@dereekb/firebase-server 14.5.1 → 14.6.0

package/mcp/index.esm.js

@@ -1,7 +1,7 @@
 import { Injectable, Inject, Optional, Logger, Post, Req, Res, Get, Delete, Controller, HttpStatus } from '@nestjs/common';
 import { existsSync, readFileSync } from 'node:fs';
 import { McpServer, isLegacyRequest, isJsonContentType, createMcpHandler } from '@modelcontextprotocol/server';
-import { callModelOidcScopeForCallType, resolveEffectiveOidcScopeTerms, CLI_TOKEN_OIDC_SCOPE, inferKeyFromTwoWayFlatFirestoreModelKey, oidcScopeTermsSatisfied } from '@dereekb/firebase';
+import { callModelOidcScopeForCallType, resolveEffectiveOidcScopeTerms, twoWayFlatFirestoreModelKey, flatFirestoreModelKey, inferKeyFromTwoWayFlatFirestoreModelKey, CLI_TOKEN_OIDC_SCOPE, oidcScopeTermsSatisfied } from '@dereekb/firebase';
 import { getOidcScopesFromRequest, OidcProviderConfigService } from '@dereekb/firebase-server/oidc';
 import { makeValuesGroupMap, AUTH_ADMIN_ROLE, IMPERSONATION_URL_QUERY_PARAM, performAsyncTasks, authRolesSetHasRoles } from '@dereekb/util';
 import { requestClientIp, ModelApiCallModelDispatchService, ModelApiGetService, FirebaseServerStorageService, FirebaseServerEnvService, FirebaseServerAnalyticsService } from '@dereekb/firebase-server';
@@ -252,7 +252,7 @@ function _object_spread$9(target) {
     }
     return target;
 }
-function ownKeys$3(object, enumerableOnly) {
+function ownKeys$4(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -260,11 +260,11 @@ function ownKeys$3(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$3(target, source) {
+function _object_spread_props$4(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$3(Object(source)).forEach(function(key) {
+        ownKeys$4(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -356,9 +356,9 @@ function _unsupported_iterable_to_array$b(o, minLen) {
         var _base_type;
         var base = (typeof inputSchema === "undefined" ? "undefined" : _type_of$4(inputSchema)) === 'object' && inputSchema != null ? inputSchema : {};
         var existingProperties = _type_of$4(base.properties) === 'object' && base.properties != null ? base.properties : {};
-        var next = _object_spread_props$3(_object_spread$9({}, base), {
+        var next = _object_spread_props$4(_object_spread$9({}, base), {
             type: (_base_type = base.type) !== null && _base_type !== void 0 ? _base_type : 'object',
-            properties: _object_spread_props$3(_object_spread$9({}, existingProperties), _define_property$b({}, resolved.parameterName, {
+            properties: _object_spread_props$4(_object_spread$9({}, existingProperties), _define_property$b({}, resolved.parameterName, {
                 type: 'string',
                 maxLength: resolved.maxLength,
                 description: resolved.description
@@ -447,6 +447,34 @@ function _class_call_check$4(instance, Constructor) {
  * Mirrors {@link MCP_MANIFEST_VERSION} in `@dereekb/dbx-cli` — both packages
  * version-bump together when the manifest shape changes.
  */ var MCP_MANIFEST_VERSION = 1;
+/**
+ * Resolves the manifest entries whose `compositeKey.from` names `source` — the models whose document
+ * id is derived from a `source` document's key. A wildcard `from=*` matches every model except
+ * `source` itself (a model's id is never derived from its own key).
+ *
+ * @param source - The manifest entry of the decoded key's leaf model.
+ * @param manifest - The full model manifest.
+ * @returns The composite-key entries derived from `source`, in manifest order.
+ */ function findCompositeKeyModelsDerivedFrom(source, manifest) {
+    return manifest.filter(function(entry) {
+        return isCompositeKeyModelDerivedFrom(source, entry);
+    });
+}
+/**
+ * Whether `candidate` is a composite-key model whose document id is derived from a `source`
+ * document's key — `candidate.compositeKey.from` names `source` (by interface name, identity const,
+ * or modelType) or is the wildcard `*`. A model is never derived from its own key.
+ *
+ * @param source - The manifest entry of the source model.
+ * @param candidate - The manifest entry to test.
+ * @returns `true` when `candidate`'s id is a flattened `source` key.
+ */ function isCompositeKeyModelDerivedFrom(source, candidate) {
+    var _candidate_compositeKey;
+    var from = (_candidate_compositeKey = candidate.compositeKey) === null || _candidate_compositeKey === void 0 ? void 0 : _candidate_compositeKey.from;
+    return from != null && candidate.modelType !== source.modelType && (from === '*' || from.some(function(name) {
+        return name === source.modelName || name === source.identityConst || name === source.modelType;
+    }));
+}
 /**
  * Builds the canonical MCP manifest key for a (modelType, callType, specifier) triple.
  *
@@ -1795,31 +1823,16 @@ function _array_like_to_array$8(arr, len) {
 function _array_without_holes$6(arr) {
     if (Array.isArray(arr)) return _array_like_to_array$8(arr);
 }
-function asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, key, arg) {
-    try {
-        var info = gen[key](arg);
-        var value = info.value;
-    } catch (error) {
-        reject(error);
-        return;
-    }
-    if (info.done) resolve(value);
-    else Promise.resolve(value).then(_next, _throw);
-}
-function _async_to_generator$7(fn) {
-    return function() {
-        var self = this, args = arguments;
-        return new Promise(function(resolve, reject) {
-            var gen = fn.apply(self, args);
-            function _next(value) {
-                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "next", value);
-            }
-            function _throw(err) {
-                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "throw", err);
-            }
-            _next(undefined);
+function _define_property$9(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
         });
-    };
+    } else obj[key] = value;
+    return obj;
 }
 function _iterable_to_array$6(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
@@ -1829,107 +1842,41 @@ function _iterable_to_array$6(iter) {
 function _non_iterable_spread$6() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$6(arr) {
-    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$8(arr) || _non_iterable_spread$6();
-}
-function _ts_generator$7(thisArg, body) {
-    var f, y, t, _ = {
-        label: 0,
-        sent: function() {
-            if (t[0] & 1) throw t[1];
-            return t[1];
-        },
-        trys: [],
-        ops: []
-    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
-    return d(g, "next", {
-        value: verb(0)
-    }), d(g, "throw", {
-        value: verb(1)
-    }), d(g, "return", {
-        value: verb(2)
-    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
-        value: function() {
-            return this;
+function _object_spread$7(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
         }
-    }), g;
-    function verb(n) {
-        return function(v) {
-            return step([
-                n,
-                v
-            ]);
-        };
+        ownKeys.forEach(function(key) {
+            _define_property$9(target, key, source[key]);
+        });
     }
-    function step(op) {
-        if (f) throw new TypeError("Generator is already executing.");
-        while(g && (g = 0, op[0] && (_ = 0)), _)try {
-            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-            if (y = 0, t) op = [
-                op[0] & 2,
-                t.value
-            ];
-            switch(op[0]){
-                case 0:
-                case 1:
-                    t = op;
-                    break;
-                case 4:
-                    _.label++;
-                    return {
-                        value: op[1],
-                        done: false
-                    };
-                case 5:
-                    _.label++;
-                    y = op[1];
-                    op = [
-                        0
-                    ];
-                    continue;
-                case 7:
-                    op = _.ops.pop();
-                    _.trys.pop();
-                    continue;
-                default:
-                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
-                        _ = 0;
-                        continue;
-                    }
-                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
-                        _.label = op[1];
-                        break;
-                    }
-                    if (op[0] === 6 && _.label < t[1]) {
-                        _.label = t[1];
-                        t = op;
-                        break;
-                    }
-                    if (t && _.label < t[2]) {
-                        _.label = t[2];
-                        _.ops.push(op);
-                        break;
-                    }
-                    if (t[2]) _.ops.pop();
-                    _.trys.pop();
-                    continue;
-            }
-            op = body.call(thisArg, _);
-        } catch (e) {
-            op = [
-                6,
-                e
-            ];
-            y = 0;
-        } finally{
-            f = t = 0;
-        }
-        if (op[0] & 5) throw op[1];
-        return {
-            value: op[0] ? op[1] : void 0,
-            done: true
-        };
+    return target;
+}
+function ownKeys$3(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$3(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    else {
+        ownKeys$3(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
     }
+    return target;
+}
+function _to_consumable_array$6(arr) {
+    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$8(arr) || _non_iterable_spread$6();
 }
 function _unsupported_iterable_to_array$8(o, minLen) {
     if (!o) return;
@@ -1941,56 +1888,59 @@ function _unsupported_iterable_to_array$8(o, minLen) {
 }
 // MARK: Constants
 /**
- * Reserved tool name for the built-in `model-get` static tool.
- */ var MODEL_GET_TOOL_NAME = 'model-get';
+ * Reserved tool name for the built-in `model-info` static tool.
+ */ var MODEL_INFO_TOOL_NAME = 'model-info';
 /**
- * Synthetic call type used in the tool's dispatch identity. Aligns with the dbx-cli `get`
- * command and the `/api/model/:modelType/get` HTTP endpoint that backs it.
- */ var MODEL_GET_DISPATCH_CALL = 'get';
+ * Synthetic call type used in the tool's dispatch identity. Aligns with the dbx-cli `model-info`
+ * command.
+ */ var MODEL_INFO_DISPATCH_CALL = 'info';
 /**
- * Synthetic model type used in the tool's dispatch identity. The tool itself isn't bound to a
- * specific model type (the `modelType` is part of its input), so we use the literal "model" as
- * the identity. Apps avoiding collision should not register a real model literally named
- * "model".
- */ var MODEL_GET_DISPATCH_MODEL_TYPE = 'model';
+ * Synthetic model type used in the tool's dispatch identity. Mirrors {@link MODEL_GET_DISPATCH_MODEL_TYPE};
+ * apps avoiding collisions should not register a real model literally named "model".
+ */ var MODEL_INFO_DISPATCH_MODEL_TYPE = 'model';
 /**
- * Maximum number of keys per backend multi-read request. Matches
- * `MAX_MODEL_ACCESS_MULTI_READ_KEYS` exported from `@dereekb/firebase-server`; mirrored as a
- * local constant so the bundler doesn't have to follow the import chain just for one number.
- */ var MCP_MODEL_GET_BATCH_SIZE = 50;
+ * Group label applied to manifest entries that declare no `modelGroup`. Keeps the `groups` mode
+ * total reconcilable with the catalog size (sum of group counts always equals `totalModels`).
+ */ var MODEL_INFO_UNGROUPED_LABEL = '(ungrouped)';
+/**
+ * Hint string surfaced alongside the default `groups` response so callers know how to drill in.
+ */ var MODEL_INFO_GROUPS_HINT = 'Pass `model` for one/many models, `modelGroup` for a group, or `all:true` for the full catalog.';
 // MARK: Factory
 /**
- * Builds the built-in `model-get` MCP tool definition.
+ * Builds the built-in `model-info` MCP tool definition.
  *
- * Mirrors dbx-cli's `get` / `get-many` behavior:
- * - Accepts an array of keys; values containing `/` are treated as full keys and passed verbatim
- *   while bare ids are promoted to `${collectionName}/${id}` for root models.
- * - Nested (subcollection) models reject bare ids since a parent path is required.
- * - Auto-chunks at {@link MCP_MODEL_GET_BATCH_SIZE} keys per backend call, mirroring
- *   `getMultipleModelsOverHttpChunked` on the CLI side.
+ * Modes (selected by input):
+ * - No args: returns model groups + counts (`mode: 'groups'`) — the cheap default for browsing.
+ * - `model` (string): returns the full entry for one model (`mode: 'single'`).
+ * - `model` (string array): returns full detail per match (`mode: 'multiple'`); misses land in `notFound`.
+ * - `modelGroup`: returns the summary list of that group's models (`mode: 'list'`).
+ * - `all: true`: returns the full catalog summary (`mode: 'list'`).
+ * - `fields`: forces (`true`) or suppresses (`false`) full persisted-field detail in list/multiple modes.
  *
- * The handler returns the same `{ results, errors }` shape produced by
- * `ModelApiGetService.readDocuments`, exposed via both the text content block and
- * `structuredContent` so MCP clients can consume either form.
+ * Each `model` query matches by `modelType`, `identityConst`, or `collectionPrefix`. When several
+ * params are supplied, precedence is `model` > `modelGroup` > `all` > the default `groups` view.
  *
- * @param deps - Read-documents and identity-resolver callbacks (typically wired to
- *   `ModelApiGetService`).
+ * Output is delivered as both stringified JSON in `content[0].text` and `structuredContent`
+ * so MCP clients can consume either form.
+ *
+ * @param deps - The frozen model manifest loaded at boot from the MCP manifest JSON.
  * @returns A statically-registered {@link McpToolDefinition} ready to be appended to the MCP
  *   server factory's tool registry.
