@dereekb/firebase 13.12.1 → 13.12.2

package/eslint/index.cjs.js

@@ -1,7 +1,9 @@
 'use strict';
 
+var node_module = require('node:module');
 var node_fs = require('node:fs');
 var node_path = require('node:path');
+var typescriptEstree = require('@typescript-eslint/typescript-estree');
 var parser = require('@typescript-eslint/parser');
 
 /**
@@ -243,15 +245,15 @@ var parser = require('@typescript-eslint/parser');
     description: 'Reject function signatures with more than four positional parameters; require a single config object.'
 });
 
-function _array_like_to_array$f(arr, len) {
+function _array_like_to_array$h(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$9(arr) {
+function _array_with_holes$a(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _iterable_to_array_limit$9(arr, i) {
+function _iterable_to_array_limit$a(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -275,19 +277,19 @@ function _iterable_to_array_limit$9(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$9() {
+function _non_iterable_rest$a() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$9(arr, i) {
-    return _array_with_holes$9(arr) || _iterable_to_array_limit$9(arr, i) || _unsupported_iterable_to_array$f(arr, i) || _non_iterable_rest$9();
+function _sliced_to_array$a(arr, i) {
+    return _array_with_holes$a(arr) || _iterable_to_array_limit$a(arr, i) || _unsupported_iterable_to_array$h(arr, i) || _non_iterable_rest$a();
 }
-function _unsupported_iterable_to_array$f(o, minLen) {
+function _unsupported_iterable_to_array$h(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$f(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$h(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$f(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$h(o, minLen);
 }
 var TAG_LINE_REGEX = /^@([A-Za-z_]\w*)\s*(.*)$/;
 var TYPE_ANNOTATION_REGEX = /^\{([^}]*)\}\s*(.*)$/;
@@ -343,19 +345,28 @@ var LINE_PREFIX_REGEX = /^(\s*\*?\s?)(.*)$/;
     });
 }
 /**
- * Returns the index of the first line that begins with a JSDoc `@tag`, or `-1` when none exists.
+ * Computes, per line, whether it sits inside a fenced code block (a ```` ``` ```` block, typically
+ * an `@example` body) and therefore must not be treated as a tag boundary. Fence delimiter lines
+ * themselves are flagged too. Without this, `@`-prefixed lines inside a fence — decorators like
+ * `@Global()` / `@Module()`, or JSDoc snippets — would be mis-parsed as standalone JSDoc tags.
  *
  * @param lines - Parsed lines in source order.
- * @returns Zero-based line index of the first tag, or `-1` when no tag is present.
- */ function findFirstTagIndex(lines) {
-    var firstTagIndex = -1;
+ * @returns Boolean mask where `true` marks a line that must not start a tag.
+ */ function computeFenceMask(lines) {
+    var mask = lines.map(function() {
+        return false;
+    });
+    var fenceOpen = false;
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
         for(var _iterator = lines.entries()[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array$9(_step.value, 2), i = _step_value[0], line = _step_value[1];
-            if (TAG_LINE_REGEX.test(line.text)) {
-                firstTagIndex = i;
-                break;
+            var _step_value = _sliced_to_array$a(_step.value, 2), i = _step_value[0], line = _step_value[1];
+            var isDelimiter = line.text.trimStart().startsWith('```');
+            if (isDelimiter) {
+                mask[i] = true;
+                fenceOpen = !fenceOpen;
+            } else {
+                mask[i] = fenceOpen;
             }
         }
     } catch (err) {
@@ -372,6 +383,32 @@ var LINE_PREFIX_REGEX = /^(\s*\*?\s?)(.*)$/;
             }
         }
     }
+    return mask;
+}
+/**
+ * Returns true when the line at `index` opens a JSDoc tag and is not masked out by a code fence.
+ *
+ * @param lines - Parsed lines in source order.
+ * @param fenceMask - Mask from {@link computeFenceMask} marking fenced lines.
+ * @param index - Line index to test.
+ * @returns True when the line begins a tag that should be treated as a tag boundary.
+ */ function isTagStart(lines, fenceMask, index) {
+    return !fenceMask[index] && TAG_LINE_REGEX.test(lines[index].text);
+}
+/**
+ * Returns the index of the first line that begins with a JSDoc `@tag`, or `-1` when none exists.
+ *
+ * @param lines - Parsed lines in source order.
+ * @param fenceMask - Mask from {@link computeFenceMask} marking fenced lines.
+ * @returns Zero-based line index of the first tag, or `-1` when no tag is present.
+ */ function findFirstTagIndex(lines, fenceMask) {
+    var firstTagIndex = -1;
+    for(var i = 0; i < lines.length; i += 1){
+        if (isTagStart(lines, fenceMask, i)) {
+            firstTagIndex = i;
+            break;
+        }
+    }
     return firstTagIndex;
 }
 /**
@@ -469,15 +506,16 @@ var LINE_PREFIX_REGEX = /^(\s*\*?\s?)(.*)$/;
  * Collects the tag line at `startIndex` plus every following non-tag continuation line.
  *
  * @param lines - All parsed lines in the comment.
+ * @param fenceMask - Mask from {@link computeFenceMask} marking fenced lines.
  * @param startIndex - Index of the `@tag` opening line.
  * @returns The collected tag lines and the index of the next unconsumed line.
- */ function collectTagLines(lines, startIndex) {
+ */ function collectTagLines(lines, fenceMask, startIndex) {
     var tagLines = [
         lines[startIndex]
     ];
     var j = startIndex + 1;
     while(j < lines.length){
-        if (TAG_LINE_REGEX.test(lines[j].text)) break;
+        if (isTagStart(lines, fenceMask, j)) break;
         tagLines.push(lines[j]);
         j += 1;
     }
@@ -508,15 +546,16 @@ var LINE_PREFIX_REGEX = /^(\s*\*?\s?)(.*)$/;
  * Builds a single parsed-tag record starting at `startIndex` in the line array.
  *
  * @param lines - All parsed lines in the comment.
+ * @param fenceMask - Mask from {@link computeFenceMask} marking fenced lines.
  * @param startIndex - Index of the `@tag` opening line.
  * @returns The parsed tag and the next unconsumed line index.
- */ function parseTagAt(lines, startIndex) {
+ */ function parseTagAt(lines, fenceMask, startIndex) {
     var line = lines[startIndex];
     var match = TAG_LINE_REGEX.exec(line.text);
     var tagName = match[1];
     var _extractTypeAnnotation = extractTypeAnnotation(match[2]), type = _extractTypeAnnotation.type, afterType = _extractTypeAnnotation.rest;
     var _extractParamName = extractParamName(tagName, afterType), name = _extractParamName.name, afterName = _extractParamName.rest;
-    var _collectTagLines = collectTagLines(lines, startIndex), tagLines = _collectTagLines.tagLines, nextIndex = _collectTagLines.nextIndex;
+    var _collectTagLines = collectTagLines(lines, fenceMask, startIndex), tagLines = _collectTagLines.tagLines, nextIndex = _collectTagLines.nextIndex;
     var description = buildTagDescription(afterName, tagLines);
     return {
         tag: {
@@ -535,18 +574,19 @@ var LINE_PREFIX_REGEX = /^(\s*\*?\s?)(.*)$/;
  * Parses every `@tag` block starting from `firstTagIndex` to the end of the line array.
  *
  * @param lines - All parsed lines in the comment.
+ * @param fenceMask - Mask from {@link computeFenceMask} marking fenced lines.
  * @param firstTagIndex - Index where tag parsing should begin (`-1` skips entirely).
  * @returns All parsed tags in source order.
- */ function parseTags(lines, firstTagIndex) {
+ */ function parseTags(lines, fenceMask, firstTagIndex) {
     var tags = [];
     if (firstTagIndex !== -1) {
         var i = firstTagIndex;
         while(i < lines.length){
-            if (!TAG_LINE_REGEX.test(lines[i].text)) {
+            if (!isTagStart(lines, fenceMask, i)) {
                 i += 1;
                 continue;
             }
-            var _parseTagAt = parseTagAt(lines, i), tag = _parseTagAt.tag, nextIndex = _parseTagAt.nextIndex;
+            var _parseTagAt = parseTagAt(lines, fenceMask, i), tag = _parseTagAt.tag, nextIndex = _parseTagAt.nextIndex;
             tags.push(tag);
             i = nextIndex;
         }
@@ -570,14 +610,15 @@ var LINE_PREFIX_REGEX = /^(\s*\*?\s?)(.*)$/;
  */ function parseJsdocComment(commentValue) {
     var singleLine = !commentValue.includes('\n');
     var lines = buildParsedLines(commentValue);
-    var firstTagIndex = findFirstTagIndex(lines);
+    var fenceMask = computeFenceMask(lines);
+    var firstTagIndex = findFirstTagIndex(lines, fenceMask);
     var descriptionLines = firstTagIndex === -1 ? lines.slice() : lines.slice(0, firstTagIndex);
     var trimmedDescription = trimBlankBoundaries(descriptionLines);
     var description = trimmedDescription.map(function(l) {
         return l.text;
     }).join('\n');
     var descriptionParagraphs = buildDescriptionParagraphs(trimmedDescription);
-    var tags = parseTags(lines, firstTagIndex);
+    var tags = parseTags(lines, fenceMask, firstTagIndex);
     return {
         lines: lines,
         descriptionLines: descriptionLines,
@@ -597,15 +638,15 @@ var LINE_PREFIX_REGEX = /^(\s*\*?\s?)(.*)$/;
  * companions are required/optional, what value format each accepts, and which
  * messageId to emit when a check fails. The rule body itself only wires the
  * visitors and message map; all value-format validation lives here.
- */ function _array_like_to_array$e(arr, len) {
+ */ function _array_like_to_array$g(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$8(arr) {
+function _array_with_holes$9(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _iterable_to_array_limit$8(arr, i) {
+function _iterable_to_array_limit$9(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -629,19 +670,19 @@ function _iterable_to_array_limit$8(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$8() {
+function _non_iterable_rest$9() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$8(arr, i) {
-    return _array_with_holes$8(arr) || _iterable_to_array_limit$8(arr, i) || _unsupported_iterable_to_array$e(arr, i) || _non_iterable_rest$8();
+function _sliced_to_array$9(arr, i) {
+    return _array_with_holes$9(arr) || _iterable_to_array_limit$9(arr, i) || _unsupported_iterable_to_array$g(arr, i) || _non_iterable_rest$9();
 }
-function _unsupported_iterable_to_array$e(o, minLen) {
+function _unsupported_iterable_to_array$g(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$e(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$g(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$e(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$g(o, minLen);
 }
 /**
  * Kebab-case slug pattern: lowercase letters/digits, words separated by single hyphens,
@@ -915,7 +956,7 @@ function emitUnknownCompanions(groups, knownSuffixes, emit) {
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
         for(var _iterator = groups.entries()[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var _step_value = _sliced_to_array$8(_step.value, 2), suffix = _step_value[0], instances = _step_value[1];
+            var _step_value = _sliced_to_array$9(_step.value, 2), suffix = _step_value[0], instances = _step_value[1];
             if (knownSuffixes.has(suffix)) continue;
             var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
             try {
@@ -1089,34 +1130,137 @@ function checkCompanion(input) {
     return result;
 }
 
