `\`${modelType}\` declares server-only (${describeDeclarations(tag, flag)}) but \`${collection}\` IS client-readable in the rules (get=${reconciliation.rulesGet}, list=${reconciliation.rulesList}).` }));
+    violations.push(
+      buildViolation({
+        code: "MODEL_SERVER_ONLY_RULES_ALLOW_READ" /* MODEL_SERVER_ONLY_RULES_ALLOW_READ */,
+        severity: "error",
+        modelType,
+        file: service.exportName,
+        message: `\`${modelType}\` declares server-only (${describeDeclarations(tag, flag)}) but \`${collection}\` IS client-readable in the rules (get=${reconciliation.rulesGet}, list=${reconciliation.rulesList}).`
+      })
+    );
   }
   if (rules === true && iface != null && !iface.serverOnly) {
-    violations.push(buildViolation({ code: "MODEL_SERVER_ONLY_MISSING_TAG" /* MODEL_SERVER_ONLY_MISSING_TAG */, severity: "warning", modelType, file: iface.file, message: `\`${collection}\` has no client read grant in the rules but interface \`${iface.name}\` has no \`@dbxModelServerOnly\` tag, so the CLI cannot refuse the read locally.` }));
+    violations.push(
+      buildViolation({
+        code: "MODEL_SERVER_ONLY_MISSING_TAG" /* MODEL_SERVER_ONLY_MISSING_TAG */,
+        severity: "warning",
+        modelType,
+        file: iface.file,
+        message: `\`${collection}\` has no client read grant in the rules but interface \`${iface.name}\` has no \`@dbxModelServerOnly\` tag, so the CLI cannot refuse the read locally.`
+      })
+    );
   }
   if (iface == null && flag) {
-    violations.push(buildViolation({ code: "MODEL_SERVER_ONLY_NO_INTERFACE" /* MODEL_SERVER_ONLY_NO_INTERFACE */, severity: "warning", modelType, file: service.exportName, message: `\`${modelType}\` sets \`serverOnly: true\` but its data type \`${service.modelName ?? "(unknown)"}\` resolves to no interface in the scanned dirs, so there is nothing to carry \`@dbxModelServerOnly\`.` }));
+    violations.push(
+      buildViolation({
+        code: "MODEL_SERVER_ONLY_NO_INTERFACE" /* MODEL_SERVER_ONLY_NO_INTERFACE */,
+        severity: "warning",
+        modelType,
+        file: service.exportName,
+        message: `\`${modelType}\` sets \`serverOnly: true\` but its data type \`${service.modelName ?? "(unknown)"}\` resolves to no interface in the scanned dirs, so there is nothing to carry \`@dbxModelServerOnly\`.`
+      })
+    );
   } else if (iface != null && tag !== flag) {
-    violations.push(buildViolation({ code: "MODEL_SERVER_ONLY_TAG_FLAG_MISMATCH" /* MODEL_SERVER_ONLY_TAG_FLAG_MISMATCH */, severity: "error", modelType, file: iface.file, message: `\`${modelType}\`: interface \`${iface.name}\` ${tag === true ? "carries" : "does NOT carry"} \`@dbxModelServerOnly\` while \`${service.exportName}\` ${flag ? "DOES" : "does not"} set \`serverOnly: true\`.` }));
+    violations.push(
+      buildViolation({
+        code: "MODEL_SERVER_ONLY_TAG_FLAG_MISMATCH" /* MODEL_SERVER_ONLY_TAG_FLAG_MISMATCH */,
+        severity: "error",
+        modelType,
+        file: iface.file,
+        message: `\`${modelType}\`: interface \`${iface.name}\` ${tag === true ? "carries" : "does NOT carry"} \`@dbxModelServerOnly\` while \`${service.exportName}\` ${flag ? "DOES" : "does not"} set \`serverOnly: true\`.`
+      })
+    );
   }
   if (manifestModelTypes != null && declared && !manifestModelTypes.has(modelType)) {
-    violations.push(buildViolation({ code: "MODEL_SERVER_ONLY_NOT_IN_MANIFEST" /* MODEL_SERVER_ONLY_NOT_IN_MANIFEST */, severity: "warning", modelType, file: manifestFile, message: `\`${modelType}\` is server-only but has no entry in the generated model manifest, so the CLI's local pre-transport refusal cannot fire for it \u2014 the read costs a round-trip to an API that refuses it.` }));
+    violations.push(
+      buildViolation({
+        code: "MODEL_SERVER_ONLY_NOT_IN_MANIFEST" /* MODEL_SERVER_ONLY_NOT_IN_MANIFEST */,
+        severity: "warning",
+        modelType,
+        file: manifestFile,
+        message: `\`${modelType}\` is server-only but has no entry in the generated model manifest, so the CLI's local pre-transport refusal cannot fire for it \u2014 the read costs a round-trip to an API that refuses it.`
+      })
+    );
   }
 }
 function legsAgree(input) {
@@ -52603,7 +53182,6 @@ async function walkTypeScriptFiles(dir) {
   try {
     entries = (await readdir12(dir)).sort();
   } catch {
-    return out;
   }
   for (const entry of entries) {
     if (entry === "node_modules" || entry === "dist") continue;
@@ -52884,7 +53462,7 @@ function relativeOrAbsolute(from, target) {
   const rel = relative20(from, target);