- */ function createModelGetTool(deps) {
+ */ function createModelInfoTool(deps) {
     var handler = function handler(args, ctx) {
-        return modelGetToolHandler(args, ctx, deps);
+        return Promise.resolve(modelInfoToolHandler(args, ctx, deps));
     };
-    var name = MODEL_GET_TOOL_NAME;
-    var description = 'Fetch one or more Firestore model documents by key or bare id. Values containing `/` are treated as full keys; bare ids are auto-promoted to `<collectionName>/<id>` for root models. Subcollection models require full keys.';
+    var name = MODEL_INFO_TOOL_NAME;
+    var count = deps.manifest.length;
+    var description = "Browse the Firestore model catalog (".concat(count, " model").concat(count === 1 ? '' : 's', "). No args returns model groups + counts (start here). ") + '`model` (a modelType/identityConst/collectionPrefix string, or an array of them) returns full detail per match — misses are reported in `notFound`. ' + '`modelGroup` returns the summary list for that group. `all:true` returns the full catalog summary. ' + '`fields` (boolean) forces or suppresses persisted-field detail in list/multiple modes.';
     return buildStaticToolDefinition({
         name: name,
         description: description,
-        inputSchema: MODEL_GET_INPUT_SCHEMA,
-        outputSchema: MODEL_GET_OUTPUT_SCHEMA,
+        inputSchema: MODEL_INFO_INPUT_SCHEMA,
+        outputSchema: MODEL_INFO_OUTPUT_SCHEMA,
         dispatch: {
-            call: MODEL_GET_DISPATCH_CALL,
-            modelType: MODEL_GET_DISPATCH_MODEL_TYPE
+            call: MODEL_INFO_DISPATCH_CALL,
+            modelType: MODEL_INFO_DISPATCH_MODEL_TYPE
         },
         staticHandler: handler,
         effectiveReadOnly: true,
@@ -2000,98 +1950,139 @@ function _unsupported_iterable_to_array$8(o, minLen) {
     });
 }
 // MARK: Handler
-function modelGetToolHandler(args, ctx, deps) {
-    return _async_to_generator$7(function() {
-        var result, input, identity, resolvedKeys, merged, error;
-        return _ts_generator$7(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    _state.trys.push([
-                        0,
-                        2,
-                        ,
-                        3
-                    ]);
-                    input = parseModelGetInput(args);
-                    identity = deps.resolveIdentity(input.modelType, ctx.auth);
-                    if (identity == null) {
-                        throw new Error("Unknown modelType: ".concat(input.modelType));
-                    }
-                    resolvedKeys = resolveKeys$1(input.keys, identity);
-                    return [
-                        4,
-                        readInChunks$1({
-                            modelType: input.modelType,
-                            keys: resolvedKeys,
-                            auth: ctx.auth,
-                            readDocuments: deps.readDocuments
-                        })
-                    ];
-                case 1:
-                    merged = _state.sent();
-                    result = {
-                        content: [
-                            {
-                                type: 'text',
-                                text: JSON.stringify(merged)
-                            }
-                        ],
-                        structuredContent: merged
-                    };
-                    return [
-                        3,
-                        3
-                    ];
-                case 2:
-                    error = _state.sent();
-                    result = formatMcpToolErrorResponse(error);
-                    return [
-                        3,
-                        3
-                    ];
-                case 3:
-                    return [
-                        2,
-                        result
-                    ];
-            }
+function modelInfoToolHandler(args, _ctx, deps) {
+    var result;
+    try {
+        var input = parseModelInfoInput(args);
+        var resolved = resolveModelInfoOutput(input, deps.manifest);
+        var output = attachReferencedEnums(resolved, deps.enums);
+        result = {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify(output)
+                }
+            ],
+            structuredContent: output
+        };
+    } catch (error) {
+        result = formatMcpToolErrorResponse(error);
+    }
+    return result;
+}
+function resolveModelInfoOutput(input, manifest) {
+    var output;
+    if (input.modelQueries != null) {
+        output = buildModelLookupOutput({
+            queries: input.modelQueries,
+            isArray: input.modelIsArray,
+            manifest: manifest,
+            fields: input.fields
         });
-    })();
+    } else if (input.modelGroup != null) {
+        output = buildGroupFilterOutput({
+            group: input.modelGroup,
+            manifest: manifest,
+            fields: input.fields
+        });
+    } else if (input.all) {
+        output = buildAllOutput(manifest, input.fields);
+    } else {
+        output = buildGroupsOutput(manifest);
+    }
+    return output;
 }
-function parseModelGetInput(args) {
-    var modelType = args['modelType'];
-    var keys = args['keys'];
-    if (typeof modelType !== 'string' || modelType.length === 0) {
-        throw new Error('model-get: "modelType" is required and must be a non-empty string.');
+// MARK: Enum attachment
+/**
+ * Attaches the value→label tables for every enum referenced (by `enumRef`) on the returned models'
+ * fields — recursively through `nestedFields` — as a top-level `enums` section.
+ *
+ * Gated behind full field detail: only `single` / `multiple` rows and `list` rows that opted into
+ * `fields:true` carry the persisted `fields` array, so the compact default modes are untouched.
+ * Returns the input unchanged when no enum map is wired or no referenced enum resolves.
+ *
+ * @param output - The resolved model-info output.
+ * @param enums - The optional enum value tables keyed by name.
+ * @returns The output, with an `enums` section attached when detailed rows reference known enums.
+ */ function attachReferencedEnums(output, enums) {
+    var result = output;
+    if (enums != null) {
+        var referenced = new Set();
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = collectDetailedEntries(output)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var entry = _step.value;
+                collectFieldEnumRefs(entry.fields, referenced);
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
+                }
+            } finally{
+                if (_didIteratorError) {
+                    throw _iteratorError;
+                }
+            }
+        }
+        var tables = [];
+        var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+        try {
+            for(var _iterator1 = referenced[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                var name = _step1.value;
+                var table = enums[name];
+                if (table != null) tables.push(table);
+            }
+        } catch (err) {
+            _didIteratorError1 = true;
+            _iteratorError1 = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                    _iterator1.return();
+                }
+            } finally{
+                if (_didIteratorError1) {
+                    throw _iteratorError1;
+                }
+            }
+        }
+        if (tables.length > 0) {
+            result = _object_spread_props$3(_object_spread$7({}, output), {
+                enums: tables
+            });
+        }
     }
-    if (!Array.isArray(keys) || keys.length === 0) {
-        throw new Error('model-get: "keys" is required and must be a non-empty array.');
+    return result;
+}
+/**
+ * Collects the full {@link McpManifestModelEntry} rows (those carrying a persisted `fields` array)
+ * from a model-info output. Summary rows (which expose `fieldCount`, not `fields`) are skipped.
+ *
+ * @param output - The resolved model-info output.
+ * @returns The detailed model entries present in the output.
+ */ function collectDetailedEntries(output) {
+    var rows = [];
+    if (output.mode === 'single') {
+        rows.push(output.model);
+    } else if (output.mode === 'list' || output.mode === 'multiple') {
+        var _rows;
+        (_rows = rows).push.apply(_rows, _to_consumable_array$6(output.models));
     }
-    var normalizedKeys = keys.map(function(value, index) {
-        if (typeof value !== 'string' || value.length === 0) {
-            throw new Error("model-get: keys[".concat(index, "] must be a non-empty string."));
-        }
-        return value;
+    return rows.filter(function(row) {
+        return Array.isArray(row.fields);
     });
-    return {
-        modelType: modelType,
-        keys: normalizedKeys
-    };
 }
-function resolveKeys$1(keys, identity) {
-    var isRoot = identity.type === 'root';
-    var resolved = [];
+function collectFieldEnumRefs(fields, into) {
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
-        for(var _iterator = keys[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var value = _step.value;
-            if (value.includes('/')) {
-                resolved.push(value);
-            } else if (isRoot) {
-                resolved.push("".concat(identity.collectionName, "/").concat(value));
-            } else {
-                throw new Error('model-get: modelType "'.concat(identity.modelType, '" is a subcollection; bare ids are not allowed. Provide full keys (e.g. "parentPrefix/parentId/').concat(identity.collectionName, "/").concat(value, '").'));
-            }
+        for(var _iterator = fields[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var field = _step.value;
+            if (field.enumRef) into.add(field.enumRef);
+            if (field.nestedFields) collectFieldEnumRefs(field.nestedFields, into);
         }
     } catch (err) {
         _didIteratorError = true;
@@ -2107,126 +2098,593 @@ function resolveKeys$1(keys, identity) {
             }
         }
     }
-    return resolved;
 }
-function readInChunks$1(input) {
-    return _async_to_generator$7(function() {
-        var modelType, keys, auth, readDocuments, merged, offset, _merged_results, _merged_errors, batch, partial;
-        return _ts_generator$7(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    modelType = input.modelType, keys = input.keys, auth = input.auth, readDocuments = input.readDocuments;
-                    merged = {
-                        results: [],
-                        errors: []
-                    };
-                    offset = 0;
-                    _state.label = 1;
-                case 1:
-                    if (!(offset < keys.length)) return [
-                        3,
-                        4
-                    ];
-                    batch = keys.slice(offset, offset + MCP_MODEL_GET_BATCH_SIZE);
-                    return [
-                        4,
-                        readDocuments(modelType, batch, auth)
-                    ];
-                case 2:
-                    partial = _state.sent();
-                    (_merged_results = merged.results).push.apply(_merged_results, _to_consumable_array$6(partial.results));
-                    (_merged_errors = merged.errors).push.apply(_merged_errors, _to_consumable_array$6(partial.errors));
-                    _state.label = 3;
-                case 3:
-                    offset += MCP_MODEL_GET_BATCH_SIZE;
-                    return [
-                        3,
-                        1
-                    ];
-                case 4:
-                    return [
-                        2,
-                        merged
-                    ];
-            }
-        });
-    })();
+// MARK: Input parsing
+function parseModelInfoInput(args) {
+    var modelQueries = parseModelArg(args['model']);
+    var modelGroup = parseModelGroupArg(args['modelGroup']);
+    var all = parseBooleanArg(args['all'], 'all');
+    var fields = parseBooleanArg(args['fields'], 'fields');
+    return _object_spread$7(_object_spread_props$3(_object_spread$7(_object_spread_props$3(_object_spread$7({}, modelQueries == null ? {} : {
+        modelQueries: modelQueries
+    }), {
+        modelIsArray: Array.isArray(args['model'])
+    }), modelGroup == null ? {} : {
+        modelGroup: modelGroup
+    }), {
+        all: all !== null && all !== void 0 ? all : false
+    }), fields == null ? {} : {
+        fields: fields
+    });
 }
-// MARK: Schemas
-var MODEL_GET_INPUT_SCHEMA = {
-    type: 'object',
-    required: [
-        'modelType',
-        'keys'
-    ],
-    properties: {
-        modelType: {
+function parseModelArg(raw) {
+    var result;
+    if (raw == null) {
+        result = undefined;
+    } else if (typeof raw === 'string') {
+        result = [
+            requireNonEmptyString$1(raw, 'model')
+        ];
+    } else if (Array.isArray(raw)) {
+        if (raw.length === 0) {
+            throw new Error('model-info: "model" array must contain at least one entry.');
+        }
+        result = raw.map(function(value, index) {
+            return requireNonEmptyString$1(value, "model[".concat(index, "]"));
+        });
+    } else {
+        throw new TypeError('model-info: "model" must be a string or an array of strings when provided.');
+    }
+    return result;
+}
+function parseModelGroupArg(raw) {
+    var result;
+    if (raw == null) {
+        result = undefined;
+    } else if (typeof raw === 'string') {
+        result = requireNonEmptyString$1(raw, 'modelGroup');
+    } else {
+        throw new TypeError('model-info: "modelGroup" must be a string when provided.');
+    }
+    return result;
+}
+function parseBooleanArg(raw, label) {
+    var result;
+    if (raw == null) {
+        result = undefined;
+    } else if (typeof raw === 'boolean') {
+        result = raw;
+    } else {
+        throw new TypeError('model-info: "'.concat(label, '" must be a boolean when provided.'));
+    }
+    return result;
+}
+function requireNonEmptyString$1(value, label) {
+    if (typeof value !== 'string') {
+        throw new TypeError('model-info: "'.concat(label, '" must be a string.'));
+    }
+    var trimmed = value.trim();
+    if (trimmed.length === 0) {
+        throw new Error('model-info: "'.concat(label, '" must be a non-empty string.'));
+    }
+    return trimmed;
+}
+// MARK: Output builders
+function buildGroupsOutput(manifest) {
+    return {
+        mode: 'groups',
+        groups: computeGroupCounts(manifest),
+        totalModels: manifest.length,
+        hint: MODEL_INFO_GROUPS_HINT
+    };
+}
+function buildGroupFilterOutput(config) {
+    var group = config.group, manifest = config.manifest, fields = config.fields;
+    var detailed = fields !== null && fields !== void 0 ? fields : false;
+    var lower = group.toLowerCase();
+    var matches = manifest.filter(function(entry) {
+        var _entry_modelGroup;
+        return ((_entry_modelGroup = entry.modelGroup) === null || _entry_modelGroup === void 0 ? void 0 : _entry_modelGroup.toLowerCase()) === lower;
+    });
+    var result;
+    if (matches.length === 0) {
+        throw new Error(buildUnknownGroupMessage(group, manifest));
+    } else {
+        var canonical = matches[0].modelGroup;
+        result = {
+            mode: 'list',
+            modelGroup: canonical,
+            models: matches.map(function(entry) {
+                return toModelRow(entry, detailed);
+            })
+        };
+    }
+    return result;
+}
+function buildAllOutput(manifest) {
+    var fields = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : false;
+    return {
+        mode: 'list',
+        models: manifest.map(function(entry) {
+            return toModelRow(entry, fields);
+        })
+    };
+}
+function buildModelLookupOutput(config) {
+    var queries = config.queries, isArray = config.isArray, manifest = config.manifest, fields = config.fields;
+    var detailed = fields !== null && fields !== void 0 ? fields : true;
+    var matched = [];
+    var notFound = [];
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = queries[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var query = _step.value;
+            var entry = findModelEntry(query, manifest);
+            if (entry == null) {
+                notFound.push({
+                    query: query,
+                    message: buildModelNotFoundMessage(query, manifest)
+                });
+            } else {
+                matched.push(toModelRow(entry, detailed));
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    var result;
+    if (isArray) {
+        result = notFound.length > 0 ? {
+            mode: 'multiple',
+            models: matched,
+            notFound: notFound
+        } : {
+            mode: 'multiple',
+            models: matched
+        };
+    } else if (matched.length > 0) {
+        result = {
+            mode: 'single',
+            model: matched[0]
+        };
+    } else {
+        throw new Error(notFound[0].message);
+    }
+    return result;
+}
+// MARK: Row + group helpers
+function toModelRow(entry, detailed) {
+    return detailed ? entry : toSummaryRow(entry);
+}
+function toSummaryRow(entry) {
+    return _object_spread$7({
+        modelType: entry.modelType,
+        modelName: entry.modelName,
+        identityConst: entry.identityConst,
+        collectionPrefix: entry.collectionPrefix,
+        sourcePackage: entry.sourcePackage,
+        fieldCount: entry.fields.length
+    }, entry.modelGroup == null ? {} : {
+        modelGroup: entry.modelGroup
+    }, entry.parentIdentityConst == null ? {} : {
+        parentIdentityConst: entry.parentIdentityConst
+    }, entry.description == null ? {} : {
+        description: entry.description
+    }, entry.read == null ? {} : {
+        read: entry.read
+    }, entry.serviceFactory == null ? {} : {
+        serviceFactoryExport: entry.serviceFactory.exportName
+    });
+}
+/**
+ * Counts models per `modelGroup`, bucketing entries without a group under
+ * {@link MODEL_INFO_UNGROUPED_LABEL}. Sorted by count descending, then group name ascending.
+ *
+ * @param manifest - Model manifest to summarize.