-function _array_like_to_array$d(arr, len) {
+function _array_like_to_array$f(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$9(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$d(arr);
+function _array_without_holes$a(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$f(arr);
 }
-function _iterable_to_array$9(iter) {
+function _iterable_to_array$a(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$9() {
+function _non_iterable_spread$a() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$9(arr) {
-    return _array_without_holes$9(arr) || _iterable_to_array$9(arr) || _unsupported_iterable_to_array$d(arr) || _non_iterable_spread$9();
+function _to_consumable_array$a(arr) {
+    return _array_without_holes$a(arr) || _iterable_to_array$a(arr) || _unsupported_iterable_to_array$f(arr) || _non_iterable_spread$a();
 }
-function _unsupported_iterable_to_array$d(o, minLen) {
+function _unsupported_iterable_to_array$f(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$d(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$f(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$d(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$f(o, minLen);
 }
 /**
  * Module that publishes the `@dereekb/firebase` Firestore constraint factories (`where`, `orderBy`, etc.).
  */ var FIREBASE_MODULE = '@dereekb/firebase';
+/**
+ * Subpath, relative to the `@dereekb/firebase` package root, where the framework Firestore model
+ * declarations live (`firestoreModelIdentity(...)` calls in source, identity type-annotations in the
+ * shipped `.d.ts`).
+ */ var FIREBASE_MODEL_SUBPATH = node_path.join('src', 'lib', 'model');
+var installedFirebaseModelDirCache = new Map();
+/**
+ * Directory names the layout-agnostic discovery globs never descend into: installed dependencies
+ * and build/cache output. Excluding these keeps a broad `**\/*.ts` scan from walking a downstream
+ * consumer's `node_modules` (which can hold tens of thousands of declaration files) and from
+ * double-counting compiled output under `dist`.
+ */ var DEFAULT_DISCOVERY_EXCLUDED_DIRS = [
+    'node_modules',
+    'dist',
+    '.git',
+    '.nx',
+    'coverage',
+    'tmp'
+];
+/**
+ * Builds the `exclude` predicate passed to `fs.globSync(pattern, { cwd, exclude })` for the broad,
+ * layout-agnostic discovery globs. Node invokes the predicate on each visited path (directories
+ * included) and prunes the subtree when it returns true, so excluding a directory name here stops
+ * the walk from ever descending into it.
+ *
+ * @param excludedDirs - Directory names to prune. Defaults to {@link DEFAULT_DISCOVERY_EXCLUDED_DIRS}.
+ * @returns A predicate that returns true for any path containing an excluded directory segment.
+ */ function discoveryGlobExcludeFilter() {
+    var excludedDirs = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : DEFAULT_DISCOVERY_EXCLUDED_DIRS;
+    var excluded = new Set(excludedDirs);
+    return function(path) {
+        return path.split(/[\\/]/).some(function(segment) {
+            return excluded.has(segment);
+        });
+    };
+}
+/**
+ * Resolves the absolute path to the installed `@dereekb/firebase` package's `src/lib/model`
+ * directory, as seen from the ESLint `cwd`. Used by rules that need to read the framework model
+ * declarations (identities, service factories) directly from the package a consumer has installed —
+ * the downstream case where these live under `node_modules/@dereekb/firebase/...` as compiled
+ * bundles plus `.d.ts` rather than a scannable source tree.
+ *
+ * Resolution uses Node's own module resolver (`require.resolve('@dereekb/firebase/package.json')`
+ * anchored at `cwd`), so it transparently handles hoisting / nested `node_modules`. Returns null
+ * when `@dereekb/firebase` is not resolvable as a dependency from `cwd` (e.g. inside the
+ * dbx-components monorepo itself, where it is consumed via TS path mapping rather than
+ * `node_modules`) — callers fall back to their cwd-relative source globs in that case.
+ *
+ * @param cwd - The ESLint working directory to resolve the dependency from.
+ * @returns The absolute model directory, or null when it cannot be resolved.
+ */ function resolveInstalledFirebaseModelDir(cwd) {
+    var result;
+    if (installedFirebaseModelDirCache.has(cwd)) {
+        var _installedFirebaseModelDirCache_get;
+        result = (_installedFirebaseModelDirCache_get = installedFirebaseModelDirCache.get(cwd)) !== null && _installedFirebaseModelDirCache_get !== void 0 ? _installedFirebaseModelDirCache_get : null;
+    } else {
+        result = null;
+        try {
+            var requireFromCwd = node_module.createRequire(node_path.join(cwd, '__dbx_firebase_model_resolver__.js'));
+            var packageJsonPath = requireFromCwd.resolve("".concat(FIREBASE_MODULE, "/package.json"), {
+                paths: [
+                    cwd
+                ]
+            });
+            var candidate = node_path.join(node_path.dirname(packageJsonPath), FIREBASE_MODEL_SUBPATH);
+            if (node_fs.existsSync(candidate)) {
+                result = candidate;
+            }
+        } catch (unused) {
+            result = null;
+        }
+        installedFirebaseModelDirCache.set(cwd, result);
+    }
+    return result;
+}
+/**
+ * Resolves the referenced type name from either a `TSTypeReference` (`Foo<…>` / `ns.Foo<…>`) or a
+ * `TSImportType` (`import("…").Foo<…>` — the form the TypeScript compiler emits in declaration
+ * files for cross-module type references). Returns the rightmost identifier name in a qualified
+ * name.
+ *
+ * @param node - A `TSTypeReference` or `TSImportType` node (or anything else).
+ * @returns The referenced type name, or null when the node is neither shape.
+ */ function referencedTypeName(node) {
+    var result = null;
+    if ((node === null || node === void 0 ? void 0 : node.type) === 'TSTypeReference') {
+        result = qualifiedNameTail(node.typeName);
+    } else if ((node === null || node === void 0 ? void 0 : node.type) === 'TSImportType') {
+        result = qualifiedNameTail(node.qualifier);
+    }
+    return result;
+}
+function qualifiedNameTail(node) {
+    var _node_right;
+    var result = null;
+    if ((node === null || node === void 0 ? void 0 : node.type) === 'Identifier') {
+        result = node.name;
+    } else if ((node === null || node === void 0 ? void 0 : node.type) === 'TSQualifiedName' && ((_node_right = node.right) === null || _node_right === void 0 ? void 0 : _node_right.type) === 'Identifier') {
+        result = node.right.name;
+    }
+    return result;
+}
 /**
  * JSDoc tag name that marks an exported query factory whose body should be scanned by
  * `dbx-components-mcp`'s index extractor (`packages/dbx-components-mcp/src/scan/model-firebase-index-extract.ts`).
@@ -1158,7 +1302,7 @@ function _unsupported_iterable_to_array$d(o, minLen) {
  * Combined list of every Firestore constraint factory exported from `@dereekb/firebase`. Used
  * by the body-coherence rule to ensure a tagged factory body contains at least one constraint
  * call of any kind (index-affecting or pagination) before warning that the marker is orphaned.
- */ var DEFAULT_CONSTRAINT_FACTORY_NAMES = _to_consumable_array$9(DEFAULT_INDEX_AFFECTING_CONSTRAINT_NAMES).concat(_to_consumable_array$9(DEFAULT_PAGINATION_CONSTRAINT_NAMES));
+ */ var DEFAULT_CONSTRAINT_FACTORY_NAMES = _to_consumable_array$a(DEFAULT_INDEX_AFFECTING_CONSTRAINT_NAMES).concat(_to_consumable_array$a(DEFAULT_PAGINATION_CONSTRAINT_NAMES));
 /**
  * Creates an empty {@link ImportRegistry}.
  *
@@ -1619,30 +1763,30 @@ function _unsupported_iterable_to_array$d(o, minLen) {
     });
 }
 
-function _array_like_to_array$c(arr, len) {
+function _array_like_to_array$e(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$8(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$c(arr);
+function _array_without_holes$9(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$e(arr);
 }
-function _iterable_to_array$8(iter) {
+function _iterable_to_array$9(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$8() {
+function _non_iterable_spread$9() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$8(arr) {
-    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$c(arr) || _non_iterable_spread$8();
+function _to_consumable_array$9(arr) {
+    return _array_without_holes$9(arr) || _iterable_to_array$9(arr) || _unsupported_iterable_to_array$e(arr) || _non_iterable_spread$9();
 }
-function _unsupported_iterable_to_array$c(o, minLen) {
+function _unsupported_iterable_to_array$e(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$c(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$e(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$c(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$e(o, minLen);
 }
 /**
  * ESLint rule that forbids inline `@dereekb/firebase` Firestore constraint factory calls
@@ -1700,7 +1844,7 @@ function _unsupported_iterable_to_array$c(o, minLen) {
         var options = (_context_options_ = context.options[0]) !== null && _context_options_ !== void 0 ? _context_options_ : {};
         var sourceCode = context.sourceCode;
         var baseNames = (_options_constraintNames = options.constraintNames) !== null && _options_constraintNames !== void 0 ? _options_constraintNames : DEFAULT_INDEX_AFFECTING_CONSTRAINT_NAMES;
-        var constraintNames = new Set(_to_consumable_array$8(baseNames).concat(_to_consumable_array$8((_options_additionalConstraintNames = options.additionalConstraintNames) !== null && _options_additionalConstraintNames !== void 0 ? _options_additionalConstraintNames : [])));
+        var constraintNames = new Set(_to_consumable_array$9(baseNames).concat(_to_consumable_array$9((_options_additionalConstraintNames = options.additionalConstraintNames) !== null && _options_additionalConstraintNames !== void 0 ? _options_additionalConstraintNames : [])));
         var allowedSources = new Set((_options_allowedImportSources = options.allowedImportSources) !== null && _options_allowedImportSources !== void 0 ? _options_allowedImportSources : [
             FIREBASE_MODULE
         ]);
@@ -2783,30 +2927,30 @@ function _type_of$8(obj) {
     }
 };
 
-function _array_like_to_array$b(arr, len) {
+function _array_like_to_array$d(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$7(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$b(arr);
+function _array_without_holes$8(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$d(arr);
 }
-function _iterable_to_array$7(iter) {
+function _iterable_to_array$8(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$7() {
+function _non_iterable_spread$8() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$7(arr) {
-    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$b(arr) || _non_iterable_spread$7();
+function _to_consumable_array$8(arr) {
+    return _array_without_holes$8(arr) || _iterable_to_array$8(arr) || _unsupported_iterable_to_array$d(arr) || _non_iterable_spread$8();
 }
-function _unsupported_iterable_to_array$b(o, minLen) {
+function _unsupported_iterable_to_array$d(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$b(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$d(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$b(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$d(o, minLen);
 }
 /**
  * ESLint rule that warns when an `@dereekb/firebase` field-path-narrowing constraint factory
@@ -2861,7 +3005,7 @@ function _unsupported_iterable_to_array$b(o, minLen) {
         var _context_options_, _options_constraintNames, _options_additionalConstraintNames, _options_allowedImportSources;
         var options = (_context_options_ = context.options[0]) !== null && _context_options_ !== void 0 ? _context_options_ : {};
         var baseNames = (_options_constraintNames = options.constraintNames) !== null && _options_constraintNames !== void 0 ? _options_constraintNames : DEFAULT_INDEX_AFFECTING_CONSTRAINT_NAMES;
-        var constraintNames = new Set(_to_consumable_array$7(baseNames).concat(_to_consumable_array$7((_options_additionalConstraintNames = options.additionalConstraintNames) !== null && _options_additionalConstraintNames !== void 0 ? _options_additionalConstraintNames : [])));
+        var constraintNames = new Set(_to_consumable_array$8(baseNames).concat(_to_consumable_array$8((_options_additionalConstraintNames = options.additionalConstraintNames) !== null && _options_additionalConstraintNames !== void 0 ? _options_additionalConstraintNames : [])));
         var allowedSources = new Set((_options_allowedImportSources = options.allowedImportSources) !== null && _options_allowedImportSources !== void 0 ? _options_allowedImportSources : [
             FIREBASE_MODULE
         ]);
@@ -2907,15 +3051,15 @@ function _unsupported_iterable_to_array$b(o, minLen) {
     }
 };
 
-function _array_like_to_array$a(arr, len) {
+function _array_like_to_array$c(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$7(arr) {
+function _array_with_holes$8(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _iterable_to_array_limit$7(arr, i) {
+function _iterable_to_array_limit$8(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -2939,19 +3083,19 @@ function _iterable_to_array_limit$7(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$7() {
+function _non_iterable_rest$8() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$7(arr, i) {
-    return _array_with_holes$7(arr) || _iterable_to_array_limit$7(arr, i) || _unsupported_iterable_to_array$a(arr, i) || _non_iterable_rest$7();
+function _sliced_to_array$8(arr, i) {
+    return _array_with_holes$8(arr) || _iterable_to_array_limit$8(arr, i) || _unsupported_iterable_to_array$c(arr, i) || _non_iterable_rest$8();
 }
-function _unsupported_iterable_to_array$a(o, minLen) {
+function _unsupported_iterable_to_array$c(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$a(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$c(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$a(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$c(o, minLen);
 }
 /**
  * Type-reference name that triggers this rule. Variables whose declared type is
@@ -3623,7 +3767,7 @@ function validateModelEntry(input) {
                 var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                 try {
                     for(var _iterator1 = expected.models[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                        var _step_value = _sliced_to_array$7(_step1.value, 2), expectedKey = _step_value[0], expectedModel1 = _step_value[1];
+                        var _step_value = _sliced_to_array$8(_step1.value, 2), expectedKey = _step_value[0], expectedModel1 = _step_value[1];
                         if (!expectedModel1.disabled && !seenKeys.has(expectedKey)) {
                             context.report({
                                 node: initializer,
@@ -4519,12 +4663,12 @@ var RESERVED = new Set([
     'prototype'
 ]);
 
-function _array_like_to_array$9(arr, len) {
+function _array_like_to_array$b(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$6(arr) {
+function _array_with_holes$7(arr) {
     if (Array.isArray(arr)) return arr;
 }
 function _check_private_redeclaration$3(obj, privateCollection) {
@@ -4594,7 +4738,7 @@ function _instanceof$7(left, right) {
         return left instanceof right;
     }
 }
-function _iterable_to_array_limit$6(arr, i) {
+function _iterable_to_array_limit$7(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -4618,23 +4762,23 @@ function _iterable_to_array_limit$6(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$6() {
+function _non_iterable_rest$7() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$6(arr, i) {
-    return _array_with_holes$6(arr) || _iterable_to_array_limit$6(arr, i) || _unsupported_iterable_to_array$9(arr, i) || _non_iterable_rest$6();
+function _sliced_to_array$7(arr, i) {
+    return _array_with_holes$7(arr) || _iterable_to_array_limit$7(arr, i) || _unsupported_iterable_to_array$b(arr, i) || _non_iterable_rest$7();
 }
 function _type_of$6(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$9(o, minLen) {
+function _unsupported_iterable_to_array$b(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$9(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$b(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$9(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$b(o, minLen);
 }
 var _value = /*#__PURE__*/ new WeakMap();
 var _Symbol_for = Symbol.for('nodejs.util.inspect.custom');
@@ -5236,7 +5380,7 @@ function registerFunctions(registry) {
             if (match.index !== 0) throw evaluationError('invalid_duration', "Invalid duration string: ".concat(string));
             string = string.slice(match[0].length);
             var unitNanos = UNIT_NANOSECONDS[match[2]];
-            var _match__split = _sliced_to_array$6(match[1].split('.'), 2), tmp = _match__split[0], intPart = tmp === void 0 ? '0' : tmp, tmp1 = _match__split[1], fracPart = tmp1 === void 0 ? '' : tmp1;
+            var _match__split = _sliced_to_array$7(match[1].split('.'), 2), tmp = _match__split[0], intPart = tmp === void 0 ? '0' : tmp, tmp1 = _match__split[1], fracPart = tmp1 === void 0 ? '' : tmp1;
             var intVal = BigInt(intPart) * unitNanos;
             var fracNanos = fracPart ? BigInt(fracPart.slice(0, 13).padEnd(13, '0')) * unitNanos / 10000000000000n : 0n;
             nanoseconds += intVal + fracNanos;
@@ -5289,16 +5433,16 @@ function stringSize(str) {
     return count;
 }
 