   if (rel.length === 0) return ".";
   if (rel.startsWith("..")) return target;
-  return rel.split("\\").join("/");
+  return rel.replaceAll("\\", "/");
 }
 
 // packages/dbx-components-mcp/src/tools/mcp-config/init.ts
@@ -53013,19 +53591,19 @@ async function planRootConfig(input) {
 }
 function defaultOutFor(input) {
   const targetAbs = resolve66(input.snapshot.workspaceRoot, ".tmp/dbx-mcp", `${input.slug}.${clusterFilenameSegment(input.cluster)}.json`);
-  return relative21(dirname22(input.scanConfigPath), targetAbs).split("\\").join("/");
+  return relative21(dirname22(input.scanConfigPath), targetAbs).replaceAll("\\", "/");
 }
 function resolveScanOut(scanConfigPath, out) {
   return resolve66(dirname22(scanConfigPath), out);
 }
 function relativeFromConfig(snapshot, absolute) {
   const configDir = snapshot.configPath === null ? snapshot.workspaceRoot : dirname22(snapshot.configPath);
-  return relative21(configDir, absolute).split("\\").join("/");
+  return relative21(configDir, absolute).replaceAll("\\", "/");
 }
 function workspaceRel(workspaceRoot, absolute) {
   const rel = relative21(workspaceRoot, absolute);
   if (rel.length === 0) return ".";
-  return rel.split("\\").join("/");
+  return rel.replaceAll("\\", "/");
 }
 function serializeJson(value) {
   return `${JSON.stringify(value, null, 2)}
@@ -55618,7 +56196,13 @@ async function tryReadBatchPath(path, cwd, reader) {
 import { type as type104 } from "arktype";
 var DBX_AUTH_CLAIM_LOOKUP_TOOL = {
   name: "dbx_auth_claim_lookup",
-  description: ["Look up a Firebase Auth custom-claim entry by key (`a`, `o`, `fr`) or by `*ApiAuthClaims` interface name (`DemoApiAuthClaims`).", "", "Returns the claim meaning, value type, role mapping through `authRoleClaimsService`, owning app + interface, and the source path:line where the claim is declared.", "", "Use the optional `app` parameter (`demo-api`) to scope the lookup when the same claim key exists in multiple apps."].join("\n"),
+  description: [
+    "Look up a Firebase Auth custom-claim entry by key (`a`, `o`, `fr`) or by `*ApiAuthClaims` interface name (`DemoApiAuthClaims`).",
+    "",
+    "Returns the claim meaning, value type, role mapping through `authRoleClaimsService`, owning app + interface, and the source path:line where the claim is declared.",
+    "",
+    "Use the optional `app` parameter (`demo-api`) to scope the lookup when the same claim key exists in multiple apps."
+  ].join("\n"),
   inputSchema: {
     type: "object",
     properties: {
@@ -55841,7 +56425,14 @@ function sourceLink2(path, line) {
 import { type as type106 } from "arktype";
 var DBX_AUTH_ROLE_LOOKUP_TOOL = {
   name: "dbx_auth_role_lookup",
-  description: ["Look up auth roles forward (by role string / const name), by tag, or in reverse (model + verb \u2192 required roles/scopes).", "", '- `topic="admin"` or `topic="AUTH_ADMIN_ROLE"` \u2192 role entry + claims that set it.', '- `tag="privileged"` \u2192 every role tagged with `privileged`.', '- `model="StorageFile" verb="read"` \u2192 reverse lookup of the roles/scopes the gate would expect.', '- `topic="list"` \u2192 catalog.'].join("\n"),
+  description: [
+    "Look up auth roles forward (by role string / const name), by tag, or in reverse (model + verb \u2192 required roles/scopes).",
+    "",
+    '- `topic="admin"` or `topic="AUTH_ADMIN_ROLE"` \u2192 role entry + claims that set it.',
+    '- `tag="privileged"` \u2192 every role tagged with `privileged`.',
+    '- `model="StorageFile" verb="read"` \u2192 reverse lookup of the roles/scopes the gate would expect.',
+    '- `topic="list"` \u2192 catalog.'
+  ].join("\n"),
   inputSchema: {
     type: "object",
     properties: {
@@ -56024,7 +56615,11 @@ function sourceLink3(path, line) {
 import { type as type107 } from "arktype";
 var DBX_AUTH_TOKEN_EXPLAIN_TOOL = {
   name: "dbx_auth_token_explain",
-  description: ["Decode a JWT or claims object and annotate each claim with the catalogued meaning, role mapping, and source path:line.", "", "Pass `token` (raw JWT string) **or** `claims` (decoded JSON object). Reserved JWT claims (`iss`/`aud`/`exp`/`iat`/`sub`/`scope`) are listed separately. Flags expired tokens and unknown wrong-issuer claims."].join("\n"),
+  description: [
+    "Decode a JWT or claims object and annotate each claim with the catalogued meaning, role mapping, and source path:line.",
+    "",
+    "Pass `token` (raw JWT string) **or** `claims` (decoded JSON object). Reserved JWT claims (`iss`/`aud`/`exp`/`iat`/`sub`/`scope`) are listed separately. Flags expired tokens and unknown wrong-issuer claims."