+ * @returns One {@link ModelInfoGroupCount} per group, ordered most-populous-first.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function computeGroupCounts(manifest) {
+    var grouped = makeValuesGroupMap(_to_consumable_array$6(manifest), function(entry) {
+        var _entry_modelGroup;
+        return (_entry_modelGroup = entry.modelGroup) !== null && _entry_modelGroup !== void 0 ? _entry_modelGroup : MODEL_INFO_UNGROUPED_LABEL;
+    });
+    var counts = [];
+    grouped.forEach(function(entries, group) {
+        counts.push({
+            modelGroup: group,
+            modelCount: entries.length
+        });
+    });
+    counts.sort(function(a, b) {
+        return b.modelCount - a.modelCount || a.modelGroup.localeCompare(b.modelGroup);
+    });
+    return counts;
+}
+function findGroupCount(query, manifest) {
+    var lower = query.toLowerCase();
+    var result;
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = computeGroupCounts(manifest)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var count = _step.value;
+            if (count.modelGroup.toLowerCase() === lower) {
+                result = count;
+                break;
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return result;
+}
+function buildModelNotFoundMessage(query, manifest) {
+    var groupMatch = findGroupCount(query, manifest);
+    var message;
+    if (groupMatch == null) {
+        message = 'model-info: no exact match for "'.concat(query, '". Call `model-info` with no arguments to list groups, or pass all:true for the full catalog.');
+    } else {
+        var plural = groupMatch.modelCount === 1 ? '' : 's';
+        message = 'model-info: no exact match for "'.concat(query, '" — did you mean group:"').concat(groupMatch.modelGroup, '" (').concat(groupMatch.modelCount, " model").concat(plural, ')? Use modelGroup:"').concat(groupMatch.modelGroup, '", or all:true for everything.');
+    }
+    return message;
+}
+function buildUnknownGroupMessage(group, manifest) {
+    var available = computeGroupCounts(manifest).map(function(count) {
+        return "".concat(count.modelGroup, " (").concat(count.modelCount, ")");
+    }).join(', ');
+    return 'model-info: no model group matches "'.concat(group, '". Available groups: ').concat(available || '(none)', ". Call `model-info` with no arguments to list groups.");
+}
+/**
+ * Resolves a manifest entry by `modelType`, `identityConst`, or `collectionPrefix`.
+ *
+ * @param query - Identifier to look up.
+ * @param manifest - Model manifest to search.
+ * @returns The matching entry or `undefined`.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function findModelEntry(query, manifest) {
+    var result;
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = manifest[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var entry = _step.value;
+            if (entry.modelType === query || entry.identityConst === query || entry.collectionPrefix === query) {
+                result = entry;
+                break;
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return result;
+}
+// MARK: Schemas
+var MODEL_INFO_INPUT_SCHEMA = {
+    type: 'object',
+    properties: {
+        model: {
+            description: 'One model (string) or many (string array), each matched by modelType, identityConst, or collectionPrefix. A string → `mode:"single"`; an array → `mode:"multiple"`. Misses are reported in `notFound`.',
+            oneOf: [
+                {
+                    type: 'string',
+                    minLength: 1
+                },
+                {
+                    type: 'array',
+                    minItems: 1,
+                    items: {
+                        type: 'string',
+                        minLength: 1
+                    }
+                }
+            ]
+        },
+        modelGroup: {
             type: 'string',
             minLength: 1,
-            description: 'Firestore model type to fetch (e.g. "guestbook", "profile").'
+            description: 'Return the summary list of models in this group (`mode:"list"`). Matched case-insensitively.'
+        },
+        all: {
+            type: 'boolean',
+            description: 'Opt in to the full catalog summary (every model). Never the default — omit to get groups instead.'
+        },
+        fields: {
+            type: 'boolean',
+            description: 'Force (true) or suppress (false) full persisted-field detail. Defaults to summary rows for list mode and full entries for single/multiple modes.'
+        }
+    },
+    additionalProperties: false
+};
+// Shared item schema for model-bearing rows. Required props cover the summary form; full entries
+// add `fields`, `sourceFile`, and `serviceFactory` (allowed as additional properties).
+var MODEL_ROW_SCHEMA = {
+    type: 'object',
+    required: [
+        'modelType',
+        'modelName',
+        'identityConst',
+        'collectionPrefix',
+        'sourcePackage'
+    ],
+    properties: {
+        modelType: {
+            type: 'string'
+        },
+        modelName: {
+            type: 'string'
+        },
+        modelGroup: {
+            type: 'string'
+        },
+        identityConst: {
+            type: 'string'
+        },
+        collectionPrefix: {
+            type: 'string'
+        },
+        parentIdentityConst: {
+            type: 'string'
+        },
+        sourcePackage: {
+            type: 'string'
+        },
+        sourceFile: {
+            type: 'string'
+        },
+        fieldCount: {
+            type: 'integer'
+        },
+        description: {
+            type: 'string'
+        },
+        read: {
+            type: 'string',
+            enum: [
+                'system',
+                'owner',
+                'admin-only',
+                'permissions'
+            ]
+        },
+        serviceFactoryExport: {
+            type: 'string'
+        },
+        fields: {
+            type: 'array',
+            items: {
+                type: 'object'
+            }
+        },
+        serviceFactory: {
+            type: 'object',
+            required: [
+                'exportName',
+                'sourceFile'
+            ],
+            properties: {
+                exportName: {
+                    type: 'string'
+                },
+                sourceFile: {
+                    type: 'string'
+                }
+            }
+        }
+    }
+};
+/**
+ * JSON-schema for one enum value→label table. Shared with the `enum-info` tool so both advertise the
+ * identical enum shape.
+ */ var ENUM_TABLE_SCHEMA = {
+    type: 'object',
+    required: [
+        'name',
+        'values'
+    ],
+    properties: {
+        name: {
+            type: 'string'
         },
-        keys: {
+        description: {
+            type: 'string'
+        },
+        values: {
             type: 'array',
-            minItems: 1,
-            description: 'Full keys ("prefix/id") or bare ids (root models only).',
             items: {
-                type: 'string',
-                minLength: 1
+                type: 'object',
+                required: [
+                    'name',
+                    'value'
+                ],
+                properties: {
+                    name: {
+                        type: 'string'
+                    },
+                    value: {
+                        type: [
+                            'string',
+                            'number'
+                        ]
+                    },
+                    description: {
+                        type: 'string'
+                    }
+                }
             }
         }
-    },
-    additionalProperties: false
+    }
 };
-var MODEL_GET_OUTPUT_SCHEMA = {
+// MCP's `tools/list` validator requires `outputSchema.type === 'object'` at the root
+// (see the MCP SDK's `ToolSchema`), so the variants are expressed via a top-level
+// object whose nested `oneOf` discriminates by the `mode` literal.
+var MODEL_INFO_OUTPUT_SCHEMA = {
     type: 'object',
     required: [
-        'results',
-        'errors'
+        'mode'
     ],
+    description: 'Discriminated by `mode`: `groups` (default model groups + counts), `list` (summary/full list for `modelGroup` or `all`), `single` (one `model`), or `multiple` (a `model` array, with misses in `notFound`).',
     properties: {
-        results: {
+        mode: {
+            type: 'string',
+            enum: [
+                'groups',
+                'list',
+                'single',
+                'multiple'
+            ]
+        },
+        groups: {
             type: 'array',
-            description: 'Per-key successful reads.',
+            description: 'Present when `mode` is `"groups"`. One entry per model group.',
             items: {
                 type: 'object',
                 required: [
-                    'key',
-                    'data'
+                    'modelGroup',
+                    'modelCount'
                 ],
                 properties: {
-                    key: {
+                    modelGroup: {
                         type: 'string'
                     },
-                    data: {}
+                    modelCount: {
+                        type: 'integer'
+                    }
                 }
             }
         },
-        errors: {
+        totalModels: {
+            type: 'integer',
+            description: 'Present when `mode` is `"groups"`. Total models across all groups.'
+        },
+        hint: {
+            type: 'string',
+            description: 'Present when `mode` is `"groups"`. Guidance on how to drill into the catalog.'
+        },
+        models: {
             type: 'array',
-            description: 'Per-key failures (not-found, forbidden, etc.).',
+            description: 'Present when `mode` is `"list"` or `"multiple"`. Summary rows by default; full entries when `fields` requests detail.',
+            items: MODEL_ROW_SCHEMA
+        },
+        modelGroup: {
+            type: 'string',
+            description: 'Present when `mode` is `"list"` from a `modelGroup` filter. The canonical group name.'
+        },
+        model: _object_spread_props$3(_object_spread$7({}, MODEL_ROW_SCHEMA), {
+            description: 'Present when `mode` is `"single"`. The matched model entry (full detail unless `fields:false`).'
+        }),
+        notFound: {
+            type: 'array',
+            description: 'Present when `mode` is `"multiple"` and one or more queries matched nothing.',
             items: {
                 type: 'object',
                 required: [
-                    'key',
+                    'query',
                     'message'
                 ],
                 properties: {
-                    key: {
+                    query: {
                         type: 'string'
                     },
                     message: {
                         type: 'string'
-                    },
-                    code: {
-                        type: 'string'
                     }
                 }
             }
+        },
+        enums: {
+            type: 'array',
+            description: 'Value→label tables for the enums referenced by the returned models’ fields. Present only when full field detail is returned (single/multiple modes, or list/all with `fields:true`) and at least one referenced enum is registered.',
+            items: ENUM_TABLE_SCHEMA
         }
-    }
+    },
+    oneOf: [
+        {
+            required: [
+                'groups',
+                'totalModels'
+            ],
+            properties: {
+                mode: {
+                    const: 'groups'
+                }
+            }
+        },
+        {
+            required: [
+                'models'
+            ],
+            properties: {
+                mode: {
+                    const: 'list'
+                }
+            }
+        },
+        {
+            required: [
+                'model'
+            ],
+            properties: {
+                mode: {
+                    const: 'single'
+                }
+            }
+        },
+        {
+            required: [
+                'models'
+            ],
+            properties: {
+                mode: {
+                    const: 'multiple'
+                }
+            }
+        }
+    ]
 };
 
-function asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, key, arg) {
+function _array_like_to_array$7(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
+}
+function asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
         var value = info.value;
@@ -2237,48 +2695,33 @@ function asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, key, arg) {
     if (info.done) resolve(value);
     else Promise.resolve(value).then(_next, _throw);
 }
-function _async_to_generator$6(fn) {
+function _async_to_generator$7(fn) {
     return function() {
         var self = this, args = arguments;
         return new Promise(function(resolve, reject) {
             var gen = fn.apply(self, args);
             function _next(value) {
-                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "next", value);
+                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "next", value);
             }
             function _throw(err) {
-                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "throw", err);
+                asyncGeneratorStep$7(gen, resolve, reject, _next, _throw, "throw", err);
             }
             _next(undefined);
         });
     };
 }
-function _define_property$9(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else obj[key] = value;
-    return obj;
-}
-function _object_spread$7(target) {
-    for(var i = 1; i < arguments.length; i++){
-        var source = arguments[i] != null ? arguments[i] : {};
-        var ownKeys = Object.keys(source);
-        if (typeof Object.getOwnPropertySymbols === "function") {
-            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
-            }));
-        }
-        ownKeys.forEach(function(key) {
-            _define_property$9(target, key, source[key]);
-        });
+function _iterable_to_array$5(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
+        return Array.from(iter);
     }
-    return target;
 }
-function _ts_generator$6(thisArg, body) {
+function _non_iterable_spread$5() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$5();
+}
+function _ts_generator$7(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
         sent: function() {
@@ -2377,60 +2820,68 @@ function _ts_generator$6(thisArg, body) {
         };
     }
 }
+function _unsupported_iterable_to_array$7(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
+}
 // MARK: Constants
 /**
- * Reserved tool name for the built-in `model-roles` static tool.
- */ var MODEL_ROLES_TOOL_NAME = 'model-roles';
-/**
- * Synthetic call type used in the tool's dispatch identity. Distinct from `model-get`'s `get` so
- * visibility predicates can target the two independently.
- */ var MODEL_ROLES_DISPATCH_CALL = 'roles';
+ * Reserved tool name for the built-in `model-get` static tool.
+ */ var MODEL_GET_TOOL_NAME = 'model-get';
 /**
- * Synthetic model type used in the tool's dispatch identity. Mirrors {@link MODEL_GET_DISPATCH_MODEL_TYPE}
- * — the tool isn't bound to one model type, so the literal "model" stands in.
- */ var MODEL_ROLES_DISPATCH_MODEL_TYPE = 'model';
+ * Synthetic call type used in the tool's dispatch identity. Aligns with the dbx-cli `get`
+ * command and the `/api/model/:modelType/get` HTTP endpoint that backs it.
+ */ var MODEL_GET_DISPATCH_CALL = 'get';
 /**
- * Maximum number of keys accepted per `model-roles` call. Role resolution runs the model's real
- * permission delegate per key (which may itself read parent documents), so this is deliberately
- * lower than the `model-get` batch size.
- */ var MCP_MODEL_ROLES_MAX_KEYS = 25;
-// MARK: Factory
+ * Synthetic model type used in the tool's dispatch identity. The tool itself isn't bound to a
+ * specific model type (the `modelType` is part of its input), so we use the literal "model" as
+ * the identity. Apps avoiding collision should not register a real model literally named
+ * "model".
+ */ var MODEL_GET_DISPATCH_MODEL_TYPE = 'model';
 /**
- * Builds the built-in `model-roles` MCP tool definition.
- *
- * Answers "what is this user actually allowed to do with this document?" by running the same
- * `roleMapForModel()` delegate the permission-checked read/write paths use, and returning the
- * resolved roles instead of consuming them. Because the model's real delegate runs, derived and
- * cascading roles appear exactly as the API grants them — there is no second implementation of the
- * rules to drift.
+ * Maximum number of keys per backend multi-read request. Matches
+ * `MAX_MODEL_ACCESS_MULTI_READ_KEYS` exported from `@dereekb/firebase-server`; mirrored as a
+ * local constant so the bundler doesn't have to follow the import chain just for one number.
+ */ var MCP_MODEL_GET_BATCH_SIZE = 50;
+// MARK: Factory
+/**
+ * Builds the built-in `model-get` MCP tool definition.
  *
- * Two things it disambiguates that a plain read cannot:
- * - **Missing vs. forbidden.** A key that resolves to a missing document returns
- *   `exists: false, roles: []` rather than an error, so "the document is not there" reads
- *   differently from "it is there and you have no access" (`exists: true, roles: []`).
- * - **Full access.** Admin short-circuits that grant the full-access marker come back as
- *   `fullAccess: true` rather than as an opaque enumerated set.
+ * Mirrors dbx-cli's `get` / `get-many` behavior:
+ * - Accepts an array of keys; values containing `/` are treated as full keys and passed verbatim
+ *   while bare ids are promoted to `${collectionName}/${id}` for root models.
+ * - Nested (subcollection) models reject bare ids since a parent path is required.