-function _array_like_to_array$8(arr, len) {
+function _array_like_to_array$a(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$5(arr) {
+function _array_with_holes$6(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$6(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$8(arr);
+function _array_without_holes$7(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$a(arr);
 }
 function _assert_this_initialized$2(self) {
     if (self === void 0) {
@@ -5454,10 +5598,10 @@ function _instanceof$6(left, right) {
 function _is_native_function(fn) {
     return Function.toString.call(fn).indexOf("[native code]") !== -1;
 }
-function _iterable_to_array$6(iter) {
+function _iterable_to_array$7(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$5(arr, i) {
+function _iterable_to_array_limit$6(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -5481,10 +5625,10 @@ function _iterable_to_array_limit$5(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$5() {
+function _non_iterable_rest$6() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$6() {
+function _non_iterable_spread$7() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _possible_constructor_return$2(self, call) {
@@ -5500,8 +5644,8 @@ function _set_prototype_of$2(o, p) {
     };
     return _set_prototype_of$2(o, p);
 }
-function _sliced_to_array$5(arr, i) {
-    return _array_with_holes$5(arr) || _iterable_to_array_limit$5(arr, i) || _unsupported_iterable_to_array$8(arr, i) || _non_iterable_rest$5();
+function _sliced_to_array$6(arr, i) {
+    return _array_with_holes$6(arr) || _iterable_to_array_limit$6(arr, i) || _unsupported_iterable_to_array$a(arr, i) || _non_iterable_rest$6();
 }
 function _super_prop_base(object, property) {
     while(!Object.prototype.hasOwnProperty.call(object, property)){
@@ -5510,20 +5654,20 @@ function _super_prop_base(object, property) {
     }
     return object;
 }
-function _to_consumable_array$6(arr) {
-    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$8(arr) || _non_iterable_spread$6();
+function _to_consumable_array$7(arr) {
+    return _array_without_holes$7(arr) || _iterable_to_array$7(arr) || _unsupported_iterable_to_array$a(arr) || _non_iterable_spread$7();
 }
 function _type_of$5(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$8(o, minLen) {
+function _unsupported_iterable_to_array$a(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$8(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$a(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$8(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$a(o, minLen);
 }
 function _wrap_native_super(Class) {
     var _cache = typeof Map === "function" ? new Map() : undefined;
@@ -6369,7 +6513,7 @@ var objTypesDecls = [
         TYPES.bytes,
         celTypes.bytes
     ]
-].concat(_to_consumable_array$6(typeof Buffer !== 'undefined' ? [
+].concat(_to_consumable_array$7(typeof Buffer !== 'undefined' ? [
     [
         Buffer,
         'bytes',
@@ -6377,7 +6521,7 @@ var objTypesDecls = [
         celTypes.bytes
     ]
 ] : [])).map(function(param) {
-    var _param = _sliced_to_array$5(param, 4), ctor = _param[0], name = _param[1], typeType = _param[2], type = _param[3];
+    var _param = _sliced_to_array$6(param, 4), ctor = _param[0], name = _param[1], typeType = _param[2], type = _param[3];
     return Object.freeze({
         name: name,
         typeType: typeType,
@@ -6744,7 +6888,7 @@ var Registry = /*#__PURE__*/ function() {
                 var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
                 try {
                     for(var _iterator = this.variables[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                        var _step_value = _sliced_to_array$5(_step.value, 2), varDecl = _step_value[1];
+                        var _step_value = _sliced_to_array$6(_step.value, 2), varDecl = _step_value[1];
                         if (!varDecl) continue;
                         variables.push({
                             name: varDecl.name,
@@ -6858,12 +7002,12 @@ var Registry = /*#__PURE__*/ function() {
                 // Parse with optional return type: "Vector + Vector: Vector" or "Vector + Vector"
                 var unaryParts = string.match(/^([-!])([\w.<>]+)(?::\s*([\w.<>]+))?$/);
                 if (unaryParts) {
-                    var _unaryParts = _sliced_to_array$5(unaryParts, 4), op = _unaryParts[1], operandType = _unaryParts[2], returnType = _unaryParts[3];
+                    var _unaryParts = _sliced_to_array$6(unaryParts, 4), op = _unaryParts[1], operandType = _unaryParts[2], returnType = _unaryParts[3];
                     return this.unaryOverload(op, operandType, handler, returnType, opts === null || opts === void 0 ? void 0 : opts.async);
                 }
                 var parts = string.match(/^([\w.<>]+) ([-+*%/]|==|!=|<|<=|>|>=|in) ([\w.<>]+)(?::\s*([\w.<>]+))?$/);
                 if (!parts) throw new Error("Operator overload invalid: ".concat(string));
-                var _parts = _sliced_to_array$5(parts, 5), leftType = _parts[1], op1 = _parts[2], rightType = _parts[3], returnType1 = _parts[4];
+                var _parts = _sliced_to_array$6(parts, 5), leftType = _parts[1], op1 = _parts[2], rightType = _parts[3], returnType1 = _parts[4];
                 return this.binaryOverload(leftType, op1, rightType, handler, returnType1);
             }
         },
@@ -7012,11 +7156,11 @@ function ensureCandiate(c, key) {
 }
 function getOperators() {
     if (_class_private_field_get$2(this, _operators)) return _class_private_field_get$2(this, _operators);
-    return _class_private_field_set$2(this, _operators, _to_consumable_array$6(_class_private_field_get$2(this, _others).operators));
+    return _class_private_field_set$2(this, _operators, _to_consumable_array$7(_class_private_field_get$2(this, _others).operators));
 }
 function getFunctions() {
     if (_class_private_field_get$2(this, _functions)) return _class_private_field_get$2(this, _functions);
-    return _class_private_field_set$2(this, _functions, _to_consumable_array$6(_class_private_field_get$2(this, _others).functions));
+    return _class_private_field_set$2(this, _functions, _to_consumable_array$7(_class_private_field_get$2(this, _others).functions));
 }
 function functionCandidates(key) {
     if (_class_private_field_get$2(this, _functionsByKey)) return _class_private_method_get$2(this, _ensureCandiate, ensureCandiate).call(this, _class_private_field_get$2(this, _functionsByKey), key);
@@ -7128,7 +7272,7 @@ function createDeclaration(creator, key) {
     for(var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++){
         args[_key - 2] = arguments[_key];
     }
-    return _class_private_field_get$2(this, _typeDeclarations).get(key) || _class_private_field_get$2(this, _typeDeclarations).set(key, creator.apply(void 0, _to_consumable_array$6(args))).get(key);
+    return _class_private_field_get$2(this, _typeDeclarations).get(key) || _class_private_field_get$2(this, _typeDeclarations).set(key, creator.apply(void 0, _to_consumable_array$7(args))).get(key);
 }
 function toCelFieldType(field) {
     if (typeof field === 'string') return {
@@ -7581,16 +7725,16 @@ var OverlayContext = /*#__PURE__*/ function() {
     }
 }
 
-function _array_like_to_array$7(arr, len) {
+function _array_like_to_array$9(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$4(arr) {
+function _array_with_holes$5(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$5(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
+function _array_without_holes$6(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$9(arr);
 }
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
     try {
@@ -7660,10 +7804,10 @@ function _instanceof$5(left, right) {
         return left instanceof right;
     }
 }
-function _iterable_to_array$5(iter) {
+function _iterable_to_array$6(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$4(arr, i) {
+function _iterable_to_array_limit$5(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -7687,29 +7831,29 @@ function _iterable_to_array_limit$4(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$4() {
+function _non_iterable_rest$5() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$5() {
+function _non_iterable_spread$6() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$4(arr, i) {
-    return _array_with_holes$4(arr) || _iterable_to_array_limit$4(arr, i) || _unsupported_iterable_to_array$7(arr, i) || _non_iterable_rest$4();
+function _sliced_to_array$5(arr, i) {
+    return _array_with_holes$5(arr) || _iterable_to_array_limit$5(arr, i) || _unsupported_iterable_to_array$9(arr, i) || _non_iterable_rest$5();
 }
-function _to_consumable_array$5(arr) {
-    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$5();
+function _to_consumable_array$6(arr) {
+    return _array_without_holes$6(arr) || _iterable_to_array$6(arr) || _unsupported_iterable_to_array$9(arr) || _non_iterable_spread$6();
 }
 function _type_of$4(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$7(o, minLen) {
+function _unsupported_iterable_to_array$9(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$9(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$9(o, minLen);
 }
 function _ts_generator(thisArg, body) {
     var f, y, t, _ = {
@@ -8064,7 +8208,7 @@ function callFn(args, ast, ev) {
     }).join(', '), ")'"), ast);
 }
 function callRecFn(args, ev, ast) {
-    var _ast_args = _sliced_to_array$4(ast.args, 3), receiverAst = _ast_args[1], argAst = _ast_args[2];
+    var _ast_args = _sliced_to_array$5(ast.args, 3), receiverAst = _ast_args[1], argAst = _ast_args[2];
     var types = ast.argTypes;
     for(var i = 0; i < types.length; i++)types[i] = ev.debugRuntimeType(args[i + 1], argAst[i].checkedType);
     var receiverType = ev.debugRuntimeType(args[0], receiverAst.checkedType);
@@ -8085,7 +8229,7 @@ function resolveAstArray(ev, astArray, ctx) {
 function safeFromEntries(entries) {
     var obj = {};
     for(var i = 0; i < entries.length; i++){
-        var _entries_i = _sliced_to_array$4(entries[i], 2), k = _entries_i[0], v = _entries_i[1];
+        var _entries_i = _sliced_to_array$5(entries[i], 2), k = _entries_i[0], v = _entries_i[1];
         if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;
         obj[k] = v;
     }
@@ -8099,8 +8243,8 @@ function comprehensionElementType(chk, iterable, ctx) {
     throw chk.createError('invalid_comprehension_range', "Expression of type '".concat(chk.formatType(iterType), "' cannot be range of a comprehension (must be list, map, or dynamic)."), iterable);
 }
 function toIterable(ev, args, coll) {
-    if (_instanceof$5(coll, Set)) return _to_consumable_array$5(coll);
-    if (_instanceof$5(coll, Map)) return _to_consumable_array$5(coll.keys());
+    if (_instanceof$5(coll, Set)) return _to_consumable_array$6(coll);
+    if (_instanceof$5(coll, Map)) return _to_consumable_array$6(coll.keys());
     if (coll && (typeof coll === "undefined" ? "undefined" : _type_of$4(coll)) === 'object') return objKeys(coll);
     throw ev.createError('invalid_comprehension_range', "Expression of type '".concat(ev.debugType(coll), "' cannot be range of a comprehension (must be list, map, or dynamic)."), args.iterable);
 }
@@ -8340,7 +8484,7 @@ var OPERATORS = {
     call: {
         check: function check(chk, ast, ctx) {
             var _decl_handler, ___handle;
-            var _ast_args = _sliced_to_array$4(ast.args, 2), functionName = _ast_args[0], args = _ast_args[1];
+            var _ast_args = _sliced_to_array$5(ast.args, 2), functionName = _ast_args[0], args = _ast_args[1];
             var candidates = ast.candidates = chk.registry.functionCandidates(false, functionName, args.length);
             var argTypes = ast.argTypes = args.map(function(a) {
                 return chk.check(a, ctx);
@@ -8363,7 +8507,7 @@ var OPERATORS = {
     },
     rcall: {
         check: function check(chk, ast, ctx) {
-            var _ast_args = _sliced_to_array$4(ast.args, 3), methodName = _ast_args[0], receiver = _ast_args[1], args = _ast_args[2];
+            var _ast_args = _sliced_to_array$5(ast.args, 3), methodName = _ast_args[0], receiver = _ast_args[1], args = _ast_args[2];
             var receiverType = chk.check(receiver, ctx);
             var candidates = ast.candidates = chk.registry.functionCandidates(true, methodName, args.length);
             var argTypes = ast.argTypes = args.map(function(a) {
@@ -8371,7 +8515,7 @@ var OPERATORS = {
             });
             ast.receiverWithArgs = [
                 receiver
-            ].concat(_to_consumable_array$5(args));
+            ].concat(_to_consumable_array$6(args));
             ast.handle = maybeAsync(ast.receiverWithArgs, false, callRecFn);
             if (receiverType.kind === 'dyn' && candidates.returnType) return candidates.returnType;
             var decl = candidates.findFunction(argTypes, receiverType);
@@ -8624,12 +8768,12 @@ try {
     }
 }
 
-function _array_like_to_array$6(arr, len) {
+function _array_like_to_array$8(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$3(arr) {
+function _array_with_holes$4(arr) {
     if (Array.isArray(arr)) return arr;
 }
 function _class_call_check$3(instance, Constructor) {
@@ -8645,7 +8789,7 @@ function _instanceof$4(left, right) {
         return left instanceof right;
     }
 }
-function _iterable_to_array_limit$3(arr, i) {
+function _iterable_to_array_limit$4(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -8669,19 +8813,19 @@ function _iterable_to_array_limit$3(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$3() {
+function _non_iterable_rest$4() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$3(arr, i) {
-    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$6(arr, i) || _non_iterable_rest$3();
+function _sliced_to_array$4(arr, i) {
+    return _array_with_holes$4(arr) || _iterable_to_array_limit$4(arr, i) || _unsupported_iterable_to_array$8(arr, i) || _non_iterable_rest$4();
 }
-function _unsupported_iterable_to_array$6(o, minLen) {
+function _unsupported_iterable_to_array$8(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$8(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$8(o, minLen);
 }
 var identity = function identity(x) {
     return x;
@@ -8696,7 +8840,7 @@ function createMapExpander(hasFilter) {
     var label = "".concat(functionDesc, " filter predicate must return bool");
     return function(param) {
         var args = param.args, receiver = param.receiver, callAst = param.ast;
-        var _ref = _sliced_to_array$3(hasFilter ? args : [
+        var _ref = _sliced_to_array$4(hasFilter ? args : [
             args[0],
             null,
             args[1]
@@ -8921,16 +9065,16 @@ function registerMacros(registry) {
     });
 }
 