+  ].join("\n"),
   inputSchema: {
     type: "object",
     properties: {
@@ -56483,7 +57078,13 @@ function createAuthClusterTools(registry) {
 function registerTools(server, options = {}) {
   const underlyingServer = server.server;
   const tools = [...DBX_TOOLS];
-  tools.push(createUiExamplesTool({ examplesRegistry: options.dbxDocsUiExamplesRegistry }), createModelValidateTool({ ruleOptions: options.modelValidateRuleOptions }), createModelValidateFolderTool({ ruleOptions: options.modelValidateRuleOptions }), createModelFixtureValidateAppTool({ getRegistry: () => options.fixtureModelRegistry }), createLogSearchTool(options.logSearchConfig));
+  tools.push(
+    createUiExamplesTool({ examplesRegistry: options.dbxDocsUiExamplesRegistry }),
+    createModelValidateTool({ ruleOptions: options.modelValidateRuleOptions }),
+    createModelValidateFolderTool({ ruleOptions: options.modelValidateRuleOptions }),
+    createModelFixtureValidateAppTool({ getRegistry: () => options.fixtureModelRegistry }),
+    createLogSearchTool(options.logSearchConfig)
+  );
   if (options.forgeFieldRegistry !== void 0) {
     tools.push(createLookupFormTool({ registry: options.forgeFieldRegistry }), createSearchFormTool({ registry: options.forgeFieldRegistry }), createFormScaffoldTool({ registry: options.forgeFieldRegistry }));
   }
@@ -56737,7 +57338,25 @@ async function loadServerContext(options = {}) {
   await emitDownstreamHints({ cwd, externalCounts, onDownstreamHints: options.onDownstreamHints });
   const context = {
     resources: { semanticTypeRegistry: registry, forgeFieldRegistry: forgeRegistry, pipeRegistry, utilRegistry, modelSnapshotFieldRegistry, modelFirebaseIndexRegistry, uiComponentRegistry: uiRegistry, actionRegistry, filterRegistry, tokenRegistry, cssUtilityRegistry, authRegistry, cwd },
-    tools: { semanticTypeRegistry: registry, forgeFieldRegistry: forgeRegistry, pipeRegistry, utilRegistry, modelSnapshotFieldRegistry, modelFirebaseIndexRegistry, uiComponentRegistry: uiRegistry, dbxDocsUiExamplesRegistry, actionRegistry, filterRegistry, tokenRegistry, cssUtilityRegistry, fixtureModelRegistry, modelValidateRuleOptions, authRegistry, cwd, logSearchConfig }
+    tools: {
+      semanticTypeRegistry: registry,
+      forgeFieldRegistry: forgeRegistry,
+      pipeRegistry,
+      utilRegistry,
+      modelSnapshotFieldRegistry,
+      modelFirebaseIndexRegistry,
+      uiComponentRegistry: uiRegistry,
+      dbxDocsUiExamplesRegistry,
+      actionRegistry,
+      filterRegistry,
+      tokenRegistry,
+      cssUtilityRegistry,
+      fixtureModelRegistry,
+      modelValidateRuleOptions,
+      authRegistry,
+      cwd,
+      logSearchConfig
+    }
   };
   return context;
 }
@@ -56841,7 +57460,14 @@ async function resolveAuthRegistry(input) {
 }
 function reportAuthLoaderResult(result) {
   const { registry, scannedFiles, fileWarnings, extractWarnings, extractedAppCount, extractedClaimCount } = result;
-  const summary = [`[dbx-components-mcp] auth registry loaded`, `  sources: ${registry.loadedSources.join(", ") || "(none)"}`, `  scanned-files: ${scannedFiles.length}`, `  apps: ${registry.apps.length} (extracted: ${extractedAppCount})`, `  claims: ${registry.claims.length} (extracted: ${extractedClaimCount})`, `  warnings: ${fileWarnings.length + extractWarnings.length}`].join("\n");
+  const summary = [
+    `[dbx-components-mcp] auth registry loaded`,
+    `  sources: ${registry.loadedSources.join(", ") || "(none)"}`,
+    `  scanned-files: ${scannedFiles.length}`,
+    `  apps: ${registry.apps.length} (extracted: ${extractedAppCount})`,
+    `  claims: ${registry.claims.length} (extracted: ${extractedClaimCount})`,
+    `  warnings: ${fileWarnings.length + extractWarnings.length}`
+  ].join("\n");
   process.stderr.write(`${summary}
 `);
   for (const warning of fileWarnings) {