+ * - When a manifest is supplied, a root composite-key model also accepts its declared source
+ *   model's key and flattens it into the document id (see {@link CreateModelGetToolDeps.manifest}).
+ * - Auto-chunks at {@link MCP_MODEL_GET_BATCH_SIZE} keys per backend call, mirroring
+ *   `getMultipleModelsOverHttpChunked` on the CLI side.
  *
- * By default roles are resolved for the calling user. Passing `uid` resolves them for another user
- * and is gated behind {@link CreateModelRolesToolDeps.canTargetOtherUids}.
+ * The handler returns the same `{ results, errors }` shape produced by
+ * `ModelApiGetService.readDocuments`, exposed via both the text content block and
+ * `structuredContent` so MCP clients can consume either form.
  *
- * @param deps - Role-map reader, identity resolver, and the target-uid authorization predicate.
+ * @param deps - Read-documents and identity-resolver callbacks (typically wired to
+ *   `ModelApiGetService`).
  * @returns A statically-registered {@link McpToolDefinition} ready to be appended to the MCP
  *   server factory's tool registry.
- */ function createModelRolesTool(deps) {
+ */ function createModelGetTool(deps) {
     var handler = function handler(args, ctx) {
-        return modelRolesToolHandler(args, ctx, deps);
+        return modelGetToolHandler(args, ctx, deps);
     };
-    var name = MODEL_ROLES_TOOL_NAME;
-    var description = 'Resolve which roles the current user (or, with "uid", another user) is granted on one or more model keys — the same permission computation the API runs, returned instead of enforced. Use to answer "why was this forbidden?" and to tell a missing document (exists:false) apart from one you cannot access (exists:true, roles:[]). Admin full-access short-circuits report fullAccess:true. Targeting another uid requires elevated access.';
+    var name = MODEL_GET_TOOL_NAME;
+    var description = "Fetch one or more Firestore model documents by key or bare id. Values containing `/` are treated as full keys; bare ids are auto-promoted to `<collectionName>/<id>` for root models. Subcollection models require full keys.".concat(deps.manifest == null ? '' : ' For a root composite-key model (`@dbxModelCompositeKey`), a source model key is accepted in place of the flattened id and rewritten automatically.');
     return buildStaticToolDefinition({
         name: name,
         description: description,
-        inputSchema: MODEL_ROLES_INPUT_SCHEMA,
-        outputSchema: MODEL_ROLES_OUTPUT_SCHEMA,
+        inputSchema: MODEL_GET_INPUT_SCHEMA,
+        outputSchema: MODEL_GET_OUTPUT_SCHEMA,
         dispatch: {
-            call: MODEL_ROLES_DISPATCH_CALL,
-            modelType: MODEL_ROLES_DISPATCH_MODEL_TYPE
+            call: MODEL_GET_DISPATCH_CALL,
+            modelType: MODEL_GET_DISPATCH_MODEL_TYPE
         },
         staticHandler: handler,
         effectiveReadOnly: true,
@@ -2440,120 +2891,56 @@ function _ts_generator$6(thisArg, body) {
     });
 }
 // MARK: Handler
-function modelRolesToolHandler(args, ctx, deps) {
-    return _async_to_generator$6(function() {
-        var result, input, identity, targetUid, keys, resolved, error;
-        return _ts_generator$6(this, function(_state) {
+function modelGetToolHandler(args, ctx, deps) {
+    return _async_to_generator$7(function() {
+        var result, input, identity, resolvedKeys, merged, error;
+        return _ts_generator$7(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
                         0,
-                        3,
+                        2,
                         ,
-                        4
+                        3
                     ]);
-                    input = parseModelRolesInput(args);
+                    input = parseModelGetInput(args);
                     identity = deps.resolveIdentity(input.modelType, ctx.auth);
                     if (identity == null) {
                         throw new Error("Unknown modelType: ".concat(input.modelType));
                     }
+                    resolvedKeys = resolveKeys$1(input.keys, identity, deps.manifest);
                     return [
                         4,
-                        resolveTargetUid({
-                            requestedUid: input.uid,
+                        readInChunks$1({
+                            modelType: input.modelType,
+                            keys: resolvedKeys,
                             auth: ctx.auth,
-                            canTargetOtherUids: deps.canTargetOtherUids
+                            readDocuments: deps.readDocuments
                         })
                     ];
                 case 1:
-                    targetUid = _state.sent();
-                    keys = resolveKeys(input.keys, identity);
-                    return [
-                        4,
-                        deps.readRoleMaps(_object_spread$7({
-                            modelType: input.modelType,
-                            keys: keys,
-                            auth: ctx.auth
-                        }, targetUid == null ? {} : {
-                            targetUid: targetUid
-                        }))
-                    ];
-                case 2:
-                    resolved = _state.sent();
+                    merged = _state.sent();
                     result = {
                         content: [
                             {
                                 type: 'text',
-                                text: JSON.stringify(resolved)
+                                text: JSON.stringify(merged)
                             }
                         ],
-                        structuredContent: resolved
+                        structuredContent: merged
                     };
                     return [
                         3,
-                        4
+                        3
                     ];
-                case 3:
+                case 2:
                     error = _state.sent();
                     result = formatMcpToolErrorResponse(error);
-                    return [
-                        3,
-                        4
-                    ];
-                case 4:
-                    return [
-                        2,
-                        result
-                    ];
-            }
-        });
-    })();
-}
-/**
- * Resolves the effective target uid for a call, enforcing the elevated-access gate.
- *
- * Requesting your own uid is always allowed and is treated as no target at all, so a caller that
- * passes their own uid never trips the predicate.
- *
- * @param input - The requested uid, the caller's auth, and the authorization predicate.
- * @returns The uid to resolve as, or `undefined` to resolve as the caller.
- * @throws {Error} When another user's uid is requested and the predicate denies (or is absent).
- */ function resolveTargetUid(input) {
-    return _async_to_generator$6(function() {
-        var requestedUid, auth, canTargetOtherUids, result, allowed, _tmp;
-        return _ts_generator$6(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    requestedUid = input.requestedUid, auth = input.auth, canTargetOtherUids = input.canTargetOtherUids;
-                    if (!(requestedUid != null && requestedUid !== (auth === null || auth === void 0 ? void 0 : auth.uid))) return [
-                        3,
-                        4
-                    ];
-                    if (!(canTargetOtherUids == null)) return [
-                        3,
-                        1
-                    ];
-                    _tmp = false;
                     return [
                         3,
                         3
                     ];
-                case 1:
-                    return [
-                        4,
-                        canTargetOtherUids(auth)
-                    ];
-                case 2:
-                    _tmp = _state.sent();
-                    _state.label = 3;
                 case 3:
-                    allowed = _tmp;
-                    if (!allowed) {
-                        throw new Error("model-roles: resolving roles for another user's uid requires elevated access.");
-                    }
-                    result = requestedUid;
-                    _state.label = 4;
-                case 4:
                     return [
                         2,
                         result
@@ -2562,36 +2949,27 @@ function modelRolesToolHandler(args, ctx, deps) {
         });
     })();
 }
-function parseModelRolesInput(args) {
+function parseModelGetInput(args) {
     var modelType = args['modelType'];
     var keys = args['keys'];
-    var uid = args['uid'];
     if (typeof modelType !== 'string' || modelType.length === 0) {
-        throw new Error('model-roles: "modelType" is required and must be a non-empty string.');
+        throw new Error('model-get: "modelType" is required and must be a non-empty string.');
     }
     if (!Array.isArray(keys) || keys.length === 0) {
-        throw new Error('model-roles: "keys" is required and must be a non-empty array.');
-    }
-    if (keys.length > MCP_MODEL_ROLES_MAX_KEYS) {
-        throw new Error("model-roles: at most ".concat(MCP_MODEL_ROLES_MAX_KEYS, " keys may be resolved per call (received ").concat(keys.length, ")."));
-    }
-    if (uid !== undefined && (typeof uid !== 'string' || uid.length === 0)) {
-        throw new Error('model-roles: "uid" must be a non-empty string when provided.');
+        throw new Error('model-get: "keys" is required and must be a non-empty array.');
     }
     var normalizedKeys = keys.map(function(value, index) {
         if (typeof value !== 'string' || value.length === 0) {
-            throw new Error("model-roles: keys[".concat(index, "] must be a non-empty string."));
+            throw new Error("model-get: keys[".concat(index, "] must be a non-empty string."));
         }
         return value;
     });
-    return _object_spread$7({
+    return {
         modelType: modelType,
         keys: normalizedKeys
-    }, uid === undefined ? {} : {
-        uid: uid
-    });
+    };
 }
-function resolveKeys(keys, identity) {
+function resolveKeys$1(keys, identity, manifest) {
     var isRoot = identity.type === 'root';
     var resolved = [];
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
@@ -2599,11 +2977,12 @@ function resolveKeys(keys, identity) {
         for(var _iterator = keys[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
             var value = _step.value;
             if (value.includes('/')) {
-                resolved.push(value);
+                var _ref;
+                resolved.push((_ref = isRoot ? flattenCompositeSourceKey(value, identity, manifest) : undefined) !== null && _ref !== void 0 ? _ref : value);
             } else if (isRoot) {
                 resolved.push("".concat(identity.collectionName, "/").concat(value));
             } else {
-                throw new Error('model-roles: modelType "'.concat(identity.modelType, '" is a subcollection; bare ids are not allowed. Provide full keys (e.g. "parentPrefix/parentId/').concat(identity.collectionName, "/").concat(value, '").'));
+                throw new Error('model-get: modelType "'.concat(identity.modelType, '" is a subcollection; bare ids are not allowed. Provide full keys (e.g. "parentPrefix/parentId/').concat(identity.collectionName, "/").concat(value, '").'));
             }
         }
     } catch (err) {
@@ -2622,8 +3001,80 @@ function resolveKeys(keys, identity) {
     }
     return resolved;
 }
+/**
+ * Rewrites `key` into the requested composite-key model's document key when `key`'s leaf model is one
+ * of that model's declared sources.
+ *
+ * @param key - A full `prefix/id` key supplied by the caller.
+ * @param identity - The identity of the requested (root) model.
+ * @param manifest - The model catalog, when wired.
+ * @returns The rewritten `<collectionName>/<flattened key>`, or `undefined` — leave the key alone — when
+ *   the manifest is absent, the key already belongs to the requested collection, the requested model
+ *   declares no composite key, or the key's leaf model is not one of its sources.
+ */ function flattenCompositeSourceKey(key, identity, manifest) {
+    var result;
+    var target = manifest == null ? undefined : manifest.find(function(entry) {
+        return entry.modelType === identity.modelType;
+    });
+    if (manifest != null && (target === null || target === void 0 ? void 0 : target.compositeKey) != null && !key.startsWith("".concat(identity.collectionName, "/"))) {
+        var segments = key.split('/').filter(function(s) {
+            return s.length > 0;
+        });
+        var leafPrefix = segments.length >= 2 && segments.length % 2 === 0 ? segments[segments.length - 2] : undefined;
+        var sourceEntry = leafPrefix == null ? undefined : findModelEntry(leafPrefix, manifest);
+        var isSource = sourceEntry != null && isCompositeKeyModelDerivedFrom(sourceEntry, target);
+        if (isSource) {
+            var flatId = target.compositeKey.encoding === 'two-way' ? twoWayFlatFirestoreModelKey(key) : flatFirestoreModelKey(key);
+            result = "".concat(identity.collectionName, "/").concat(flatId);
+        }
+    }
+    return result;
+}
+function readInChunks$1(input) {
+    return _async_to_generator$7(function() {
+        var modelType, keys, auth, readDocuments, merged, offset, _merged_results, _merged_errors, batch, partial;
+        return _ts_generator$7(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    modelType = input.modelType, keys = input.keys, auth = input.auth, readDocuments = input.readDocuments;
+                    merged = {
+                        results: [],
+                        errors: []
+                    };
+                    offset = 0;
+                    _state.label = 1;
+                case 1:
+                    if (!(offset < keys.length)) return [
+                        3,
+                        4
+                    ];
+                    batch = keys.slice(offset, offset + MCP_MODEL_GET_BATCH_SIZE);
+                    return [
+                        4,
+                        readDocuments(modelType, batch, auth)
+                    ];
+                case 2:
+                    partial = _state.sent();
+                    (_merged_results = merged.results).push.apply(_merged_results, _to_consumable_array$5(partial.results));
+                    (_merged_errors = merged.errors).push.apply(_merged_errors, _to_consumable_array$5(partial.errors));
+                    _state.label = 3;
+                case 3:
+                    offset += MCP_MODEL_GET_BATCH_SIZE;
+                    return [
+                        3,
+                        1
+                    ];
+                case 4:
+                    return [
+                        2,
+                        merged
+                    ];
+            }
+        });
+    })();
+}
 // MARK: Schemas
-var MODEL_ROLES_INPUT_SCHEMA = {
+var MODEL_GET_INPUT_SCHEMA = {
     type: 'object',
     required: [
         'modelType',
@@ -2633,78 +3084,47 @@ var MODEL_ROLES_INPUT_SCHEMA = {
         modelType: {
             type: 'string',
             minLength: 1,
-            description: 'Firestore model type to resolve roles on (e.g. "guestbook", "profile").'
+            description: 'Firestore model type to fetch (e.g. "guestbook", "profile").'
         },
         keys: {
             type: 'array',
             minItems: 1,
-            maxItems: MCP_MODEL_ROLES_MAX_KEYS,
-            description: 'Full keys ("prefix/id") or bare ids (root models only).',
+            description: 'Full keys ("prefix/id") or bare ids (root models only). For a root composite-key model, the source model key (e.g. a District key for jobDistrict) is also accepted and flattened into the document id.',
             items: {
                 type: 'string',
                 minLength: 1
             }
-        },
-        uid: {
-            type: 'string',
-            minLength: 1,
-            description: 'Resolve roles as this user instead of the caller. Requires elevated access; passing your own uid is always allowed.'
         }
     },
     additionalProperties: false
 };
-var MODEL_ROLES_OUTPUT_SCHEMA = {
+var MODEL_GET_OUTPUT_SCHEMA = {
     type: 'object',
     required: [
-        'targeted',
         'results',
         'errors'
     ],
     properties: {
-        uid: {
-            type: 'string',
-            description: 'The uid the roles were resolved for.'
-        },
-        targeted: {
-            type: 'boolean',
-            description: 'True when the roles were resolved for a user other than the caller.'
-        },
         results: {
             type: 'array',
-            description: 'Per-key resolved permission state.',
+            description: 'Per-key successful reads.',
             items: {
                 type: 'object',
                 required: [
                     'key',
-                    'exists',
-                    'fullAccess',
-                    'roles'
+                    'data'
                 ],
                 properties: {
                     key: {
                         type: 'string'
                     },
-                    exists: {
-                        type: 'boolean',
-                        description: 'Whether the document exists. Roles are only computed for documents that exist.'