-function _array_like_to_array$5(arr, len) {
+function _array_like_to_array$7(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$2(arr) {
+function _array_with_holes$3(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$4(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
+function _array_without_holes$5(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$7(arr);
 }
 function _instanceof$3(left, right) {
     "@swc/helpers - instanceof";
@@ -8940,10 +9084,10 @@ function _instanceof$3(left, right) {
         return left instanceof right;
     }
 }
-function _iterable_to_array$4(iter) {
+function _iterable_to_array$5(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$2(arr, i) {
+function _iterable_to_array_limit$3(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -8967,29 +9111,29 @@ function _iterable_to_array_limit$2(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$2() {
+function _non_iterable_rest$3() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$4() {
+function _non_iterable_spread$5() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$2(arr, i) {
-    return _array_with_holes$2(arr) || _iterable_to_array_limit$2(arr, i) || _unsupported_iterable_to_array$5(arr, i) || _non_iterable_rest$2();
+function _sliced_to_array$3(arr, i) {
+    return _array_with_holes$3(arr) || _iterable_to_array_limit$3(arr, i) || _unsupported_iterable_to_array$7(arr, i) || _non_iterable_rest$3();
 }
-function _to_consumable_array$4(arr) {
-    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$4();
+function _to_consumable_array$5(arr) {
+    return _array_without_holes$5(arr) || _iterable_to_array$5(arr) || _unsupported_iterable_to_array$7(arr) || _non_iterable_spread$5();
 }
 function _type_of$3(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$5(o, minLen) {
+function _unsupported_iterable_to_array$7(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$7(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$7(o, minLen);
 }
 function registerOverloads(registry) {
     var unaryOverload = function unaryOverload(op, t, h, ret) {
@@ -9056,7 +9200,7 @@ function registerOverloads(registry) {
         return a + b;
     });
     binaryOverload('list<V>', '+', 'list<V>', function(a, b) {
-        return _to_consumable_array$4(a).concat(_to_consumable_array$4(b));
+        return _to_consumable_array$5(a).concat(_to_consumable_array$5(b));
     });
     binaryOverload('bytes', '+', 'bytes', function(a, b) {
         if (!a.length) return b;
@@ -9193,7 +9337,7 @@ function registerOverloads(registry) {
             var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
             try {
                 for(var _iterator = a[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                    var _step_value = _sliced_to_array$2(_step.value, 2), key = _step_value[0], value = _step_value[1];
+                    var _step_value = _sliced_to_array$3(_step.value, 2), key = _step_value[0], value = _step_value[1];
                     if (!(b.has(key) && isEqual(value, b.get(key), ast, ev))) return false;
                 }
             } catch (err) {
@@ -9220,7 +9364,7 @@ function registerOverloads(registry) {
             var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
             try {
                 for(var _iterator1 = map[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                    var _step_value1 = _sliced_to_array$2(_step1.value, 2), key1 = _step_value1[0], value1 = _step_value1[1];
+                    var _step_value1 = _sliced_to_array$3(_step1.value, 2), key1 = _step_value1[0], value1 = _step_value1[1];
                     if (!(key1 in obj && isEqual(value1, obj[key1], ast, ev))) return false;
                 }
             } catch (err) {
@@ -9325,7 +9469,7 @@ function registerOverloads(registry) {
             'double'
         ]
     ]; _i1 < _iter1.length; _i1++){
-        var _iter__i = _sliced_to_array$2(_iter1[_i1], 2), left = _iter__i[0], right = _iter__i[1];
+        var _iter__i = _sliced_to_array$3(_iter1[_i1], 2), left = _iter__i[0], right = _iter__i[1];
         binaryOverload(left, '<', right, function(a, b) {
             return a < b;
         });
@@ -9529,13 +9673,13 @@ var toDynTypeBinding = new Map().set('A', 'dyn').set('T', 'dyn').set('K', 'dyn')
     return TypeChecker;
 }(Base);
 
-function _array_like_to_array$4(arr, len) {
+function _array_like_to_array$6(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_without_holes$3(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
+function _array_without_holes$4(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$6(arr);
 }
 function _check_private_redeclaration$1(obj, privateCollection) {
     if (privateCollection.has(obj)) {
@@ -9626,22 +9770,22 @@ function _instanceof$2(left, right) {
         return left instanceof right;
     }
 }
-function _iterable_to_array$3(iter) {
+function _iterable_to_array$4(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _non_iterable_spread$3() {
+function _non_iterable_spread$4() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _to_consumable_array$3(arr) {
-    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$3();
+function _to_consumable_array$4(arr) {
+    return _array_without_holes$4(arr) || _iterable_to_array$4(arr) || _unsupported_iterable_to_array$6(arr) || _non_iterable_spread$4();
 }
-function _unsupported_iterable_to_array$4(o, minLen) {
+function _unsupported_iterable_to_array$6(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$6(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$6(o, minLen);
 }
 var TOKEN = {
     EOF: 0,
@@ -9838,7 +9982,7 @@ var ASTNode = /*#__PURE__*/ function() {
                 ];
                 return [
                     this.op
-                ].concat(_to_consumable_array$3(args.map(function(a) {
+                ].concat(_to_consumable_array$4(args.map(function(a) {
                     return _instanceof$2(a, ASTNode) ? a.toOldStructure() : a;
                 })));
             }
@@ -11183,16 +11327,16 @@ function parse(expression) {
     return globalEnvironment.parse(expression);
 }
 
-function _array_like_to_array$3(arr, len) {
+function _array_like_to_array$5(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
-function _array_with_holes$1(arr) {
+function _array_with_holes$2(arr) {
     if (Array.isArray(arr)) return arr;
 }
-function _array_without_holes$2(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
+function _array_without_holes$3(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$5(arr);
 }
 function _instanceof(left, right) {
     "@swc/helpers - instanceof";
@@ -11202,10 +11346,10 @@ function _instanceof(left, right) {
         return left instanceof right;
     }
 }
-function _iterable_to_array$2(iter) {
+function _iterable_to_array$3(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
 }
-function _iterable_to_array_limit$1(arr, i) {
+function _iterable_to_array_limit$2(arr, i) {
     var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
     if (_i == null) return;
     var _arr = [];
@@ -11229,29 +11373,29 @@ function _iterable_to_array_limit$1(arr, i) {
     }
     return _arr;
 }
-function _non_iterable_rest$1() {
+function _non_iterable_rest$2() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _non_iterable_spread$2() {
+function _non_iterable_spread$3() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
-function _sliced_to_array$1(arr, i) {
-    return _array_with_holes$1(arr) || _iterable_to_array_limit$1(arr, i) || _unsupported_iterable_to_array$3(arr, i) || _non_iterable_rest$1();
+function _sliced_to_array$2(arr, i) {
+    return _array_with_holes$2(arr) || _iterable_to_array_limit$2(arr, i) || _unsupported_iterable_to_array$5(arr, i) || _non_iterable_rest$2();
 }
-function _to_consumable_array$2(arr) {
-    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$2();
+function _to_consumable_array$3(arr) {
+    return _array_without_holes$3(arr) || _iterable_to_array$3(arr) || _unsupported_iterable_to_array$5(arr) || _non_iterable_spread$3();
 }
 function _type_of(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
-function _unsupported_iterable_to_array$3(o, minLen) {
+function _unsupported_iterable_to_array$5(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$5(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$5(o, minLen);
 }
 var REGEX_METACHARS_RE = /[.*+?^${}()|[\]\\]/;
 var HELPER_INLINE_MAX_DEPTH = 8;
@@ -11402,7 +11546,7 @@ function collectUniqueBranches(ast, helpers) {
     if (op === 'value' || op === 'id') {
         result = node;
     } else if (op === '.' || op === '.?') {
-        var _args = _sliced_to_array$1(args, 2), receiver = _args[0], prop = _args[1];
+        var _args = _sliced_to_array$2(args, 2), receiver = _args[0], prop = _args[1];
         result = {
             op: op,
             args: [
@@ -11411,7 +11555,7 @@ function collectUniqueBranches(ast, helpers) {
             ]
         };
     } else if (op === 'call') {
-        var _args1 = _sliced_to_array$1(args, 2), name = _args1[0], callArgs = _args1[1];
+        var _args1 = _sliced_to_array$2(args, 2), name = _args1[0], callArgs = _args1[1];
         result = {
             op: op,
             args: [
@@ -11420,7 +11564,7 @@ function collectUniqueBranches(ast, helpers) {
             ]
         };
     } else if (op === 'rcall') {
-        var _args2 = _sliced_to_array$1(args, 3), name1 = _args2[0], receiver1 = _args2[1], callArgs1 = _args2[2];
+        var _args2 = _sliced_to_array$2(args, 3), name1 = _args2[0], receiver1 = _args2[1], callArgs1 = _args2[2];
         result = {
             op: op,
             args: [
@@ -11435,7 +11579,7 @@ function collectUniqueBranches(ast, helpers) {
             args: fn(args)
         };
     } else if (op === '?:') {
-        var _args3 = _sliced_to_array$1(args, 3), c = _args3[0], t = _args3[1], e = _args3[2];
+        var _args3 = _sliced_to_array$2(args, 3), c = _args3[0], t = _args3[1], e = _args3[2];
         result = {
             op: op,
             args: [
@@ -11455,7 +11599,7 @@ function collectUniqueBranches(ast, helpers) {
         result = {
             op: op,
             args: entries.map(function(param) {
-                var _param = _sliced_to_array$1(param, 2), k = _param[0], v = _param[1];
+                var _param = _sliced_to_array$2(param, 2), k = _param[0], v = _param[1];
                 return [
                     fn(k),
                     fn(v)
@@ -11494,10 +11638,10 @@ function collectUniqueBranches(ast, helpers) {
  */ function toDnf(node) {
     var result;
     if (node.op === '||') {
-        var _node_args = _sliced_to_array$1(node.args, 2), l = _node_args[0], r = _node_args[1];
-        result = _to_consumable_array$2(toDnf(l)).concat(_to_consumable_array$2(toDnf(r)));
+        var _node_args = _sliced_to_array$2(node.args, 2), l = _node_args[0], r = _node_args[1];
+        result = _to_consumable_array$3(toDnf(l)).concat(_to_consumable_array$3(toDnf(r)));
     } else if (node.op === '&&') {
-        var _node_args1 = _sliced_to_array$1(node.args, 2), l1 = _node_args1[0], r1 = _node_args1[1];
+        var _node_args1 = _sliced_to_array$2(node.args, 2), l1 = _node_args1[0], r1 = _node_args1[1];
         var left = toDnf(l1);
         var right = toDnf(r1);
         result = [];
@@ -11509,7 +11653,7 @@ function collectUniqueBranches(ast, helpers) {
                 try {
                     for(var _iterator1 = right[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
                         var rd = _step1.value;
-                        result.push(_to_consumable_array$2(ld).concat(_to_consumable_array$2(rd)));
+                        result.push(_to_consumable_array$3(ld).concat(_to_consumable_array$3(rd)));
                     }
                 } catch (err) {
                     _didIteratorError1 = true;
@@ -11641,7 +11785,7 @@ function collectUniqueBranches(ast, helpers) {
  * @param atom - The comparison atom (already known to be `<` or `<=`).
  * @param acc - The clause accumulator.
  */ function extractSizeCap(atom, acc) {
-    var _atom_args = _sliced_to_array$1(atom.args, 2), lhs = _atom_args[0], rhs = _atom_args[1];
+    var _atom_args = _sliced_to_array$2(atom.args, 2), lhs = _atom_args[0], rhs = _atom_args[1];
     if (isMemberPath(lhs, REQUEST_RESOURCE_SIZE_PATH)) {
         var cap = foldNumericNode(rhs);
         if (typeof cap === 'number') {
@@ -11656,7 +11800,7 @@ function collectUniqueBranches(ast, helpers) {
  * @param atom - The equality atom.
  * @param acc - The clause accumulator.
  */ function extractMimeEquality(atom, acc) {
-    var _atom_args = _sliced_to_array$1(atom.args, 2), lhs = _atom_args[0], rhs = _atom_args[1];
+    var _atom_args = _sliced_to_array$2(atom.args, 2), lhs = _atom_args[0], rhs = _atom_args[1];
     var mimeNode = null;
     if (isMemberPath(lhs, REQUEST_RESOURCE_CONTENT_TYPE_PATH)) {
         mimeNode = rhs;
@@ -11675,7 +11819,7 @@ function collectUniqueBranches(ast, helpers) {
  * @param atom - The `rcall` atom.
  * @param acc - The clause accumulator.
  */ function extractMimeMatches(atom, acc) {
-    var _atom_args = _sliced_to_array$1(atom.args, 3), method = _atom_args[0], receiver = _atom_args[1], args = _atom_args[2];
+    var _atom_args = _sliced_to_array$2(atom.args, 3), method = _atom_args[0], receiver = _atom_args[1], args = _atom_args[2];
     if (method === 'matches' && isMemberPath(receiver, REQUEST_RESOURCE_CONTENT_TYPE_PATH) && args.length === 1) {
         var arg = args[0];
         if (arg.op === 'value' && typeof arg.args === 'string') {
@@ -11695,7 +11839,7 @@ function collectUniqueBranches(ast, helpers) {
  * @param atom - The `in` atom.
  * @param acc - The clause accumulator.
  */ function extractMimeInList(atom, acc) {
-    var _atom_args = _sliced_to_array$1(atom.args, 2), lhs = _atom_args[0], rhs = _atom_args[1];
+    var _atom_args = _sliced_to_array$2(atom.args, 2), lhs = _atom_args[0], rhs = _atom_args[1];
     if (isMemberPath(lhs, REQUEST_RESOURCE_CONTENT_TYPE_PATH) && rhs.op === 'list') {
         var items = rhs.args;
         var collected = [];
@@ -11763,7 +11907,7 @@ function collectUniqueBranches(ast, helpers) {
     if (endIndex === 1) {
         result = node.op === 'id' && node.args === segments[0];
     } else if (endIndex > 1 && node.op === '.') {
-        var _node_args = _sliced_to_array$1(node.args, 2), receiver = _node_args[0], prop = _node_args[1];
+        var _node_args = _sliced_to_array$2(node.args, 2), receiver = _node_args[0], prop = _node_args[1];
         if (prop === segments[endIndex - 1]) {
             result = isMemberPath(receiver, segments, endIndex - 1);
         }
@@ -11791,7 +11935,7 @@ function collectUniqueBranches(ast, helpers) {
             result = -inner;
         }
     } else if (node.op === '+' || node.op === '-' || node.op === '*' || node.op === '/') {
-        var _node_args = _sliced_to_array$1(node.args, 2), l = _node_args[0], r = _node_args[1];
+        var _node_args = _sliced_to_array$2(node.args, 2), l = _node_args[0], r = _node_args[1];
         var left = foldNumericNode(l);
         var right = foldNumericNode(r);
         if (typeof left === 'number' && typeof right === 'number') {
@@ -11833,10 +11977,10 @@ function applyNumericBinaryOp(op, left, right) {
  * @param branch - The parsed branch.
  * @returns A signature string usable as a Map/Set key.
  */ function branchSignature(branch) {
-    var literals = _to_consumable_array$2(branch.allowedMimeLiterals).sort(function(a, b) {
+    var literals = _to_consumable_array$3(branch.allowedMimeLiterals).sort(function(a, b) {
         return a.localeCompare(b);
     });
-    var regexes = _to_consumable_array$2(branch.allowedMimeRegexes).sort(function(a, b) {
+    var regexes = _to_consumable_array$3(branch.allowedMimeRegexes).sort(function(a, b) {
         return a.localeCompare(b);
     });
     return "".concat(branch.maxFileSizeBytes, "|").concat(literals.join(','), "|").concat(regexes.join(','));
@@ -12109,6 +12253,46 @@ function _object_spread$1(target) {
  * in `STORAGE_FILE_PURPOSE_UPLOAD_POLICIES`. The capture group is the policy key constant
  * name, e.g. `USER_AVATAR_PURPOSE`.
  */ var MIRRORS_POLICY_KEY_MARKER_REGEX = /\/\/\s*Mirrors\s+STORAGE_FILE_PURPOSE_UPLOAD_POLICIES\[(\w+)\]/g;
+/**
+ * Converts a parsed leaf block's `matchPath` (e.g. `/uploads/u/{uid}/jr/{shortKey}`) into a
+ * structural segment list for comparison against a folded upload-policy path. Empty segments
+ * (leading/trailing/duplicate slashes) are dropped; `{var}` / `{var=**}` path variables become
+ * wildcards; every other segment is a literal.
+ *
+ * @param matchPath - The accumulated match-path string.
+ * @returns The structural segment list.
+ */ function rulesMatchPathToSegments(matchPath) {
+    var segments = [];
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = matchPath.split('/')[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var raw = _step.value;
+            if (raw.length > 0) {
+                segments.push(/^\{[^}]*\}$/.test(raw) ? {
+                    kind: 'wildcard',
+                    value: ''
+                } : {
+                    kind: 'literal',
+                    value: raw
+                });
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return segments;
+}
 var ALLOW_WRITE_RE = /allow\s+(?:write|create|update)(?:\s*,\s*(?:write|create|update))*\s*:\s*if\s+([\s\S]+?);/g;
 /**
  * Collects every `// Mirrors STORAGE_FILE_PURPOSE_UPLOAD_POLICIES[<KEY>]` marker in the
@@ -12257,9 +12441,10 @@ var ALLOW_WRITE_RE = /allow\s+(?:write|create|update)(?:\s*,\s*(?:write|create|u
     return trimmed.startsWith('service ') || /^match\s+\/b\/[^]+\/o\s*$/.test(trimmed);
 }
 /**
- * Processes a single `match /<segment> { ... }` block: descends into nested matches,
- * skips catch-all deny blocks, and (when a `Mirrors ...` marker precedes the block)
- * reduces the `allow write` predicate to `ParsedRuleBranch[]`.
+ * Processes a single `match /<segment> { ... }` block: skips catch-all deny blocks, records
+ * the block as a leaf when it carries an `allow write|create|update` predicate (reducing the
+ * predicate to `ParsedRuleBranch[]`), and always descends into nested matches so deeper leaf
+ * blocks are collected too.
  *
  * @param input - The match-block inputs: block descriptor, unmasked path segment,
  *   enclosing body offset, parent path, scope functions, and walk context.
@@ -12269,13 +12454,14 @@ var ALLOW_WRITE_RE = /allow\s+(?:write|create|update)(?:\s*,\s*(?:write|create|u
     var headerSourceOffset = bodyOffset + block.headerStart;
     var markerKey = consumePrecedingMarker(ctx.pendingMarkers, headerSourceOffset);
     if (!isCatchAllSegment(matchSegment)) {
-        if (markerKey) {
-            recordMirroredBlock({
-                block: block,
+        var predicate = extractAllowWritePredicate(topLevelBlockText(block.body));
+        if (predicate) {
+            recordLeafBlock({
                 fullPath: fullPath,
                 headerSourceOffset: headerSourceOffset,
                 scopeFunctions: scopeFunctions,
                 markerKey: markerKey,
+                predicate: predicate,
                 ctx: ctx
             });
         }
@@ -12289,40 +12475,70 @@ var ALLOW_WRITE_RE = /allow\s+(?:write|create|update)(?:\s*,\s*(?:write|create|u
     }
 }
 /**
- * Reduces a match block paired with a `// Mirrors ...` marker and pushes a
- * `ParsedStorageRulesBlock` onto the results.
+ * Reduces a leaf match block's `allow write` predicate and pushes a `ParsedStorageRulesBlock`
+ * onto the results. Pairing with a TypeScript upload policy is by `matchPath`; any legacy
+ * `// Mirrors ...` marker key is recorded for backward compatibility only.
  *
- * @param input - The record inputs: block descriptor, accumulated unmasked path,
- *   header source offset, scope functions, marker key, and walk context.
- */ function recordMirroredBlock(input) {
-    var block = input.block, fullPath = input.fullPath, headerSourceOffset = input.headerSourceOffset, scopeFunctions = input.scopeFunctions, markerKey = input.markerKey, ctx = input.ctx;
-    var predicate = extractAllowWritePredicate(block.body);
+ * @param input - The record inputs: accumulated unmasked path, header source offset, scope
+ *   functions, optional marker key, the allow-write predicate text, and walk context.
+ */ function recordLeafBlock(input) {
+    var fullPath = input.fullPath, headerSourceOffset = input.headerSourceOffset, scopeFunctions = input.scopeFunctions, markerKey = input.markerKey, predicate = input.predicate, ctx = input.ctx;
     var _indexToLineColumn = indexToLineColumn(ctx.source, headerSourceOffset), line = _indexToLineColumn.line, column = _indexToLineColumn.column;
-    if (predicate) {
-        var helpers = {
-            definitions: scopeFunctions
-        };
-        var reduced = evaluatePredicate(predicate, helpers);
-        var entry = _object_spread$1({
-            mirrorsPolicyKey: markerKey,
-            matchPath: fullPath,
-            branches: reduced.branches,
-            sourceLine: line,
-            sourceColumn: column
-        }, reduced.unsupported ? {
-            unsupported: reduced.unsupported
-        } : {});
-        ctx.results.push(entry);
-    } else {
-        ctx.results.push({
-            mirrorsPolicyKey: markerKey,
-            matchPath: fullPath,
-            branches: [],
-            sourceLine: line,
-            sourceColumn: column,
-            unsupported: 'no allow write/create/update predicate found in match block'
-        });
+    var helpers = {
+        definitions: scopeFunctions
+    };
+    var reduced = evaluatePredicate(predicate, helpers);
+    var entry = _object_spread$1({
+        mirrorsPolicyKey: markerKey,
+        matchPath: fullPath,
+        branches: reduced.branches,
+        sourceLine: line,
+        sourceColumn: column
+    }, reduced.unsupported ? {
+        unsupported: reduced.unsupported
+    } : {});
+    ctx.results.push(entry);
+}
+/**
+ * Blanks out everything nested inside braces, leaving only this block's own top-level text.
+ * Used so a block's `allow write` predicate is detected only when it belongs to the block
+ * itself — not when it appears inside a nested `match` / `function` block (whose predicates
+ * belong to those deeper leaf blocks instead).
+ *
+ * @param body - The (masked) block body.
+ * @returns The body with nested-brace content replaced by spaces (offsets preserved).
+ */ function topLevelBlockText(body) {
+    var depth = 0;
+    var result = '';
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = body[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var char = _step.value;
+            if (char === '{') {
+                depth += 1;
+                result += ' ';
+            } else if (char === '}') {
+                depth -= 1;
+                result += ' ';
+            } else {
+                result += depth === 0 ? char : ' ';
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
     }
+    return result;
 }
 /**
  * Pulls the first `allow write|create|update: if <predicate>;` predicate from a match
@@ -12340,12 +12556,14 @@ var ALLOW_WRITE_RE = /allow\s+(?:write|create|update)(?:\s*,\s*(?:write|create|u
     return result;
 }
 /**
- * Parses a `storage.rules` source string and returns every match block paired with a
- * `// Mirrors STORAGE_FILE_PURPOSE_UPLOAD_POLICIES[<KEY>]` marker. Catch-all deny blocks
- * are skipped; the rest of the tree is walked normally.
+ * Parses a `storage.rules` source string and returns every leaf `match` block that carries an
+ * `allow write|create|update` predicate, each with its full accumulated `matchPath`. Catch-all
+ * deny blocks are skipped; the rest of the tree is walked normally. Pairing with TypeScript
+ * upload policies is by path (see {@link rulesMatchPathToSegments}); the `// Mirrors ...` marker
+ * is no longer required.
  *
  * @param source - The raw rules source text.
- * @returns Parsed mirrored blocks in source order.
+ * @returns Parsed leaf blocks in source order.
  */ function parseStorageRules(source) {
     var stripped = stripLineComments(source);
     var masked = maskPathVariables(stripped);
@@ -12364,168 +12582,134 @@ var ALLOW_WRITE_RE = /allow\s+(?:write|create|update)(?:\s*,\s*(?:write|create|u
     return ctx.results;
 }
 