-                    },
-                    fullAccess: {
-                        type: 'boolean',
-                        description: 'True when the full-access marker was granted; every role is implicitly held and "roles" is empty.'
-                    },
-                    roles: {
-                        type: 'array',
-                        items: {
-                            type: 'string'
-                        },
-                        description: 'Granted role names, sorted.'
-                    }
+                    data: {}
                 }
             }
         },
         errors: {
             type: 'array',
-            description: 'Per-key failures. A missing document is NOT an error — it appears in results with exists:false.',
+            description: 'Per-key failures (not-found, forbidden, etc.).',
             items: {
                 type: 'object',
                 required: [
@@ -2727,565 +3147,384 @@ var MODEL_ROLES_OUTPUT_SCHEMA = {
     }
 };
 
-function _array_like_to_array$7(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_without_holes$5(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
-}
-function _define_property$8(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else obj[key] = value;
-    return obj;
-}
-function _iterable_to_array$5(iter) {
-    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
-        return Array.from(iter);
-    }
-}
-function _non_iterable_spread$5() {
-    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _object_spread$6(target) {
-    for(var i = 1; i < arguments.length; i++){
-        var source = arguments[i] != null ? arguments[i] : {};
-        var ownKeys = Object.keys(source);
-        if (typeof Object.getOwnPropertySymbols === "function") {
-            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
-            }));
-        }
-        ownKeys.forEach(function(key) {
-            _define_property$8(target, key, source[key]);
-        });
-    }
-    return target;
-}
-function ownKeys$2(object, enumerableOnly) {
-    var keys = Object.keys(object);
-    if (Object.getOwnPropertySymbols) {
-        var symbols = Object.getOwnPropertySymbols(object);
-        keys.push.apply(keys, symbols);
-    }
-    return keys;
-}
-function _object_spread_props$2(target, source) {
-    source = source != null ? source : {};
-    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
-    else {
-        ownKeys$2(Object(source)).forEach(function(key) {
-            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
-        });
-    }
-    return target;
-}
-function _to_consumable_array$5(arr) {
-    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$5();
-}
-function _unsupported_iterable_to_array$7(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
-}
-// MARK: Constants
-/**
- * Reserved tool name for the built-in `model-info` static tool.
- */ var MODEL_INFO_TOOL_NAME = 'model-info';
-/**
- * Synthetic call type used in the tool's dispatch identity. Aligns with the dbx-cli `model-info`
- * command.
- */ var MODEL_INFO_DISPATCH_CALL = 'info';
-/**
- * Synthetic model type used in the tool's dispatch identity. Mirrors {@link MODEL_GET_DISPATCH_MODEL_TYPE};
- * apps avoiding collisions should not register a real model literally named "model".
- */ var MODEL_INFO_DISPATCH_MODEL_TYPE = 'model';
-/**
- * Group label applied to manifest entries that declare no `modelGroup`. Keeps the `groups` mode
- * total reconcilable with the catalog size (sum of group counts always equals `totalModels`).
- */ var MODEL_INFO_UNGROUPED_LABEL = '(ungrouped)';
-/**
- * Hint string surfaced alongside the default `groups` response so callers know how to drill in.
- */ var MODEL_INFO_GROUPS_HINT = 'Pass `model` for one/many models, `modelGroup` for a group, or `all:true` for the full catalog.';
-// MARK: Factory
-/**
- * Builds the built-in `model-info` MCP tool definition.
- *
- * Modes (selected by input):
- * - No args: returns model groups + counts (`mode: 'groups'`) — the cheap default for browsing.
- * - `model` (string): returns the full entry for one model (`mode: 'single'`).
- * - `model` (string array): returns full detail per match (`mode: 'multiple'`); misses land in `notFound`.
- * - `modelGroup`: returns the summary list of that group's models (`mode: 'list'`).
- * - `all: true`: returns the full catalog summary (`mode: 'list'`).
- * - `fields`: forces (`true`) or suppresses (`false`) full persisted-field detail in list/multiple modes.
- *
- * Each `model` query matches by `modelType`, `identityConst`, or `collectionPrefix`. When several
- * params are supplied, precedence is `model` > `modelGroup` > `all` > the default `groups` view.
- *
- * Output is delivered as both stringified JSON in `content[0].text` and `structuredContent`
- * so MCP clients can consume either form.
- *
- * @param deps - The frozen model manifest loaded at boot from the MCP manifest JSON.
- * @returns A statically-registered {@link McpToolDefinition} ready to be appended to the MCP
- *   server factory's tool registry.
- */ function createModelInfoTool(deps) {
-    var handler = function handler(args, ctx) {
-        return Promise.resolve(modelInfoToolHandler(args, ctx, deps));
-    };
-    var name = MODEL_INFO_TOOL_NAME;
-    var count = deps.manifest.length;
-    var description = "Browse the Firestore model catalog (".concat(count, " model").concat(count === 1 ? '' : 's', "). No args returns model groups + counts (start here). ") + '`model` (a modelType/identityConst/collectionPrefix string, or an array of them) returns full detail per match — misses are reported in `notFound`. ' + '`modelGroup` returns the summary list for that group. `all:true` returns the full catalog summary. ' + '`fields` (boolean) forces or suppresses persisted-field detail in list/multiple modes.';
-    return buildStaticToolDefinition({
-        name: name,
-        description: description,
-        inputSchema: MODEL_INFO_INPUT_SCHEMA,
-        outputSchema: MODEL_INFO_OUTPUT_SCHEMA,
-        dispatch: {
-            call: MODEL_INFO_DISPATCH_CALL,
-            modelType: MODEL_INFO_DISPATCH_MODEL_TYPE
-        },
-        staticHandler: handler,
-        effectiveReadOnly: true,
-        rule: {
-            requireAuthenticated: true
-        }
-    });
-}
-// MARK: Handler
-function modelInfoToolHandler(args, _ctx, deps) {
-    var result;
+function asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, key, arg) {
     try {
-        var input = parseModelInfoInput(args);
-        var resolved = resolveModelInfoOutput(input, deps.manifest);
-        var output = attachReferencedEnums(resolved, deps.enums);
-        result = {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify(output)
-                }
-            ],
-            structuredContent: output
-        };
-    } catch (error) {
-        result = formatMcpToolErrorResponse(error);
-    }
-    return result;
-}
-function resolveModelInfoOutput(input, manifest) {
-    var output;
-    if (input.modelQueries != null) {
-        output = buildModelLookupOutput({
-            queries: input.modelQueries,
-            isArray: input.modelIsArray,
-            manifest: manifest,
-            fields: input.fields
-        });
-    } else if (input.modelGroup != null) {
-        output = buildGroupFilterOutput({
-            group: input.modelGroup,
-            manifest: manifest,
-            fields: input.fields
-        });
-    } else if (input.all) {
-        output = buildAllOutput(manifest, input.fields);
-    } else {
-        output = buildGroupsOutput(manifest);
-    }
-    return output;
-}
-// MARK: Enum attachment
-/**
- * Attaches the value→label tables for every enum referenced (by `enumRef`) on the returned models'
- * fields — recursively through `nestedFields` — as a top-level `enums` section.
- *
- * Gated behind full field detail: only `single` / `multiple` rows and `list` rows that opted into
- * `fields:true` carry the persisted `fields` array, so the compact default modes are untouched.
- * Returns the input unchanged when no enum map is wired or no referenced enum resolves.
- *
- * @param output - The resolved model-info output.
- * @param enums - The optional enum value tables keyed by name.
- * @returns The output, with an `enums` section attached when detailed rows reference known enums.
- */ function attachReferencedEnums(output, enums) {
-    var result = output;
-    if (enums != null) {
-        var referenced = new Set();
-        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-        try {
-            for(var _iterator = collectDetailedEntries(output)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                var entry = _step.value;
-                collectFieldEnumRefs(entry.fields, referenced);
-            }
-        } catch (err) {
-            _didIteratorError = true;
-            _iteratorError = err;
-        } finally{
-            try {
-                if (!_iteratorNormalCompletion && _iterator.return != null) {
-                    _iterator.return();
-                }
-            } finally{
-                if (_didIteratorError) {
-                    throw _iteratorError;
-                }
-            }
-        }
-        var tables = [];
-        var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
-        try {
-            for(var _iterator1 = referenced[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                var name = _step1.value;
-                var table = enums[name];
-                if (table != null) tables.push(table);
-            }
-        } catch (err) {
-            _didIteratorError1 = true;
-            _iteratorError1 = err;
-        } finally{
-            try {
-                if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
-                    _iterator1.return();
-                }
-            } finally{
-                if (_didIteratorError1) {
-                    throw _iteratorError1;
-                }
-            }
-        }
-        if (tables.length > 0) {
-            result = _object_spread_props$2(_object_spread$6({}, output), {
-                enums: tables
-            });
-        }
-    }
-    return result;
-}
-/**
- * Collects the full {@link McpManifestModelEntry} rows (those carrying a persisted `fields` array)
- * from a model-info output. Summary rows (which expose `fieldCount`, not `fields`) are skipped.
- *
- * @param output - The resolved model-info output.
- * @returns The detailed model entries present in the output.
- */ function collectDetailedEntries(output) {
-    var rows = [];
-    if (output.mode === 'single') {
-        rows.push(output.model);
-    } else if (output.mode === 'list' || output.mode === 'multiple') {
-        var _rows;
-        (_rows = rows).push.apply(_rows, _to_consumable_array$5(output.models));
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
     }
-    return rows.filter(function(row) {
-        return Array.isArray(row.fields);
-    });
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
 }
-function collectFieldEnumRefs(fields, into) {
-    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-    try {
-        for(var _iterator = fields[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var field = _step.value;
-            if (field.enumRef) into.add(field.enumRef);
-            if (field.nestedFields) collectFieldEnumRefs(field.nestedFields, into);
-        }
-    } catch (err) {
-        _didIteratorError = true;
-        _iteratorError = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion && _iterator.return != null) {
-                _iterator.return();
+function _async_to_generator$6(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "next", value);
             }
-        } finally{
-            if (_didIteratorError) {
-                throw _iteratorError;
+            function _throw(err) {
+                asyncGeneratorStep$6(gen, resolve, reject, _next, _throw, "throw", err);
             }
-        }
-    }
+            _next(undefined);
+        });
+    };
 }
-// MARK: Input parsing
-function parseModelInfoInput(args) {
-    var modelQueries = parseModelArg(args['model']);
-    var modelGroup = parseModelGroupArg(args['modelGroup']);
-    var all = parseBooleanArg(args['all'], 'all');
-    var fields = parseBooleanArg(args['fields'], 'fields');
-    return _object_spread$6(_object_spread_props$2(_object_spread$6(_object_spread_props$2(_object_spread$6({}, modelQueries == null ? {} : {
-        modelQueries: modelQueries
-    }), {
-        modelIsArray: Array.isArray(args['model'])
-    }), modelGroup == null ? {} : {
-        modelGroup: modelGroup
-    }), {
-        all: all !== null && all !== void 0 ? all : false
-    }), fields == null ? {} : {
-        fields: fields
-    });
+function _define_property$8(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
 }
-function parseModelArg(raw) {
-    var result;
-    if (raw == null) {
-        result = undefined;
-    } else if (typeof raw === 'string') {
-        result = [
-            requireNonEmptyString$1(raw, 'model')
-        ];
-    } else if (Array.isArray(raw)) {
-        if (raw.length === 0) {
-            throw new Error('model-info: "model" array must contain at least one entry.');
+function _object_spread$6(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
         }
-        result = raw.map(function(value, index) {
-            return requireNonEmptyString$1(value, "model[".concat(index, "]"));
+        ownKeys.forEach(function(key) {
+            _define_property$8(target, key, source[key]);
         });
-    } else {
-        throw new TypeError('model-info: "model" must be a string or an array of strings when provided.');
-    }
-    return result;
-}
-function parseModelGroupArg(raw) {
-    var result;
-    if (raw == null) {
-        result = undefined;
-    } else if (typeof raw === 'string') {
-        result = requireNonEmptyString$1(raw, 'modelGroup');
-    } else {
-        throw new TypeError('model-info: "modelGroup" must be a string when provided.');
-    }
-    return result;
-}
-function parseBooleanArg(raw, label) {
-    var result;
-    if (raw == null) {
-        result = undefined;
-    } else if (typeof raw === 'boolean') {
-        result = raw;
-    } else {
-        throw new TypeError('model-info: "'.concat(label, '" must be a boolean when provided.'));
-    }
-    return result;
-}
-function requireNonEmptyString$1(value, label) {
-    if (typeof value !== 'string') {
-        throw new TypeError('model-info: "'.concat(label, '" must be a string.'));
     }
-    var trimmed = value.trim();
-    if (trimmed.length === 0) {
-        throw new Error('model-info: "'.concat(label, '" must be a non-empty string.'));
-    }
-    return trimmed;
-}
-// MARK: Output builders
-function buildGroupsOutput(manifest) {
-    return {
-        mode: 'groups',
-        groups: computeGroupCounts(manifest),
-        totalModels: manifest.length,
-        hint: MODEL_INFO_GROUPS_HINT
-    };
+    return target;
 }
-function buildGroupFilterOutput(config) {
-    var group = config.group, manifest = config.manifest, fields = config.fields;
-    var detailed = fields !== null && fields !== void 0 ? fields : false;
-    var lower = group.toLowerCase();
-    var matches = manifest.filter(function(entry) {
-        var _entry_modelGroup;
-        return ((_entry_modelGroup = entry.modelGroup) === null || _entry_modelGroup === void 0 ? void 0 : _entry_modelGroup.toLowerCase()) === lower;
-    });
-    var result;
-    if (matches.length === 0) {
-        throw new Error(buildUnknownGroupMessage(group, manifest));
-    } else {
-        var canonical = matches[0].modelGroup;
-        result = {
-            mode: 'list',
-            modelGroup: canonical,
-            models: matches.map(function(entry) {
-                return toModelRow(entry, detailed);
-            })
+function _ts_generator$6(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
         };
     }
-    return result;
-}
-function buildAllOutput(manifest) {
-    var fields = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : false;
-    return {
-        mode: 'list',
-        models: manifest.map(function(entry) {
-            return toModelRow(entry, fields);
-        })
-    };
-}
-function buildModelLookupOutput(config) {
-    var queries = config.queries, isArray = config.isArray, manifest = config.manifest, fields = config.fields;
-    var detailed = fields !== null && fields !== void 0 ? fields : true;
-    var matched = [];
-    var notFound = [];
-    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-    try {
-        for(var _iterator = queries[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var query = _step.value;
-            var entry = findModelEntry(query, manifest);
-            if (entry == null) {
-                notFound.push({
-                    query: query,
-                    message: buildModelNotFoundMessage(query, manifest)
-                });
-            } else {
-                matched.push(toModelRow(entry, detailed));
-            }
-        }
-    } catch (err) {
-        _didIteratorError = true;
-        _iteratorError = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion && _iterator.return != null) {
-                _iterator.return();
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
             }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
         } finally{
-            if (_didIteratorError) {
-                throw _iteratorError;
-            }
+            f = t = 0;
         }
-    }
-    var result;
-    if (isArray) {
-        result = notFound.length > 0 ? {
-            mode: 'multiple',
-            models: matched,
-            notFound: notFound
-        } : {
-            mode: 'multiple',
-            models: matched
-        };
-    } else if (matched.length > 0) {
-        result = {
-            mode: 'single',
-            model: matched[0]
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
         };
-    } else {
-        throw new Error(notFound[0].message);
     }
-    return result;
-}
-// MARK: Row + group helpers
-function toModelRow(entry, detailed) {
-    return detailed ? entry : toSummaryRow(entry);
 }
-function toSummaryRow(entry) {
-    return _object_spread$6({
-        modelType: entry.modelType,
-        modelName: entry.modelName,
-        identityConst: entry.identityConst,
-        collectionPrefix: entry.collectionPrefix,
-        sourcePackage: entry.sourcePackage,
-        fieldCount: entry.fields.length
-    }, entry.modelGroup == null ? {} : {
-        modelGroup: entry.modelGroup
-    }, entry.parentIdentityConst == null ? {} : {
-        parentIdentityConst: entry.parentIdentityConst
-    }, entry.description == null ? {} : {
-        description: entry.description
-    }, entry.read == null ? {} : {
-        read: entry.read
-    }, entry.serviceFactory == null ? {} : {
-        serviceFactoryExport: entry.serviceFactory.exportName
+// MARK: Constants
+/**
+ * Reserved tool name for the built-in `model-roles` static tool.