+function _array_like_to_array$4(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$2(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$4(arr);
+}
+function _iterable_to_array$2(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread$2() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array$2(arr) {
+    return _array_without_holes$2(arr) || _iterable_to_array$2(arr) || _unsupported_iterable_to_array$4(arr) || _non_iterable_spread$2();
+}
+function _unsupported_iterable_to_array$4(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$4(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$4(o, minLen);
+}
+var MAX_FOLD_DEPTH = 24;
+var PATH_SEPARATOR = '/';
 /**
- * Default type name the rule looks for on top-level declarators. Variables whose type
- * annotation resolves to this identifier are treated as upload policies and validated
- * against `storage.rules`.
- */ var DEFAULT_STORAGE_FILE_UPLOAD_POLICY_TYPE_NAME = 'StorageFilePurposeUploadPolicy';
+ * `@dereekb/util` path combinators that merge a single array argument of path parts. Modeled
+ * exactly: drop statically-empty parts, join with a `/` boundary, collapse empty segments.
+ */ var MERGE_COMBINATOR_NAMES = new Set([
+    'mergeSlashPaths'
+]);
 /**
- * Default file name searched relative to the lint root when `storageRulesPath` is omitted.
- */ var DEFAULT_STORAGE_RULES_FILENAME = 'storage.rules';
-var rulesFileCache = new Map();
+ * `@dereekb/util` path combinators that take a single path argument and only normalize
+ * slashes (collapse `//`, prepend a leading `/`). Structurally these are identity over the
+ * abstract domain because {@link fragsToSegments} already collapses empty segments.
+ */ var NORMALIZE_COMBINATOR_NAMES = new Set([
+    'fixMultiSlashesInSlashPath',
+    'replaceMultipleFilePathsInSlashPath',
+    'toAbsoluteSlashPathStartType',
+    'toRelativeSlashPathStartType',
+    'removeTrailingSlashes',
+    'addTrailingSlash'
+]);
 /**
- * Reads and parses a `storage.rules` file, caching by absolute path so repeated rule
- * activations across files in the same lint pass don't re-read disk.
+ * Statically folds a `StorageFilePurposeUploadPolicy.buildUploadPath` builder to an abstract
+ * path template. The builder is an arrow `(input) => <path expression>` whose destructured /
+ * positional params become wildcards and whose body is a composition of string literals,
+ * `const`s, `@dereekb/util` path combinators, and foldable single-`return` helper functions.
  *
- * @param absolutePath - Absolute path to the rules file.
- * @returns The parsed blocks, or null when the file cannot be read.
- */ function loadParsedRulesFromPath(absolutePath) {
-    var result = null;
-    var cached = rulesFileCache.get(absolutePath);
-    if (cached) {
-        result = cached;
+ * @param builderNode - The `buildUploadPath` value node (arrow / function expression, possibly behind a type assertion).
+ * @param scope - The lexical scope the builder lives in.
+ * @returns The folded path, or a reason the builder is unresolvable.
+ */ function foldUploadPath(builderNode, scope) {
+    var result;
+    var fn = unwrapTypeAssertion$1(builderNode);
+    if ((fn === null || fn === void 0 ? void 0 : fn.type) !== 'ArrowFunctionExpression' && (fn === null || fn === void 0 ? void 0 : fn.type) !== 'FunctionExpression') {
+        result = {
+            ok: false,
+            reason: 'buildUploadPath is not an inline arrow/function expression'
+        };
     } else {
-        try {
-            var source = node_fs.readFileSync(absolutePath, 'utf8');
-            var parsed = parseStorageRules(source);
-            rulesFileCache.set(absolutePath, parsed);
-            result = parsed;
-        } catch (unused) {
-            result = null;
-        }
-    }
-    return result;
-}
-/**
- * Folds a numeric expression node to a number using literals, binary `*`/`+`/`-`/`/`,
- * unary `-`/`+`, parenthesized expressions, and identifier lookups in `constants`.
- *
- * @param node - The expression node.
- * @param constants - Numeric constants resolvable by identifier name.
- * @returns The folded number, or null when any operand is unresolvable.
- */ function evaluateNumericNode(node, constants) {
-    var result = null;
-    if (node) {
-        if (node.type === 'Literal' && typeof node.value === 'number') {
-            result = node.value;
-        } else if (node.type === 'UnaryExpression' && (node.operator === '-' || node.operator === '+')) {
-            result = evaluateNumericUnary(node, constants);
-        } else if (node.type === 'BinaryExpression') {
-            result = evaluateNumericBinary(node, constants);
-        } else if (node.type === 'Identifier') {
-            var value = constants.get(node.name);
-            if (typeof value === 'number') {
-                result = value;
+        var _fn_params;
+        var env = new Map();
+        bindParamsAsWildcards((_fn_params = fn.params) !== null && _fn_params !== void 0 ? _fn_params : [], env);
+        var body = functionBodyExpression(fn);
+        if (!body) {
+            result = {
+                ok: false,
+                reason: 'buildUploadPath body is not a single return expression'
+            };
+        } else {
+            var frags = foldFrags(body, {
+                scope: scope,
+                env: env
+            }, 0);
+            if (!frags) {
+                result = {
+                    ok: false,
+                    reason: 'buildUploadPath does not fold to a constant path (unknown const, unmodeled call, or runtime value)'
+                };
+            } else {
+                result = {
+                    ok: true,
+                    path: {
+                        segments: fragsToSegments(frags)
+                    }
+                };
             }
-        } else if (node.type === 'TSAsExpression' && node.expression) {
-            result = evaluateNumericNode(node.expression, constants);
         }
     }
     return result;
 }
-function evaluateNumericUnary(node, constants) {
-    var result = null;
-    var arg = evaluateNumericNode(node.argument, constants);
-    if (typeof arg === 'number') {
-        result = node.operator === '-' ? -arg : arg;
-    }
-    return result;
-}
-function evaluateNumericBinary(node, constants) {
-    var result = null;
-    var left = evaluateNumericNode(node.left, constants);
-    var right = evaluateNumericNode(node.right, constants);
-    if (typeof left === 'number' && typeof right === 'number') {
-        result = applyBinaryOperator(node.operator, left, right);
-    }
-    return result;
-}
-/**
- * Applies a binary operator to two folded operands, returning null for unsupported operators.
- *
- * @param operator - The binary operator (`+`, `-`, `*`, `/`).
- * @param left - Left operand.
- * @param right - Right operand.
- * @returns The result, or null when the operator is unsupported.
- */ function applyBinaryOperator(operator, left, right) {
-    var result = null;
-    if (operator === '*') {
-        result = left * right;
-    } else if (operator === '+') {
-        result = left + right;
-    } else if (operator === '-') {
-        result = left - right;
-    } else if (operator === '/' && right !== 0) {
-        result = left / right;
-    }
-    return result;
-}
 /**
- * Extracts the cross-reference key used to pair a policy with its `storage.rules` `Mirrors`
- * block.
- *
- * - When `purpose` is an `Identifier`, the constant name (e.g. `USER_AVATAR_PURPOSE`) is the
- *   key — this is what `// Mirrors STORAGE_FILE_PURPOSE_UPLOAD_POLICIES[USER_AVATAR_PURPOSE]`
- *   comments reference.
- * - When `purpose` is a string literal, the literal value is used so a policy that inlines
- *   `purpose: 'avatar'` can still pair with `Mirrors ...[avatar]`.
- * - `TSAsExpression` is unwrapped transparently.
- * - Anything else (computed expression, member access, function call) returns null and
- *   triggers `unresolvedPolicyField`.
+ * Returns the single expression a function-like node evaluates to: an arrow's expression
+ * body directly, or the argument of a lone `return` statement in a block body.
  *
- * @param node - The expression node for the policy's `purpose` field.
- * @returns The mirror-cross-reference key, or null when unresolvable.
- */ function extractPolicyKey(node) {
+ * @param fn - The arrow / function expression node.
+ * @returns The returned expression, or null when the body is not a single return.
+ */ function functionBodyExpression(fn) {
     var result = null;
-    if (node) {
-        if (node.type === 'Identifier') {
-            result = node.name;
-        } else if (node.type === 'Literal' && typeof node.value === 'string') {
-            result = node.value;
-        } else if (node.type === 'TSAsExpression' && node.expression) {
-            result = extractPolicyKey(node.expression);
+    var body = fn.body;
+    if (body && body.type !== 'BlockStatement') {
+        result = body;
+    } else if ((body === null || body === void 0 ? void 0 : body.type) === 'BlockStatement') {
+        var _body_body;
+        var _statements_;
+        var statements = (_body_body = body.body) !== null && _body_body !== void 0 ? _body_body : [];
+        if (statements.length === 1 && ((_statements_ = statements[0]) === null || _statements_ === void 0 ? void 0 : _statements_.type) === 'ReturnStatement' && statements[0].argument) {
+            result = statements[0].argument;
         }
     }
     return result;
 }
 /**
- * Folds a string-array expression node to a list of strings using array literals of string
- * literals and identifier lookups in `constants`.
+ * Binds each parameter pattern to a wildcard (or a wildcard-per-property for an object
+ * destructure). The builder never needs a param's runtime content — a param maps to a single
+ * path segment, which compares equal to a rules `{var}`.
  *
- * @param node - The expression node.
- * @param constants - String-array constants resolvable by identifier name.
- * @returns The resolved string array, or null when any element is unresolvable.
- */ function evaluateStringArrayNode(node, constants) {
-    var result = null;
-    if (node) {
-        if (node.type === 'ArrayExpression') {
-            result = evaluateStringArrayLiteral(node);
-        } else if (node.type === 'Identifier') {
-            var value = constants.get(node.name);
-            if (value) {
-                result = value;
-            }
-        } else if (node.type === 'TSAsExpression' && node.expression) {
-            result = evaluateStringArrayNode(node.expression, constants);
-        }
-    }
-    return result;
-}
-function evaluateStringArrayLiteral(node) {
-    var _node_elements;
-    var result = null;
-    var items = [];
-    var allLiterals = true;
+ * @param params - The parameter pattern nodes.
+ * @param env - The environment to mutate.
+ */ function bindParamsAsWildcards(params, env) {
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
-        for(var _iterator = ((_node_elements = node.elements) !== null && _node_elements !== void 0 ? _node_elements : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var element = _step.value;
-            if ((element === null || element === void 0 ? void 0 : element.type) === 'Literal' && typeof element.value === 'string') {
-                items.push(element.value);
-            } else {
-                allLiterals = false;
-                break;
-            }
+        for(var _iterator = params[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var param = _step.value;
+            bindPatternAsWildcards(param, env);
         }
     } catch (err) {
         _didIteratorError = true;
@@ -12541,43 +12725,1122 @@ function evaluateStringArrayLiteral(node) {
             }
         }
     }
-    if (allLiterals) {
-        result = items;
-    }
-    return result;
 }
-/**
- * Walks the Program body to index every top-level numeric / string / string-array `const` so
- * later folding can resolve identifier references inside policy literals.
- *
- * @param programNode - The Program AST node.
- * @returns The constants index for the file.
- */ function indexProgramConstants(programNode) {
-    var numericConstants = new Map();
-    var stringArrayConstants = new Map();
-    var declarators = collectTopLevelDeclarators$1(programNode);
-    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-    try {
-        for(var _iterator = declarators[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var declarator = _step.value;
-            var _declarator_id;
-            if (((_declarator_id = declarator.id) === null || _declarator_id === void 0 ? void 0 : _declarator_id.type) === 'Identifier' && declarator.init) {
-                var name = declarator.id.name;
-                var init = declarator.init.type === 'TSAsExpression' ? declarator.init.expression : declarator.init;
-                var numeric = evaluateNumericNode(init, numericConstants);
-                if (typeof numeric === 'number') {
-                    numericConstants.set(name, numeric);
+function bindPatternAsWildcards(param, env) {
+    var _param_argument;
+    if ((param === null || param === void 0 ? void 0 : param.type) === 'Identifier') {
+        env.set(param.name, wildcardScalar());
+    } else if ((param === null || param === void 0 ? void 0 : param.type) === 'ObjectPattern') {
+        var _param_properties;
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = ((_param_properties = param.properties) !== null && _param_properties !== void 0 ? _param_properties : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var property = _step.value;
+                var _property_key, _property_argument;
+                if (property.type === 'Property' && ((_property_key = property.key) === null || _property_key === void 0 ? void 0 : _property_key.type) === 'Identifier') {
+                    env.set(property.key.name, wildcardScalar());
+                } else if (property.type === 'RestElement' && ((_property_argument = property.argument) === null || _property_argument === void 0 ? void 0 : _property_argument.type) === 'Identifier') {
+                    env.set(property.argument.name, {
+                        kind: 'list',
+                        items: []
+                    });
                 }
-                var stringArray = evaluateStringArrayNode(init, stringArrayConstants);
-                if (stringArray) {
-                    stringArrayConstants.set(name, stringArray);
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
+                }
+            } finally{
+                if (_didIteratorError) {
+                    throw _iteratorError;
                 }
             }
         }
-    } catch (err) {
-        _didIteratorError = true;
-        _iteratorError = err;
-    } finally{
+    } else if ((param === null || param === void 0 ? void 0 : param.type) === 'RestElement' && ((_param_argument = param.argument) === null || _param_argument === void 0 ? void 0 : _param_argument.type) === 'Identifier') {
+        env.set(param.argument.name, {
+            kind: 'list',
+            items: []
+        });
+    } else if ((param === null || param === void 0 ? void 0 : param.type) === 'AssignmentPattern' && param.left) {
+        bindPatternAsWildcards(param.left, env);
+    }
+}
+function wildcardScalar() {
+    return {
+        kind: 'scalar',
+        frags: [
+            {
+                kind: 'wildcard'
+            }
+        ]
+    };
+}
+/**
+ * Folds an expression node to a fragment stream, or null when any sub-expression is
+ * statically unknown.
+ *
+ * @param node - The expression node.
+ * @param frame - The current scope + environment.
+ * @param depth - Recursion depth guard.
+ * @returns The fragment stream, or null when unfoldable.
+ */ function foldFrags(node, frame, depth) {
+    var result = null;
+    if (node && depth <= MAX_FOLD_DEPTH) {
+        if (node.type === 'Literal') {
+            result = typeof node.value === 'string' ? [
+                {
+                    kind: 'literal',
+                    value: node.value
+                }
+            ] : null;
+        } else if (node.type === 'TemplateLiteral') {
+            result = foldTemplateLiteral(node, frame, depth);
+        } else if (node.type === 'Identifier') {
+            result = foldIdentifier(node, frame, depth);
+        } else if (node.type === 'TSAsExpression' || node.type === 'TSTypeAssertion' || node.type === 'TSNonNullExpression') {
+            result = node.expression ? foldFrags(node.expression, frame, depth) : null;
+        } else if (node.type === 'BinaryExpression' && node.operator === '+') {
+            result = foldStringConcat(node, frame, depth);
+        } else if (node.type === 'CallExpression') {
+            result = foldCall(node, frame, depth);
+        }
+    }
+    return result;
+}
+function foldTemplateLiteral(node, frame, depth) {
+    var _node_quasis, _node_expressions;
+    var result = [];
+    var quasis = (_node_quasis = node.quasis) !== null && _node_quasis !== void 0 ? _node_quasis : [];
+    var expressions = (_node_expressions = node.expressions) !== null && _node_expressions !== void 0 ? _node_expressions : [];
+    for(var i = 0; i < quasis.length && result; i++){
+        var _ref;
+        var _quasis_i_value, _quasis_i;
+        var cooked = (_ref = (_quasis_i = quasis[i]) === null || _quasis_i === void 0 ? void 0 : (_quasis_i_value = _quasis_i.value) === null || _quasis_i_value === void 0 ? void 0 : _quasis_i_value.cooked) !== null && _ref !== void 0 ? _ref : '';
+        var next = _to_consumable_array$2(result).concat([
+            {
+                kind: 'literal',