+ */ var MODEL_ROLES_TOOL_NAME = 'model-roles';
+/**
+ * Synthetic call type used in the tool's dispatch identity. Distinct from `model-get`'s `get` so
+ * visibility predicates can target the two independently.
+ */ var MODEL_ROLES_DISPATCH_CALL = 'roles';
+/**
+ * Synthetic model type used in the tool's dispatch identity. Mirrors {@link MODEL_GET_DISPATCH_MODEL_TYPE}
+ * — the tool isn't bound to one model type, so the literal "model" stands in.
+ */ var MODEL_ROLES_DISPATCH_MODEL_TYPE = 'model';
+/**
+ * Maximum number of keys accepted per `model-roles` call. Role resolution runs the model's real
+ * permission delegate per key (which may itself read parent documents), so this is deliberately
+ * lower than the `model-get` batch size.
+ */ var MCP_MODEL_ROLES_MAX_KEYS = 25;
+// MARK: Factory
+/**
+ * Builds the built-in `model-roles` MCP tool definition.
+ *
+ * Answers "what is this user actually allowed to do with this document?" by running the same
+ * `roleMapForModel()` delegate the permission-checked read/write paths use, and returning the
+ * resolved roles instead of consuming them. Because the model's real delegate runs, derived and
+ * cascading roles appear exactly as the API grants them — there is no second implementation of the
+ * rules to drift.
+ *
+ * Two things it disambiguates that a plain read cannot:
+ * - **Missing vs. forbidden.** A key that resolves to a missing document returns
+ *   `exists: false, roles: []` rather than an error, so "the document is not there" reads
+ *   differently from "it is there and you have no access" (`exists: true, roles: []`).
+ * - **Full access.** Admin short-circuits that grant the full-access marker come back as
+ *   `fullAccess: true` rather than as an opaque enumerated set.
+ *
+ * By default roles are resolved for the calling user. Passing `uid` resolves them for another user
+ * and is gated behind {@link CreateModelRolesToolDeps.canTargetOtherUids}.
+ *
+ * @param deps - Role-map reader, identity resolver, and the target-uid authorization predicate.
+ * @returns A statically-registered {@link McpToolDefinition} ready to be appended to the MCP
+ *   server factory's tool registry.
+ */ function createModelRolesTool(deps) {
+    var handler = function handler(args, ctx) {
+        return modelRolesToolHandler(args, ctx, deps);
+    };
+    var name = MODEL_ROLES_TOOL_NAME;
+    var description = 'Resolve which roles the current user (or, with "uid", another user) is granted on one or more model keys — the same permission computation the API runs, returned instead of enforced. Use to answer "why was this forbidden?" and to tell a missing document (exists:false) apart from one you cannot access (exists:true, roles:[]). Admin full-access short-circuits report fullAccess:true. Targeting another uid requires elevated access.';
+    return buildStaticToolDefinition({
+        name: name,
+        description: description,
+        inputSchema: MODEL_ROLES_INPUT_SCHEMA,
+        outputSchema: MODEL_ROLES_OUTPUT_SCHEMA,
+        dispatch: {
+            call: MODEL_ROLES_DISPATCH_CALL,
+            modelType: MODEL_ROLES_DISPATCH_MODEL_TYPE
+        },
+        staticHandler: handler,
+        effectiveReadOnly: true,
+        rule: {
+            requireAuthenticated: true
+        }
     });
 }
+// MARK: Handler
+function modelRolesToolHandler(args, ctx, deps) {
+    return _async_to_generator$6(function() {
+        var result, input, identity, targetUid, keys, resolved, error;
+        return _ts_generator$6(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    _state.trys.push([
+                        0,
+                        3,
+                        ,
+                        4
+                    ]);
+                    input = parseModelRolesInput(args);
+                    identity = deps.resolveIdentity(input.modelType, ctx.auth);
+                    if (identity == null) {
+                        throw new Error("Unknown modelType: ".concat(input.modelType));
+                    }
+                    return [
+                        4,
+                        resolveTargetUid({
+                            requestedUid: input.uid,
+                            auth: ctx.auth,
+                            canTargetOtherUids: deps.canTargetOtherUids
+                        })
+                    ];
+                case 1:
+                    targetUid = _state.sent();
+                    keys = resolveKeys(input.keys, identity);
+                    return [
+                        4,
+                        deps.readRoleMaps(_object_spread$6({
+                            modelType: input.modelType,
+                            keys: keys,
+                            auth: ctx.auth
+                        }, targetUid == null ? {} : {
+                            targetUid: targetUid
+                        }))
+                    ];
+                case 2:
+                    resolved = _state.sent();
+                    result = {
+                        content: [
+                            {
+                                type: 'text',
+                                text: JSON.stringify(resolved)
+                            }
+                        ],
+                        structuredContent: resolved
+                    };
+                    return [
+                        3,
+                        4
+                    ];
+                case 3:
+                    error = _state.sent();
+                    result = formatMcpToolErrorResponse(error);
+                    return [
+                        3,
+                        4
+                    ];
+                case 4:
+                    return [
+                        2,
+                        result
+                    ];
+            }
+        });
+    })();
+}
 /**
- * Counts models per `modelGroup`, bucketing entries without a group under
- * {@link MODEL_INFO_UNGROUPED_LABEL}. Sorted by count descending, then group name ascending.
+ * Resolves the effective target uid for a call, enforcing the elevated-access gate.
  *
- * @param manifest - Model manifest to summarize.
- * @returns One {@link ModelInfoGroupCount} per group, ordered most-populous-first.
+ * Requesting your own uid is always allowed and is treated as no target at all, so a caller that
+ * passes their own uid never trips the predicate.
  *
- * @__NO_SIDE_EFFECTS__
- */ function computeGroupCounts(manifest) {
-    var grouped = makeValuesGroupMap(_to_consumable_array$5(manifest), function(entry) {
-        var _entry_modelGroup;
-        return (_entry_modelGroup = entry.modelGroup) !== null && _entry_modelGroup !== void 0 ? _entry_modelGroup : MODEL_INFO_UNGROUPED_LABEL;
-    });
-    var counts = [];
-    grouped.forEach(function(entries, group) {
-        counts.push({
-            modelGroup: group,
-            modelCount: entries.length
+ * @param input - The requested uid, the caller's auth, and the authorization predicate.
+ * @returns The uid to resolve as, or `undefined` to resolve as the caller.
+ * @throws {Error} When another user's uid is requested and the predicate denies (or is absent).
+ */ function resolveTargetUid(input) {
+    return _async_to_generator$6(function() {
+        var requestedUid, auth, canTargetOtherUids, result, allowed, _tmp;
+        return _ts_generator$6(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    requestedUid = input.requestedUid, auth = input.auth, canTargetOtherUids = input.canTargetOtherUids;
+                    if (!(requestedUid != null && requestedUid !== (auth === null || auth === void 0 ? void 0 : auth.uid))) return [
+                        3,
+                        4
+                    ];
+                    if (!(canTargetOtherUids == null)) return [
+                        3,
+                        1
+                    ];
+                    _tmp = false;
+                    return [
+                        3,
+                        3
+                    ];
+                case 1:
+                    return [
+                        4,
+                        canTargetOtherUids(auth)
+                    ];
+                case 2:
+                    _tmp = _state.sent();
+                    _state.label = 3;
+                case 3:
+                    allowed = _tmp;
+                    if (!allowed) {
+                        throw new Error("model-roles: resolving roles for another user's uid requires elevated access.");
+                    }
+                    result = requestedUid;
+                    _state.label = 4;
+                case 4:
+                    return [
+                        2,
+                        result
+                    ];
+            }
         });
-    });
-    counts.sort(function(a, b) {
-        return b.modelCount - a.modelCount || a.modelGroup.localeCompare(b.modelGroup);
-    });
-    return counts;
+    })();
 }
-function findGroupCount(query, manifest) {
-    var lower = query.toLowerCase();
-    var result;
-    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-    try {
-        for(var _iterator = computeGroupCounts(manifest)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var count = _step.value;
-            if (count.modelGroup.toLowerCase() === lower) {
-                result = count;
-                break;
-            }
-        }
-    } catch (err) {
-        _didIteratorError = true;
-        _iteratorError = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion && _iterator.return != null) {
-                _iterator.return();
-            }
-        } finally{
-            if (_didIteratorError) {
-                throw _iteratorError;
-            }
-        }
+function parseModelRolesInput(args) {
+    var modelType = args['modelType'];
+    var keys = args['keys'];
+    var uid = args['uid'];
+    if (typeof modelType !== 'string' || modelType.length === 0) {
+        throw new Error('model-roles: "modelType" is required and must be a non-empty string.');
     }
-    return result;
-}
-function buildModelNotFoundMessage(query, manifest) {
-    var groupMatch = findGroupCount(query, manifest);
-    var message;
-    if (groupMatch == null) {
-        message = 'model-info: no exact match for "'.concat(query, '". Call `model-info` with no arguments to list groups, or pass all:true for the full catalog.');
-    } else {
-        var plural = groupMatch.modelCount === 1 ? '' : 's';
-        message = 'model-info: no exact match for "'.concat(query, '" — did you mean group:"').concat(groupMatch.modelGroup, '" (').concat(groupMatch.modelCount, " model").concat(plural, ')? Use modelGroup:"').concat(groupMatch.modelGroup, '", or all:true for everything.');
+    if (!Array.isArray(keys) || keys.length === 0) {
+        throw new Error('model-roles: "keys" is required and must be a non-empty array.');
     }
-    return message;
-}
-function buildUnknownGroupMessage(group, manifest) {
-    var available = computeGroupCounts(manifest).map(function(count) {
-        return "".concat(count.modelGroup, " (").concat(count.modelCount, ")");
-    }).join(', ');
-    return 'model-info: no model group matches "'.concat(group, '". Available groups: ').concat(available || '(none)', ". Call `model-info` with no arguments to list groups.");
+    if (keys.length > MCP_MODEL_ROLES_MAX_KEYS) {
+        throw new Error("model-roles: at most ".concat(MCP_MODEL_ROLES_MAX_KEYS, " keys may be resolved per call (received ").concat(keys.length, ")."));
+    }
+    if (uid !== undefined && (typeof uid !== 'string' || uid.length === 0)) {
+        throw new Error('model-roles: "uid" must be a non-empty string when provided.');
+    }
+    var normalizedKeys = keys.map(function(value, index) {
+        if (typeof value !== 'string' || value.length === 0) {
+            throw new Error("model-roles: keys[".concat(index, "] must be a non-empty string."));
+        }
+        return value;
+    });
+    return _object_spread$6({
+        modelType: modelType,
+        keys: normalizedKeys
+    }, uid === undefined ? {} : {
+        uid: uid
+    });
 }
-/**
- * Resolves a manifest entry by `modelType`, `identityConst`, or `collectionPrefix`.
- *
- * @param query - Identifier to look up.
- * @param manifest - Model manifest to search.
- * @returns The matching entry or `undefined`.
- *
- * @__NO_SIDE_EFFECTS__
- */ function findModelEntry(query, manifest) {
-    var result;
+function resolveKeys(keys, identity) {
+    var isRoot = identity.type === 'root';
+    var resolved = [];
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
-        for(var _iterator = manifest[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var entry = _step.value;
-            if (entry.modelType === query || entry.identityConst === query || entry.collectionPrefix === query) {
-                result = entry;
-                break;
+        for(var _iterator = keys[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var value = _step.value;
+            if (value.includes('/')) {
+                resolved.push(value);
+            } else if (isRoot) {
+                resolved.push("".concat(identity.collectionName, "/").concat(value));
+            } else {
+                throw new Error('model-roles: modelType "'.concat(identity.modelType, '" is a subcollection; bare ids are not allowed. Provide full keys (e.g. "parentPrefix/parentId/').concat(identity.collectionName, "/").concat(value, '").'));
             }
         }
     } catch (err) {
@@ -3302,290 +3541,111 @@ function buildUnknownGroupMessage(group, manifest) {
             }
         }
     }
-    return result;
+    return resolved;
 }
 // MARK: Schemas
-var MODEL_INFO_INPUT_SCHEMA = {
-    type: 'object',
-    properties: {
-        model: {
-            description: 'One model (string) or many (string array), each matched by modelType, identityConst, or collectionPrefix. A string → `mode:"single"`; an array → `mode:"multiple"`. Misses are reported in `notFound`.',
-            oneOf: [
-                {
-                    type: 'string',
-                    minLength: 1
-                },
-                {
-                    type: 'array',
-                    minItems: 1,
-                    items: {
-                        type: 'string',
-                        minLength: 1
-                    }
-                }
-            ]
-        },
-        modelGroup: {
-            type: 'string',
-            minLength: 1,
-            description: 'Return the summary list of models in this group (`mode:"list"`). Matched case-insensitively.'