+                value: cooked
+            }
+        ]);
+        if (i < expressions.length) {
+            var exprFrags = foldFrags(expressions[i], frame, depth + 1);
+            result = exprFrags ? _to_consumable_array$2(next).concat(_to_consumable_array$2(exprFrags)) : null;
+        } else {
+            result = next;
+        }
+    }
+    return result;
+}
+function foldStringConcat(node, frame, depth) {
+    var result = null;
+    var left = foldFrags(node.left, frame, depth + 1);
+    var right = foldFrags(node.right, frame, depth + 1);
+    if (left && right) {
+        result = _to_consumable_array$2(left).concat(_to_consumable_array$2(right));
+    }
+    return result;
+}
+/**
+ * Folds an identifier: a bound (scalar) param/local, then a top-level const in the current
+ * module, then an imported const in another module. A list-bound identifier (rest param) used
+ * as a string is unfoldable.
+ *
+ * @param node - The identifier node.
+ * @param frame - The current scope + environment.
+ * @param depth - Recursion depth guard.
+ * @returns The fragment stream, or null.
+ */ function foldIdentifier(node, frame, depth) {
+    var result = null;
+    var name = node.name;
+    var bound = frame.env.get(name);
+    if (bound) {
+        result = bound.kind === 'scalar' ? bound.frags : null;
+    } else {
+        var local = findTopLevelConstInit(frame.scope.program, name);
+        if (local) {
+            result = foldFrags(local, {
+                scope: frame.scope,
+                env: new Map()
+            }, depth + 1);
+        } else {
+            var imported = resolveImported(name, node, frame.scope);
+            var init = imported ? declaratorInit(imported.node) : null;
+            if (imported && init) {
+                result = foldFrags(init, {
+                    scope: imported.scope,
+                    env: new Map()
+                }, depth + 1);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Folds a call expression: a modeled `@dereekb/util` path combinator, or an inlinable
+ * single-`return` helper function (local or imported).
+ *
+ * @param node - The CallExpression node.
+ * @param frame - The current scope + environment.
+ * @param depth - Recursion depth guard.
+ * @returns The fragment stream, or null.
+ */ function foldCall(node, frame, depth) {
+    var _node_arguments;
+    var result = null;
+    var calleeName = callExpressionCalleeName(node.callee);
+    var args = (_node_arguments = node.arguments) !== null && _node_arguments !== void 0 ? _node_arguments : [];
+    if (calleeName && MERGE_COMBINATOR_NAMES.has(calleeName)) {
+        result = foldMergeCombinator(args[0], frame, depth);
+    } else if (calleeName && NORMALIZE_COMBINATOR_NAMES.has(calleeName)) {
+        result = args.length === 1 ? foldFrags(args[0], frame, depth + 1) : null;
+    } else if (calleeName) {
+        result = foldInlinedFunction({
+            calleeName: calleeName,
+            call: node,
+            frame: frame,
+            depth: depth
+        });
+    }
+    return result;
+}
+/**
+ * Models `mergeSlashPaths([...])`: folds the single array argument to a list of parts, drops
+ * statically-empty parts, and joins them with a `/` boundary. Empty-segment collapse is left
+ * to {@link fragsToSegments}.
+ *
+ * @param arrayArg - The array argument node.
+ * @param frame - The current scope + environment.
+ * @param depth - Recursion depth guard.
+ * @returns The joined fragment stream, or null when any element is unfoldable.
+ */ function foldMergeCombinator(arrayArg, frame, depth) {
+    var result = null;
+    var items = arrayArg ? foldList(arrayArg, frame, depth) : null;
+    if (items) {
+        var joined = [];
+        var first = true;
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = items[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var item = _step.value;
+                if (!isStaticallyEmpty(item)) {
+                    var _joined;
+                    if (!first) {
+                        joined.push({
+                            kind: 'literal',
+                            value: PATH_SEPARATOR
+                        });
+                    }
+                    (_joined = joined).push.apply(_joined, _to_consumable_array$2(item));
+                    first = false;
+                }
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
+                }
+            } finally{
+                if (_didIteratorError) {
+                    throw _iteratorError;
+                }
+            }
+        }
+        result = joined;
+    }
+    return result;
+}
+/**
+ * Inlines a foldable single-`return` helper function called by name: binds its parameters to
+ * the folded arguments (a rest parameter collects the remaining arguments as a list), then
+ * folds its body in the function's own scope.
+ *
+ * @param input - The callee name, the CallExpression node, the caller's frame, and the depth guard.
+ * @returns The fragment stream, or null when the function is not foldable.
+ */ function foldInlinedFunction(input) {
+    var calleeName = input.calleeName, call = input.call, frame = input.frame, depth = input.depth;
+    var result = null;
+    var resolved = resolveFunctionBinding(calleeName, call.callee, frame.scope);
+    var fn = resolved ? functionFromBinding(resolved.node) : null;
+    var body = fn ? functionBodyExpression(fn) : null;
+    if (resolved && fn && body) {
+        var _fn_params, _call_arguments;
+        var env = bindCallArguments({
+            params: (_fn_params = fn.params) !== null && _fn_params !== void 0 ? _fn_params : [],
+            callArgs: (_call_arguments = call.arguments) !== null && _call_arguments !== void 0 ? _call_arguments : [],
+            frame: frame,
+            depth: depth
+        });
+        if (env) {
+            result = foldFrags(body, {
+                scope: resolved.scope,
+                env: env
+            }, depth + 1);
+        }
+    }
+    return result;
+}
+/**
+ * Binds call arguments to parameter patterns. Positional identifiers take the folded
+ * argument; a trailing rest parameter collects the remaining folded arguments as a list.
+ * Spread arguments are expanded from a list-valued operand. Any unfoldable argument fails the
+ * whole binding (sound bail).
+ *
+ * @param input - The parameter patterns, the call argument nodes, the caller's frame, and the depth guard.
+ * @returns The new environment, or null when an argument is unfoldable.
+ */ function bindCallArguments(input) {
+    var params = input.params, callArgs = input.callArgs, frame = input.frame, depth = input.depth;
+    var argValues = foldArgumentList(callArgs, frame, depth);
+    var result = null;
+    if (argValues) {
+        var env = new Map();
+        var ok = true;
+        var argIndex = 0;
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = params[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var param = _step.value;
+                var _param_argument;
+                if ((param === null || param === void 0 ? void 0 : param.type) === 'RestElement' && ((_param_argument = param.argument) === null || _param_argument === void 0 ? void 0 : _param_argument.type) === 'Identifier') {
+                    env.set(param.argument.name, {
+                        kind: 'list',
+                        items: argValues.slice(argIndex)
+                    });
+                    argIndex = argValues.length;
+                } else if ((param === null || param === void 0 ? void 0 : param.type) === 'Identifier') {
+                    var _argValues_argIndex;
+                    env.set(param.name, {
+                        kind: 'scalar',
+                        frags: (_argValues_argIndex = argValues[argIndex]) !== null && _argValues_argIndex !== void 0 ? _argValues_argIndex : []
+                    });
+                    argIndex += 1;
+                } else {
+                    ok = false;
+                    break;
+                }
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
+                }
+            } finally{
+                if (_didIteratorError) {
+                    throw _iteratorError;
+                }
+            }
+        }
+        result = ok ? env : null;
+    }
+    return result;
+}
+/**
+ * Folds a positional argument list to a flat list of fragment streams, expanding any spread
+ * whose operand folds to a list.
+ *
+ * @param callArgs - The call argument nodes.
+ * @param frame - The current scope + environment.
+ * @param depth - Recursion depth guard.
+ * @returns The expanded list, or null when any argument is unfoldable.
+ */ function foldArgumentList(callArgs, frame, depth) {
+    var result = [];
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = callArgs[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var arg = _step.value;
+            if (!result) {
+                break;
+            }
+            if ((arg === null || arg === void 0 ? void 0 : arg.type) === 'SpreadElement') {
+                var list = foldSpreadOperand(arg.argument, frame, depth);
+                result = list ? _to_consumable_array$2(result).concat(_to_consumable_array$2(list)) : null;
+            } else {
+                var frags = foldFrags(arg, frame, depth + 1);
+                result = frags ? _to_consumable_array$2(result).concat([
+                    frags
+                ]) : null;
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Folds the operand of a spread (`...x`) to a list of fragment streams: a list-bound rest
+ * parameter, or an inline array literal.
+ *
+ * @param operand - The spread operand node.
+ * @param frame - The current scope + environment.
+ * @param depth - Recursion depth guard.
+ * @returns The list, or null when the operand is statically unknown.
+ */ function foldSpreadOperand(operand, frame, depth) {
+    var result = null;
+    if ((operand === null || operand === void 0 ? void 0 : operand.type) === 'Identifier') {
+        var bound = frame.env.get(operand.name);
+        if ((bound === null || bound === void 0 ? void 0 : bound.kind) === 'list') {
+            result = bound.items;
+        }
+    } else if ((operand === null || operand === void 0 ? void 0 : operand.type) === 'ArrayExpression') {
+        result = foldList(operand, frame, depth);
+    }
+    return result;
+}
+/**
+ * Folds an array-literal expression to a list of fragment streams, expanding spreads. Returns
+ * null when any element is unfoldable or a spread operand is statically unknown.
+ *
+ * @param node - The ArrayExpression node.
+ * @param frame - The current scope + environment.
+ * @param depth - Recursion depth guard.
+ * @returns The element list, or null.
+ */ function foldList(node, frame, depth) {
+    var result = null;
+    if ((node === null || node === void 0 ? void 0 : node.type) === 'ArrayExpression') {
+        var _node_elements;
+        result = [];
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = ((_node_elements = node.elements) !== null && _node_elements !== void 0 ? _node_elements : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var element = _step.value;
+                if (!result) {
+                    break;
+                }
+                if (element == null) {
+                    result = null;
+                } else if (element.type === 'SpreadElement') {
+                    var list = foldSpreadOperand(element.argument, frame, depth);
+                    result = list ? _to_consumable_array$2(result).concat(_to_consumable_array$2(list)) : null;
+                } else {
+                    var frags = foldFrags(element, frame, depth + 1);
+                    result = frags ? _to_consumable_array$2(result).concat([
+                        frags
+                    ]) : null;
+                }
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
+                }
+            } finally{
+                if (_didIteratorError) {
+                    throw _iteratorError;
+                }
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Returns true when a fragment stream is statically the empty string (no wildcards, no
+ * literal characters) — `mergeSlashPaths`'s `.filter(Boolean)` drops such parts.
+ *
+ * @param frags - The fragment stream.
+ * @returns True when the stream contributes nothing.
+ */ function isStaticallyEmpty(frags) {
+    return frags.every(function(frag) {
+        return frag.kind === 'literal' && frag.value.length === 0;
+    });
+}
+/**
+ * Splits a fragment stream into path segments on `/` boundaries, collapsing empty segments
+ * (so leading/trailing/duplicate slashes vanish, mirroring `mergeSlashPaths` /
+ * `fixMultiSlashesInSlashPath`). A segment containing any wildcard is a wildcard segment.
+ *
+ * @param frags - The fragment stream.
+ * @returns The folded segments.
+ */ function fragsToSegments(frags) {
+    var segments = [];
+    var text = '';
+    var wild = false;
+    var flush = function flush() {
+        if (wild) {
+            segments.push({
+                kind: 'wildcard',
+                value: ''
+            });
+        } else if (text.length > 0) {
+            segments.push({
+                kind: 'literal',
+                value: text
+            });
+        }
+        text = '';
+        wild = false;
+    };
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = frags[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var frag = _step.value;
+            if (frag.kind === 'wildcard') {
+                wild = true;
+            } else {
+                var pieces = frag.value.split(PATH_SEPARATOR);
+                text += pieces[0];
+                for(var i = 1; i < pieces.length; i++){
+                    flush();
+                    text = pieces[i];
+                }
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    flush();
+    return segments;
+}
+/**
+ * Finds a top-level `const`/`let`/`var` declarator's initializer by name in a Program,
+ * looking through `export` wrappers. Used to resolve in-module path consts.
+ *
+ * @param programNode - The Program AST node.
+ * @param name - The declarator name.
+ * @returns The initializer node, or null.
+ */ function findTopLevelConstInit(programNode, name) {
+    var _ref;
+    var result = null;
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = ((_ref = programNode === null || programNode === void 0 ? void 0 : programNode.body) !== null && _ref !== void 0 ? _ref : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var statement = _step.value;
+            var declaration = (statement === null || statement === void 0 ? void 0 : statement.type) === 'ExportNamedDeclaration' ? statement.declaration : statement;
+            if ((declaration === null || declaration === void 0 ? void 0 : declaration.type) === 'VariableDeclaration') {
+                var _declaration_declarations;
+                var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+                try {
+                    for(var _iterator1 = ((_declaration_declarations = declaration.declarations) !== null && _declaration_declarations !== void 0 ? _declaration_declarations : [])[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                        var declarator = _step1.value;
+                        var _declarator_id;
+                        if (((_declarator_id = declarator.id) === null || _declarator_id === void 0 ? void 0 : _declarator_id.type) === 'Identifier' && declarator.id.name === name && declarator.init) {
+                            result = declarator.init;
+                        }
+                    }
+                } catch (err) {
+                    _didIteratorError1 = true;
+                    _iteratorError1 = err;
+                } finally{
+                    try {
+                        if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                            _iterator1.return();
+                        }
+                    } finally{
+                        if (_didIteratorError1) {
+                            throw _iteratorError1;
+                        }
+                    }
+                }
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Finds a top-level function-like binding by name in a Program (function declaration, or a
+ * declarator whose initializer is an arrow / function expression), looking through `export`
+ * wrappers.
+ *
+ * @param programNode - The Program AST node.
+ * @param name - The binding name.
+ * @returns The function-like node, or null.
+ */ function findTopLevelFunction(programNode, name) {
+    var _ref;
+    var result = null;
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = ((_ref = programNode === null || programNode === void 0 ? void 0 : programNode.body) !== null && _ref !== void 0 ? _ref : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var statement = _step.value;
+            var _declaration_id;
+            var declaration = (statement === null || statement === void 0 ? void 0 : statement.type) === 'ExportNamedDeclaration' ? statement.declaration : statement;
+            if ((declaration === null || declaration === void 0 ? void 0 : declaration.type) === 'FunctionDeclaration' && ((_declaration_id = declaration.id) === null || _declaration_id === void 0 ? void 0 : _declaration_id.name) === name) {
+                result = declaration;
+            } else if ((declaration === null || declaration === void 0 ? void 0 : declaration.type) === 'VariableDeclaration') {
+                var _declaration_declarations;
+                var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+                try {