-        },
-        all: {
-            type: 'boolean',
-            description: 'Opt in to the full catalog summary (every model). Never the default — omit to get groups instead.'
-        },
-        fields: {
-            type: 'boolean',
-            description: 'Force (true) or suppress (false) full persisted-field detail. Defaults to summary rows for list mode and full entries for single/multiple modes.'
-        }
-    },
-    additionalProperties: false
-};
-// Shared item schema for model-bearing rows. Required props cover the summary form; full entries
-// add `fields`, `sourceFile`, and `serviceFactory` (allowed as additional properties).
-var MODEL_ROW_SCHEMA = {
-    type: 'object',
-    required: [
-        'modelType',
-        'modelName',
-        'identityConst',
-        'collectionPrefix',
-        'sourcePackage'
-    ],
-    properties: {
-        modelType: {
-            type: 'string'
-        },
-        modelName: {
-            type: 'string'
-        },
-        modelGroup: {
-            type: 'string'
-        },
-        identityConst: {
-            type: 'string'
-        },
-        collectionPrefix: {
-            type: 'string'
-        },
-        parentIdentityConst: {
-            type: 'string'
-        },
-        sourcePackage: {
-            type: 'string'
-        },
-        sourceFile: {
-            type: 'string'
-        },
-        fieldCount: {
-            type: 'integer'
-        },
-        description: {
-            type: 'string'
-        },
-        read: {
-            type: 'string',
-            enum: [
-                'system',
-                'owner',
-                'admin-only',
-                'permissions'
-            ]
-        },
-        serviceFactoryExport: {
-            type: 'string'
-        },
-        fields: {
-            type: 'array',
-            items: {
-                type: 'object'
-            }
-        },
-        serviceFactory: {
-            type: 'object',
-            required: [
-                'exportName',
-                'sourceFile'
-            ],
-            properties: {
-                exportName: {
-                    type: 'string'
-                },
-                sourceFile: {
-                    type: 'string'
-                }
-            }
-        }
-    }
-};
-/**
- * JSON-schema for one enum value→label table. Shared with the `enum-info` tool so both advertise the
- * identical enum shape.
- */ var ENUM_TABLE_SCHEMA = {
-    type: 'object',
-    required: [
-        'name',
-        'values'
-    ],
-    properties: {
-        name: {
-            type: 'string'
-        },
-        description: {
-            type: 'string'
-        },
-        values: {
-            type: 'array',
-            items: {
-                type: 'object',
-                required: [
-                    'name',
-                    'value'
-                ],
-                properties: {
-                    name: {
-                        type: 'string'
-                    },
-                    value: {
-                        type: [
-                            'string',
-                            'number'
-                        ]
-                    },
-                    description: {
-                        type: 'string'
-                    }
-                }
+var MODEL_ROLES_INPUT_SCHEMA = {
+    type: 'object',
+    required: [
+        'modelType',
+        'keys'
+    ],
+    properties: {
+        modelType: {
+            type: 'string',
+            minLength: 1,
+            description: 'Firestore model type to resolve roles on (e.g. "guestbook", "profile").'
+        },
+        keys: {
+            type: 'array',
+            minItems: 1,
+            maxItems: MCP_MODEL_ROLES_MAX_KEYS,
+            description: 'Full keys ("prefix/id") or bare ids (root models only).',
+            items: {
+                type: 'string',
+                minLength: 1
             }
+        },
+        uid: {
+            type: 'string',
+            minLength: 1,
+            description: 'Resolve roles as this user instead of the caller. Requires elevated access; passing your own uid is always allowed.'
         }
-    }
+    },
+    additionalProperties: false
 };
-// MCP's `tools/list` validator requires `outputSchema.type === 'object'` at the root
-// (see the MCP SDK's `ToolSchema`), so the variants are expressed via a top-level
-// object whose nested `oneOf` discriminates by the `mode` literal.
-var MODEL_INFO_OUTPUT_SCHEMA = {
+var MODEL_ROLES_OUTPUT_SCHEMA = {
     type: 'object',
     required: [
-        'mode'
+        'targeted',
+        'results',
+        'errors'
     ],
-    description: 'Discriminated by `mode`: `groups` (default model groups + counts), `list` (summary/full list for `modelGroup` or `all`), `single` (one `model`), or `multiple` (a `model` array, with misses in `notFound`).',
     properties: {
-        mode: {
+        uid: {
             type: 'string',
-            enum: [
-                'groups',
-                'list',
-                'single',
-                'multiple'
-            ]
+            description: 'The uid the roles were resolved for.'
         },
-        groups: {
+        targeted: {
+            type: 'boolean',
+            description: 'True when the roles were resolved for a user other than the caller.'
+        },
+        results: {
             type: 'array',
-            description: 'Present when `mode` is `"groups"`. One entry per model group.',
+            description: 'Per-key resolved permission state.',
             items: {
                 type: 'object',
                 required: [
-                    'modelGroup',
-                    'modelCount'
+                    'key',
+                    'exists',
+                    'fullAccess',
+                    'roles'
                 ],
                 properties: {
-                    modelGroup: {
+                    key: {
                         type: 'string'
                     },
-                    modelCount: {
-                        type: 'integer'
+                    exists: {
+                        type: 'boolean',
+                        description: 'Whether the document exists. Roles are only computed for documents that exist.'
+                    },
+                    fullAccess: {
+                        type: 'boolean',
+                        description: 'True when the full-access marker was granted; every role is implicitly held and "roles" is empty.'
+                    },
+                    roles: {
+                        type: 'array',
+                        items: {
+                            type: 'string'
+                        },
+                        description: 'Granted role names, sorted.'
                     }
                 }
             }
         },
-        totalModels: {
-            type: 'integer',
-            description: 'Present when `mode` is `"groups"`. Total models across all groups.'
-        },
-        hint: {
-            type: 'string',
-            description: 'Present when `mode` is `"groups"`. Guidance on how to drill into the catalog.'
-        },
-        models: {
-            type: 'array',
-            description: 'Present when `mode` is `"list"` or `"multiple"`. Summary rows by default; full entries when `fields` requests detail.',
-            items: MODEL_ROW_SCHEMA
-        },
-        modelGroup: {
-            type: 'string',
-            description: 'Present when `mode` is `"list"` from a `modelGroup` filter. The canonical group name.'
-        },
-        model: _object_spread_props$2(_object_spread$6({}, MODEL_ROW_SCHEMA), {
-            description: 'Present when `mode` is `"single"`. The matched model entry (full detail unless `fields:false`).'
-        }),
-        notFound: {
+        errors: {
             type: 'array',
-            description: 'Present when `mode` is `"multiple"` and one or more queries matched nothing.',
+            description: 'Per-key failures. A missing document is NOT an error — it appears in results with exists:false.',
             items: {
                 type: 'object',
                 required: [
-                    'query',
+                    'key',
                     'message'
                 ],
                 properties: {
-                    query: {
+                    key: {
                         type: 'string'
                     },
                     message: {
                         type: 'string'
+                    },
+                    code: {
+                        type: 'string'
                     }
                 }
             }
-        },
-        enums: {
-            type: 'array',
-            description: 'Value→label tables for the enums referenced by the returned models’ fields. Present only when full field detail is returned (single/multiple modes, or list/all with `fields:true`) and at least one referenced enum is registered.',
-            items: ENUM_TABLE_SCHEMA
-        }
-    },
-    oneOf: [
-        {
-            required: [
-                'groups',
-                'totalModels'
-            ],
-            properties: {
-                mode: {
-                    const: 'groups'
-                }
-            }
-        },
-        {
-            required: [
-                'models'
-            ],
-            properties: {
-                mode: {
-                    const: 'list'
-                }
-            }
-        },
-        {
-            required: [
-                'model'
-            ],
-            properties: {
-                mode: {
-                    const: 'single'
-                }
-            }
-        },
-        {
-            required: [
-                'models'
-            ],
-            properties: {
-                mode: {
-                    const: 'multiple'
-                }
-            }
         }
-    ]
+    }
 };
 
 function _define_property$7(obj, key, value) {
@@ -3614,6 +3674,24 @@ function _object_spread$5(target) {
     }
     return target;
 }
+function ownKeys$2(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$2(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    else {
+        ownKeys$2(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
 // MARK: Constants
 /**
  * Reserved tool name for the built-in `model-decode` static tool.
@@ -3647,7 +3725,7 @@ function _object_spread$5(target) {
         return Promise.resolve(modelDecodeToolHandler(args, ctx, deps));
     };
     var name = MODEL_DECODE_TOOL_NAME;
-    var description = 'Decode a Firestore model key ("prefix/id", or subcollection path "parentPrefix/parentId/childPrefix/childId") into { leaf, ancestors, unresolvedPrefixes } using the registered manifest ('.concat(deps.manifest.length, " model").concat(deps.manifest.length === 1 ? '' : 's', ").");
+    var description = 'Decode a Firestore model key ("prefix/id", or subcollection path "parentPrefix/parentId/childPrefix/childId") into { leaf, ancestors, unresolvedPrefixes, derivedKeys, compositeSource? } using the registered manifest ('.concat(deps.manifest.length, " model").concat(deps.manifest.length === 1 ? '' : 's', "). `derivedKeys` lists composite-key models whose document id is a flattened form of this key, each with its ready-to-use key.");
     return buildStaticToolDefinition({
         name: name,
         description: description,
@@ -3695,18 +3773,77 @@ function parseModelDecodeInput(args) {
 }
 /**
  * Splits `rawKey` on `/`, resolves each `[prefix, id]` pair against the manifest, and
- * returns the leaf segment + ancestor chain.
+ * returns the leaf segment + ancestor chain, plus the composite-key relationships declared
+ * on the manifest: the keys of models derived from this key (`derivedKeys`) and, for a
+ * two-way composite-key leaf, the recovered source key (`compositeSource`).
  *
  * Mirrors the dbx-cli `decodeFirestoreModelKey` helper structurally; both implementations
- * must stay in lockstep on segment count and resolution order.
+ * must stay in lockstep on segment count, resolution order, and composite-key output.
  *
  * @param rawKey - The Firestore key string.
  * @param manifest - The model manifest.
- * @returns The decoded key with leaf, ancestors, and any unresolved prefixes.
+ * @returns The decoded key with leaf, ancestors, unresolved prefixes, and composite-key relationships.
  * @throws {Error} When `rawKey` is empty or does not parse into an even number of `prefix/id` segments.
  *
  * @__NO_SIDE_EFFECTS__
  */ function decodeFirestoreModelKey(rawKey, manifest) {
+    var _leafEntry_compositeKey;
+    var segments = decodeFirestoreModelKeySegments(rawKey, manifest);
+    var leafEntry = segments.leaf.modelType == null ? undefined : findModelEntry(segments.leaf.prefix, manifest);
+    var derivedKeys = leafEntry == null ? [] : findCompositeKeyModelsDerivedFrom(leafEntry, manifest).map(function(entry) {
+        return toDerivedCompositeKey(segments.key, entry);
+    });
+    var compositeSource = (leafEntry === null || leafEntry === void 0 ? void 0 : (_leafEntry_compositeKey = leafEntry.compositeKey) === null || _leafEntry_compositeKey === void 0 ? void 0 : _leafEntry_compositeKey.encoding) === 'two-way' ? decodeTwoWayCompositeSource(segments.leaf.id, manifest) : undefined;
+    return _object_spread$5(_object_spread_props$2(_object_spread$5({}, segments), {
+        derivedKeys: derivedKeys
+    }), compositeSource == null ? {} : {
+        compositeSource: compositeSource
+    });
+}
+function toDerivedCompositeKey(sourceKey, entry) {
+    var _ref;
+    var _entry_compositeKey;
+    var encoding = (_ref = (_entry_compositeKey = entry.compositeKey) === null || _entry_compositeKey === void 0 ? void 0 : _entry_compositeKey.encoding) !== null && _ref !== void 0 ? _ref : 'one-way';
+    var flatId = encoding === 'two-way' ? twoWayFlatFirestoreModelKey(sourceKey) : flatFirestoreModelKey(sourceKey);
+    return {
+        key: "".concat(entry.collectionPrefix, "/").concat(flatId),
+        modelType: entry.modelType,
+        modelName: entry.modelName,
+        collectionPrefix: entry.collectionPrefix,
+        encoding: encoding
+    };
+}
+/**
+ * Recovers and decodes the source key behind a two-way flattened id.
+ *
+ * @param flatId - The leaf document id of a two-way composite-key model.
+ * @param manifest - The model manifest.
+ * @returns The decoded source key, or `undefined` when the id does not contain a separator or does
+ *   not recover to an even number of segments — it was not produced by `twoWayFlatFirestoreModelKey`.
+ */ function decodeTwoWayCompositeSource(flatId, manifest) {
+    var result;
+    if (flatId.includes('_')) {
+        var sourceKey = inferKeyFromTwoWayFlatFirestoreModelKey(flatId);
+        var segmentCount = sourceKey.split('/').filter(function(s) {
+            return s.length > 0;
+        }).length;
+        if (segmentCount >= 2 && segmentCount % 2 === 0) {
+            result = decodeFirestoreModelKeySegments(sourceKey, manifest);
+        }
+    }
+    return result;
+}
+/**
+ * Splits `rawKey` on `/` and resolves each `[prefix, id]` pair against the manifest — the segment
+ * walk shared by {@link decodeFirestoreModelKey} and the two-way composite-source decode.
+ *
+ * @param rawKey - The Firestore key string.
+ * @param manifest - The model manifest.
+ * @returns The decoded key with leaf, ancestors, and any unresolved prefixes.
+ * @throws {Error} When `rawKey` is empty or does not parse into an even number of `prefix/id` segments.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function decodeFirestoreModelKeySegments(rawKey, manifest) {
     var trimmed = rawKey.trim();
     if (trimmed.length === 0) {
         throw new Error('model-decode: key is empty. Provide a Firestore key like `sf/abc123`.');
@@ -3807,34 +3944,86 @@ var SEGMENT_SCHEMA = {
         }
     }
 };
-var MODEL_DECODE_OUTPUT_SCHEMA = {
+var DECODED_SEGMENTS_PROPERTIES = {
+    key: {
+        type: 'string',
+        description: 'The trimmed input key.'
+    },
+    leaf: SEGMENT_SCHEMA,
+    ancestors: {
+        type: 'array',
+        description: 'Parent segments, root-first.',
+        items: SEGMENT_SCHEMA
+    },
+    unresolvedPrefixes: {
+        type: 'array',
+        description: 'Prefixes that did not match any model in the manifest.',
+        items: {
+            type: 'string'
+        }
+    }
+};
+var DERIVED_KEY_SCHEMA = {
     type: 'object',
     required: [
         'key',
-        'leaf',
-        'ancestors',
-        'unresolvedPrefixes'
+        'modelType',
+        'modelName',
+        'collectionPrefix',
+        'encoding'
     ],
     properties: {
         key: {
             type: 'string',
-            description: 'The trimmed input key.'
+            description: 'Ready-to-use key of the derived document (`<collectionPrefix>/<flattened source key>`).'
         },
-        leaf: SEGMENT_SCHEMA,
-        ancestors: {
-            type: 'array',
-            description: 'Parent segments, root-first.',
-            items: SEGMENT_SCHEMA
+        modelType: {
+            type: 'string'
         },
-        unresolvedPrefixes: {
-            type: 'array',
-            description: 'Prefixes that did not match any model in the manifest.',
-            items: {
-                type: 'string'
-            }
+        modelName: {
+            type: 'string'
+        },
+        collectionPrefix: {
+            type: 'string'
+        },
+        encoding: {
+            type: 'string',
+            enum: [
+                'one-way',
+                'two-way'
+            ],
+            description: 'Flat-key encoding: `one-way` strips slashes, `two-way` replaces them with underscores.'
         }
     }
 };
+var MODEL_DECODE_OUTPUT_SCHEMA = {
+    type: 'object',
+    required: [
+        'key',
+        'leaf',
+        'ancestors',
+        'unresolvedPrefixes',
+        'derivedKeys'
+    ],
+    properties: _object_spread_props$2(_object_spread$5({}, DECODED_SEGMENTS_PROPERTIES), {
+        derivedKeys: {
+            type: 'array',
+            description: 'Composite-key models whose document id is derived from this key (from `@dbxModelCompositeKey`), each with its ready-to-use key. Empty when none apply.',
+            items: DERIVED_KEY_SCHEMA
+        },
+        compositeSource: {
+            type: 'object',
+            description: 'When the leaf is a two-way composite-key model, the source key recovered from its id, decoded. Absent otherwise.',
+            required: [
+                'key',
+                'leaf',
+                'ancestors',
+                'unresolvedPrefixes'
+            ],
+            properties: DECODED_SEGMENTS_PROPERTIES
+        }
+    })
+};
 
 // MARK: Constants
 /**
@@ -4722,21 +4911,35 @@ function cliTokenToolHandler(args, ctx, deps) {
         });
     })();
 }
-function buildOutput(minted) {
+/**
+ * Renders the tool's output, including the command the target machine runs verbatim.
+ *
+ * `--env` is appended whenever the mint supplied an `envName`. Without it the rendered command is
+ * only correct on a machine that already has the right env ACTIVE — `auth handoff` takes the issuer
+ * to redeem against from the active env, so a bare machine fails `AUTH_HANDOFF_NO_ISSUER` and a
+ * machine pointed at another env sends the claim to the wrong issuer. Naming the env also
+ * instantiates it from its built-in default template, which a name alone does not do.
+ *
+ * @param minted - The mint result from the app-supplied minter.
+ * @returns The tool output payload.
+ */ function buildOutput(minted) {
     var _minted_cliName;
     var cliName = (_minted_cliName = minted.cliName) !== null && _minted_cliName !== void 0 ? _minted_cliName : '<cli>';
+    var envArgument = minted.envName == null ? '' : " --env ".concat(minted.envName);
     return _object_spread$3({
         claimCode: minted.claimCode,
         claimExpiresAt: minted.claimExpiresAt,
         expiresAt: minted.expiresAt,
         scope: minted.scope,
-        handoffCommand: "".concat(cliName, " auth handoff ").concat(minted.claimCode)
+        handoffCommand: "".concat(cliName, " auth handoff ").concat(minted.claimCode).concat(envArgument)
     }, minted.cliName == null ? {} : {
         cliName: minted.cliName
     }, minted.downloadUrl == null ? {} : {
         downloadUrl: minted.downloadUrl
     }, minted.downloadSha256 == null ? {} : {
         downloadSha256: minted.downloadSha256
+    }, minted.envName == null ? {} : {
+        envName: minted.envName
     });
 }
 // Reads the optional `scopes` input as a string array, ignoring anything that is not a non-empty string.
@@ -4827,6 +5030,9 @@ var CLI_TOKEN_OUTPUT_SCHEMA = {
         downloadSha256: {
             type: 'string'
         },
+        envName: {
+            type: 'string'
+        },
         handoffCommand: {
             type: 'string'
         }
@@ -7197,15 +7403,19 @@ var McpServerFactoryService_1;
                     this._resolveManifest();
                     var staticTools = [];
                     var getService = this.modelApiGetService;
+                    var modelManifest = this._cachedManifestModels;
+                    var enumManifest = this._cachedManifestEnums;
                     if (getService != null) {
-                        staticTools.push(createModelGetTool({
+                        staticTools.push(createModelGetTool(_object_spread$1({
                             readDocuments: function readDocuments(modelType, keys, auth) {
                                 return getService.readDocuments(modelType, keys, auth);
                             },
                             resolveIdentity: function resolveIdentity(modelType, auth) {
                                 return getService.getModelIdentity(modelType, auth);
                             }
-                        }), createModelRolesTool({
+                        }, modelManifest == null ? {} : {
+                            manifest: modelManifest
+                        })), createModelRolesTool({
                             readRoleMaps: function readRoleMaps(params) {
                                 return getService.readRoleMaps(params);
                             },
@@ -7229,8 +7439,6 @@ var McpServerFactoryService_1;
                             }));
                         }
                     }
-                    var modelManifest = this._cachedManifestModels;
-                    var enumManifest = this._cachedManifestEnums;
                     if (modelManifest != null && modelManifest.length > 0) {
                         staticTools.push(createModelInfoTool(_object_spread$1({
                             manifest: modelManifest
@@ -9020,4 +9228,4 @@ function _unsupported_iterable_to_array(o, minLen) {
     };
 }
 
-export { BATCH_EXECUTE_DISPATCH_CALL, BATCH_EXECUTE_DISPATCH_MODEL_TYPE, BATCH_EXECUTE_TOOL_NAME, CLI_TOKEN_DISPATCH_CALL, CLI_TOKEN_DISPATCH_MODEL_TYPE, CLI_TOKEN_TOOL_NAME, DEFAULT_BATCH_EXECUTE_MAX_PARALLEL, DEFAULT_JSON_SCHEMA_GENERATION_OPTIONS, DEFAULT_MCP_ANALYTICS_EVENT_NAME, DEFAULT_MCP_PATH, DEFAULT_MCP_REASON_PARAMETER_DESCRIPTION, DEFAULT_MCP_REASON_PARAMETER_MAX_LENGTH, DEFAULT_MCP_REASON_PARAMETER_NAME, DEFAULT_MCP_REASON_PARAMETER_REQUIRED, DEFAULT_MCP_SERVER_INSTRUCTIONS, DEFAULT_MCP_SERVER_NAME, DEFAULT_SPECIFIER_KEY, DEFAULT_VOID_MCP_SUCCESS_VALUE, ENUM_INFO_DISPATCH_CALL, ENUM_INFO_DISPATCH_MODEL_TYPE, ENUM_INFO_TOOL_NAME, ENUM_TABLE_SCHEMA, FIREBASE_SERVER_MCP_ANALYTICS_CONFIG, FIREBASE_SERVER_MCP_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, FirebaseServerMcpAnalyticsService, MAX_BATCH_EXECUTE_FILE_BYTES, MAX_BATCH_EXECUTE_OPERATIONS, MCP_ANALYTICS_SERVICE, MCP_AUTH_ROLE_READER, MCP_CALL_TYPE_ABBREVIATIONS, MCP_CLI_TOKEN_MINTER, MCP_MANIFEST_VERSION, MCP_MODEL_GET_BATCH_SIZE, MCP_MODEL_ROLES_MAX_KEYS, MCP_MODEL_ROLES_TARGET_UID_PREDICATE, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MCP_WRITE_TOOL_DESCRIPTION_PREFIX, MODEL_DECODE_DISPATCH_CALL, MODEL_DECODE_DISPATCH_MODEL_TYPE, MODEL_DECODE_TOOL_NAME, MODEL_GET_DISPATCH_CALL, MODEL_GET_DISPATCH_MODEL_TYPE, MODEL_GET_TOOL_NAME, MODEL_INFO_DISPATCH_CALL, MODEL_INFO_DISPATCH_MODEL_TYPE, MODEL_INFO_GROUPS_HINT, MODEL_INFO_TOOL_NAME, MODEL_INFO_UNGROUPED_LABEL, MODEL_ROLES_DISPATCH_CALL, MODEL_ROLES_DISPATCH_MODEL_TYPE, MODEL_ROLES_TOOL_NAME, McpAnalyticsService, McpController, McpModuleConfig, McpServerFactoryService, McpWellKnownController, ROUTE_MANIFEST_VERSION, URL_MODELS_DISPATCH_CALL, URL_MODELS_DISPATCH_MODEL_TYPE, URL_MODELS_TOOL_NAME, abbreviateMcpCallType, appMcpAnalyticsModuleMetadata, applyMcpReasonParameterToSchema, applyWriteMarker, batchOperationCoordKey, buildDefaultMcpToolDescription, buildDisambiguatedMcpToolName, buildMcpToolName, buildStaticToolDefinition, buildStaticWireEntry, classifyVisibility, createBatchExecuteTool, createCliTokenTool, createEnumInfoTool, createModelDecodeTool, createModelGetTool, createModelInfoTool, createModelRolesTool, createUrlModelsTool, decodeFirestoreModelKey, extractMcpReasonFromArgs, findModelEntry, formatMcpToolErrorResponse, formatMcpToolResponse, generateMcpToolDefinitions, handleStreamableHttpMcpRequest, matchRouteManifestUrl, mcpManifestKey, mcpModuleMetadata, mcpSchemaDeclaresProperty, noopMcpAnalyticsService, parseUrlModelsPathname, readUrlModelsImpersonationUid, resolveEffectiveReadOnly, resolveEnumInfoOutput, resolveMcpReasonParameterConfig, resolveMcpToolAnnotations, resolveRequiredScope, validateMcpToolName };
+export { BATCH_EXECUTE_DISPATCH_CALL, BATCH_EXECUTE_DISPATCH_MODEL_TYPE, BATCH_EXECUTE_TOOL_NAME, CLI_TOKEN_DISPATCH_CALL, CLI_TOKEN_DISPATCH_MODEL_TYPE, CLI_TOKEN_TOOL_NAME, DEFAULT_BATCH_EXECUTE_MAX_PARALLEL, DEFAULT_JSON_SCHEMA_GENERATION_OPTIONS, DEFAULT_MCP_ANALYTICS_EVENT_NAME, DEFAULT_MCP_PATH, DEFAULT_MCP_REASON_PARAMETER_DESCRIPTION, DEFAULT_MCP_REASON_PARAMETER_MAX_LENGTH, DEFAULT_MCP_REASON_PARAMETER_NAME, DEFAULT_MCP_REASON_PARAMETER_REQUIRED, DEFAULT_MCP_SERVER_INSTRUCTIONS, DEFAULT_MCP_SERVER_NAME, DEFAULT_SPECIFIER_KEY, DEFAULT_VOID_MCP_SUCCESS_VALUE, ENUM_INFO_DISPATCH_CALL, ENUM_INFO_DISPATCH_MODEL_TYPE, ENUM_INFO_TOOL_NAME, ENUM_TABLE_SCHEMA, FIREBASE_SERVER_MCP_ANALYTICS_CONFIG, FIREBASE_SERVER_MCP_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, FirebaseServerMcpAnalyticsService, MAX_BATCH_EXECUTE_FILE_BYTES, MAX_BATCH_EXECUTE_OPERATIONS, MCP_ANALYTICS_SERVICE, MCP_AUTH_ROLE_READER, MCP_CALL_TYPE_ABBREVIATIONS, MCP_CLI_TOKEN_MINTER, MCP_MANIFEST_VERSION, MCP_MODEL_GET_BATCH_SIZE, MCP_MODEL_ROLES_MAX_KEYS, MCP_MODEL_ROLES_TARGET_UID_PREDICATE, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MCP_WRITE_TOOL_DESCRIPTION_PREFIX, MODEL_DECODE_DISPATCH_CALL, MODEL_DECODE_DISPATCH_MODEL_TYPE, MODEL_DECODE_TOOL_NAME, MODEL_GET_DISPATCH_CALL, MODEL_GET_DISPATCH_MODEL_TYPE, MODEL_GET_TOOL_NAME, MODEL_INFO_DISPATCH_CALL, MODEL_INFO_DISPATCH_MODEL_TYPE, MODEL_INFO_GROUPS_HINT, MODEL_INFO_TOOL_NAME, MODEL_INFO_UNGROUPED_LABEL, MODEL_ROLES_DISPATCH_CALL, MODEL_ROLES_DISPATCH_MODEL_TYPE, MODEL_ROLES_TOOL_NAME, McpAnalyticsService, McpController, McpModuleConfig, McpServerFactoryService, McpWellKnownController, ROUTE_MANIFEST_VERSION, URL_MODELS_DISPATCH_CALL, URL_MODELS_DISPATCH_MODEL_TYPE, URL_MODELS_TOOL_NAME, abbreviateMcpCallType, appMcpAnalyticsModuleMetadata, applyMcpReasonParameterToSchema, applyWriteMarker, batchOperationCoordKey, buildDefaultMcpToolDescription, buildDisambiguatedMcpToolName, buildMcpToolName, buildStaticToolDefinition, buildStaticWireEntry, classifyVisibility, createBatchExecuteTool, createCliTokenTool, createEnumInfoTool, createModelDecodeTool, createModelGetTool, createModelInfoTool, createModelRolesTool, createUrlModelsTool, decodeFirestoreModelKey, decodeFirestoreModelKeySegments, extractMcpReasonFromArgs, findCompositeKeyModelsDerivedFrom, findModelEntry, formatMcpToolErrorResponse, formatMcpToolResponse, generateMcpToolDefinitions, handleStreamableHttpMcpRequest, isCompositeKeyModelDerivedFrom, matchRouteManifestUrl, mcpManifestKey, mcpModuleMetadata, mcpSchemaDeclaresProperty, noopMcpAnalyticsService, parseUrlModelsPathname, readUrlModelsImpersonationUid, resolveEffectiveReadOnly, resolveEnumInfoOutput, resolveMcpReasonParameterConfig, resolveMcpToolAnnotations, resolveRequiredScope, validateMcpToolName };