+                    for(var _iterator1 = ((_declaration_declarations = declaration.declarations) !== null && _declaration_declarations !== void 0 ? _declaration_declarations : [])[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                        var declarator = _step1.value;
+                        var _declarator_id;
+                        var init = declarator.init ? unwrapTypeAssertion$1(declarator.init) : null;
+                        if (((_declarator_id = declarator.id) === null || _declarator_id === void 0 ? void 0 : _declarator_id.type) === 'Identifier' && declarator.id.name === name && ((init === null || init === void 0 ? void 0 : init.type) === 'ArrowFunctionExpression' || (init === null || init === void 0 ? void 0 : init.type) === 'FunctionExpression')) {
+                            result = init;
+                        }
+                    }
+                } catch (err) {
+                    _didIteratorError1 = true;
+                    _iteratorError1 = err;
+                } finally{
+                    try {
+                        if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                            _iterator1.return();
+                        }
+                    } finally{
+                        if (_didIteratorError1) {
+                            throw _iteratorError1;
+                        }
+                    }
+                }
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Returns the function-like node for a resolved binding: a function declaration directly, or
+ * the unwrapped arrow / function-expression initializer of a const declarator.
+ *
+ * @param node - The resolved binding node.
+ * @returns The function-like node, or null.
+ */ function functionFromBinding(node) {
+    var result = null;
+    if ((node === null || node === void 0 ? void 0 : node.type) === 'FunctionDeclaration' || (node === null || node === void 0 ? void 0 : node.type) === 'ArrowFunctionExpression' || (node === null || node === void 0 ? void 0 : node.type) === 'FunctionExpression') {
+        result = node;
+    } else if ((node === null || node === void 0 ? void 0 : node.type) === 'VariableDeclarator' && node.init) {
+        var init = unwrapTypeAssertion$1(node.init);
+        if ((init === null || init === void 0 ? void 0 : init.type) === 'ArrowFunctionExpression' || (init === null || init === void 0 ? void 0 : init.type) === 'FunctionExpression') {
+            result = init;
+        }
+    }
+    return result;
+}
+/**
+ * Returns the initializer of a resolved const binding (a declarator node, or an
+ * already-initializer node), unwrapping type assertions.
+ *
+ * @param node - The resolved binding node.
+ * @returns The initializer node, or null.
+ */ function declaratorInit(node) {
+    var result = null;
+    if ((node === null || node === void 0 ? void 0 : node.type) === 'VariableDeclarator' && node.init) {
+        result = unwrapTypeAssertion$1(node.init);
+    } else if (node) {
+        result = unwrapTypeAssertion$1(node);
+    }
+    return result;
+}
+/**
+ * Resolves an imported const/value binding to its declaration in another module.
+ *
+ * @param name - The identifier name.
+ * @param referenceNode - The reference node (for type-checker mapping).
+ * @param scope - The current scope.
+ * @returns The resolved binding, or null.
+ */ function resolveImported(name, referenceNode, scope) {
+    var result = null;
+    if (scope.resolver && scope.importRegistry.localToSource.has(name)) {
+        result = scope.resolver.resolve(name, referenceNode, scope);
+    }
+    return result;
+}
+/**
+ * Resolves a called function to its declaration: first in the current module, then via the
+ * imported-binding resolver.
+ *
+ * @param name - The callee name.
+ * @param calleeNode - The callee reference node.
+ * @param scope - The current scope.
+ * @returns The resolved binding, or null.
+ */ function resolveFunctionBinding(name, calleeNode, scope) {
+    var result = null;
+    var local = findTopLevelFunction(scope.program, name);
+    if (local) {
+        result = {
+            node: local,
+            scope: scope
+        };
+    } else {
+        result = resolveImported(name, calleeNode, scope);
+    }
+    return result;
+}
+/**
+ * Resolves an identifier to the initializer of its `const` declaration: first a top-level const
+ * in the current module, then an imported const in another module via the binding resolver. Reads
+ * the AST initializer — not the checker's type — so annotated-widened / branded consts
+ * (`X: BrandedMime = 'image/jpeg'`) still fold to their literal value.
+ *
+ * @param node - The identifier node.
+ * @param scope - The current scope.
+ * @returns The initializer node + declaring scope, or null when unresolvable.
+ */ function resolveIdentifierInit(node, scope) {
+    var result = null;
+    var local = findTopLevelConstInit(scope.program, node.name);
+    if (local) {
+        result = {
+            init: local,
+            scope: scope
+        };
+    } else {
+        var imported = resolveImported(node.name, node, scope);
+        var init = imported ? declaratorInit(imported.node) : null;
+        if (imported && init) {
+            result = {
+                init: init,
+                scope: imported.scope
+            };
+        }
+    }
+    return result;
+}
+/**
+ * Collapses a fragment stream to a concrete string, returning null when any fragment is a
+ * wildcard (a param/runtime value) — a MIME literal or size constant must be fully known.
+ *
+ * @param frags - The fragment stream.
+ * @returns The concrete string, or null when a wildcard is present.
+ */ function fragsToConcreteString(frags) {
+    var result = null;
+    var text = '';
+    var ok = true;
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = frags[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var frag = _step.value;
+            if (frag.kind === 'wildcard') {
+                ok = false;
+                break;
+            }
+            text += frag.value;
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    if (ok) {
+        result = text;
+    }
+    return result;
+}
+/**
+ * Folds an expression to a list of concrete strings: an inline array literal (each element folded
+ * via {@link foldStringExpression}, spreads of statically-known lists expanded), or an identifier
+ * resolving to such an array const (local or cross-module). Returns null when any element is
+ * unfoldable, so a genuinely dynamic element (e.g. a function call) still surfaces as unresolvable.
+ *
+ * @param node - The expression node (e.g. an `allowedMimeTypes` value).
+ * @param scope - The lexical scope the expression lives in.
+ * @returns The folded string list, or null when unresolvable.
+ */ function foldStringArrayExpression(node, scope) {
+    return foldStringArray(node, scope, 0);
+}
+function foldStringArray(node, scope, depth) {
+    var result = null;
+    if (node && depth <= MAX_FOLD_DEPTH) {
+        var unwrapped = unwrapTypeAssertion$1(node);
+        if ((unwrapped === null || unwrapped === void 0 ? void 0 : unwrapped.type) === 'ArrayExpression') {
+            var items = foldList(unwrapped, {
+                scope: scope,
+                env: new Map()
+            }, depth);
+            result = items ? fragListsToStrings(items) : null;
+        } else if ((unwrapped === null || unwrapped === void 0 ? void 0 : unwrapped.type) === 'Identifier') {
+            var resolved = resolveIdentifierInit(unwrapped, scope);
+            result = resolved ? foldStringArray(resolved.init, resolved.scope, depth + 1) : null;
+        }
+    }
+    return result;
+}
+function fragListsToStrings(items) {
+    var result = [];
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = items[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var item = _step.value;
+            if (!result) {
+                break;
+            }
+            var str = fragsToConcreteString(item);
+            result = str != null ? _to_consumable_array$2(result).concat([
+                str
+            ]) : null;
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Folds a numeric expression to a number: literals, unary `-`/`+`, binary `*`/`+`/`-`/`/`,
+ * type-assertion see-through, and identifiers resolving to a numeric `const` (local or
+ * cross-module, read from the AST initializer). Returns null when any operand is unresolvable.
+ *
+ * @param node - The expression node (e.g. a `maxFileSizeBytes` value).
+ * @param scope - The lexical scope the expression lives in.
+ * @returns The folded number, or null when unresolvable.
+ */ function foldNumericExpression(node, scope) {
+    return foldNumeric(node, scope, 0);
+}
+function foldNumeric(node, scope, depth) {
+    var result = null;
+    if (node && depth <= MAX_FOLD_DEPTH) {
+        if (node.type === 'Literal' && typeof node.value === 'number') {
+            result = node.value;
+        } else if (node.type === 'UnaryExpression' && (node.operator === '-' || node.operator === '+')) {
+            result = foldNumericUnary(node, scope, depth);
+        } else if (node.type === 'BinaryExpression') {
+            result = foldNumericBinary(node, scope, depth);
+        } else if ((node.type === 'TSAsExpression' || node.type === 'TSTypeAssertion' || node.type === 'TSNonNullExpression') && node.expression) {
+            result = foldNumeric(node.expression, scope, depth + 1);
+        } else if (node.type === 'Identifier') {
+            var resolved = resolveIdentifierInit(node, scope);
+            result = resolved ? foldNumeric(resolved.init, resolved.scope, depth + 1) : null;
+        }
+    }
+    return result;
+}
+function foldNumericUnary(node, scope, depth) {
+    var result = null;
+    var arg = foldNumeric(node.argument, scope, depth + 1);
+    if (typeof arg === 'number') {
+        result = node.operator === '-' ? -arg : arg;
+    }
+    return result;
+}
+function foldNumericBinary(node, scope, depth) {
+    var result = null;
+    var left = foldNumeric(node.left, scope, depth + 1);
+    var right = foldNumeric(node.right, scope, depth + 1);
+    if (typeof left === 'number' && typeof right === 'number') {
+        result = applyNumericOperator(node.operator, left, right);
+    }
+    return result;
+}
+function applyNumericOperator(operator, left, right) {
+    var result = null;
+    if (operator === '*') {
+        result = left * right;
+    } else if (operator === '+') {
+        result = left + right;
+    } else if (operator === '-') {
+        result = left - right;
+    } else if (operator === '/' && right !== 0) {
+        result = left / right;
+    }
+    return result;
+}
+/**
+ * Structurally compares a folded upload path against a Firebase rules match-path segment list
+ * (`{var}` / `{var=**}` → wildcard, otherwise literal). Literal segments must match value;
+ * wildcard segments compare equal to one another.
+ *
+ * @param folded - The folded upload path.
+ * @param ruleSegments - The rules match-path segments.
+ * @returns True when the two segment lists match position-for-position.
+ */ function foldedPathMatchesRuleSegments(folded, ruleSegments) {
+    var result = folded.segments.length === ruleSegments.length;
+    for(var i = 0; result && i < folded.segments.length; i++){
+        var a = folded.segments[i];
+        var b = ruleSegments[i];
+        if (a.kind !== b.kind) {
+            result = false;
+        } else if (a.kind === 'literal' && a.value !== b.value) {
+            result = false;
+        }
+    }
+    return result;
+}
+/**
+ * Renders a folded path for diagnostics, e.g. `uploads/u/{*}/jr/{*}`.
+ *
+ * @param folded - The folded path.
+ * @returns The display string.
+ */ function describeFoldedPath(folded) {
+    return folded.segments.map(function(segment) {
+        return segment.kind === 'wildcard' ? '{*}' : segment.value;
+    }).join(PATH_SEPARATOR);
+}
+
+/**
+ * Builds an {@link ImportedBindingResolver} backed by the TypeScript type checker, or null when
+ * type information is unavailable (e.g. a lint config without `parserOptions.project`, or a
+ * pure-AST test harness). The resolver performs a single hop: it maps an imported identifier in
+ * the linted file to the declaration's source file, re-parses that file to ESTree (cached), and
+ * returns the named binding plus that module's scope. Identifiers local to the resolved module
+ * fold via the re-parsed program directly; transitive re-imports from a third module are not
+ * followed.
+ *
+ * Every failure mode (no symbol, unreadable file, parse error, identifier from an already
+ * re-parsed module) returns null so the analyzer falls back to reporting an unresolvable path —
+ * it never throws into the lint pass.
+ *
+ * @param services - The parser services, when present.
+ * @returns A resolver, or null when type information is unavailable.
+ */ function createImportedBindingResolver(services) {
+    var result = null;
+    if ((services === null || services === void 0 ? void 0 : services.program) && services.esTreeNodeToTSNodeMap) {
+        var moduleCache = new Map();
+        result = {
+            resolve: function resolve(name, referenceNode, fromScope) {
+                return resolveBinding({
+                    name: name,
+                    referenceNode: referenceNode,
+                    fromScope: fromScope,
+                    services: services,
+                    moduleCache: moduleCache
+                });
+            }
+        };
+    }
+    return result;
+}
+function resolveBinding(input) {
+    var name = input.name, referenceNode = input.referenceNode, services = input.services, moduleCache = input.moduleCache;
+    var result = null;
+    try {
+        var fileName = declarationSourceFile(referenceNode, services);
+        if (fileName) {
+            var parsedModule = loadModule(fileName, moduleCache);
+            var node = parsedModule ? findExportedBinding(parsedModule.program, name) : null;
+            if (parsedModule && node) {
+                result = {
+                    node: node,
+                    scope: {
+                        program: parsedModule.program,
+                        importRegistry: parsedModule.importRegistry,
+                        resolver: input.fromScope.resolver
+                    }
+                };
+            }
+        }
+    } catch (unused) {
+        result = null;
+    }
+    return result;
+}
+/**
+ * Maps a reference identifier to the absolute path of its declaration's source file via the
+ * type checker, following an import alias when present. Returns null when the reference is not
+ * in the current file's node map (e.g. it came from an already re-parsed module) or has no
+ * resolvable declaration.
+ *
+ * @param referenceNode - The ESTree reference node in the linted file.
+ * @param services - The parser services.
+ * @returns The declaration's source file path, or null.
+ */ function declarationSourceFile(referenceNode, services) {
+    var _ref;
+    var _services_esTreeNodeToTSNodeMap;
+    var result = null;
+    var tsNode = (_ref = (_services_esTreeNodeToTSNodeMap = services.esTreeNodeToTSNodeMap) === null || _services_esTreeNodeToTSNodeMap === void 0 ? void 0 : _services_esTreeNodeToTSNodeMap.get(referenceNode)) !== null && _ref !== void 0 ? _ref : null;
+    if (tsNode) {
+        var _ref1, _ref2, _ref3, _ref4;
+        var _services_program;
+        var checker = (_services_program = services.program) === null || _services_program === void 0 ? void 0 : _services_program.getTypeChecker();
+        var symbol = aliasedSymbol(checker, checker.getSymbolAtLocation(tsNode));
+        var declarations = (_ref1 = symbol === null || symbol === void 0 ? void 0 : symbol.getDeclarations()) !== null && _ref1 !== void 0 ? _ref1 : null;
+        var declaration = (_ref2 = (_ref3 = declarations === null || declarations === void 0 ? void 0 : declarations.find(function(decl) {
+            return isValueDeclarationKind(decl.kind);
+        })) !== null && _ref3 !== void 0 ? _ref3 : declarations === null || declarations === void 0 ? void 0 : declarations[0]) !== null && _ref2 !== void 0 ? _ref2 : null;
+        result = (_ref4 = declaration === null || declaration === void 0 ? void 0 : declaration.getSourceFile().fileName) !== null && _ref4 !== void 0 ? _ref4 : null;
+    }
+    return result;
+}
+function aliasedSymbol(checker, symbol) {
+    var result = symbol;
+    if (symbol) {
+        try {
+            var _checker_getAliasedSymbol;
+            result = (_checker_getAliasedSymbol = checker.getAliasedSymbol(symbol)) !== null && _checker_getAliasedSymbol !== void 0 ? _checker_getAliasedSymbol : symbol;
+        } catch (unused) {
+            result = symbol;
+        }
+    }
+    return result;
+}
+/**
+ * TS `SyntaxKind` values for the declarations we fold: `VariableDeclaration` (244) and
+ * `FunctionDeclaration` (262) in TypeScript 5.x. Other kinds (interfaces, type aliases) carry no
+ * foldable value.
+ *
+ * @param kind - The TS `SyntaxKind` numeric value.
+ * @returns True when the declaration kind can carry a foldable value.
+ */ function isValueDeclarationKind(kind) {
+    return kind === 244 || kind === 262;
+}
+/**
+ * Reads and parses a module to ESTree, indexing its imports, caching by absolute path. A
+ * `null` cache entry records an unreadable/unparsable file so repeated lookups stay cheap.
+ *
+ * @param fileName - The absolute module path.
+ * @param cache - The per-resolver module cache.
+ * @returns The parsed module, or null.
+ */ function loadModule(fileName, cache) {
+    var result;
+    if (cache.has(fileName)) {
+        var _cache_get;
+        result = (_cache_get = cache.get(fileName)) !== null && _cache_get !== void 0 ? _cache_get : null;
+    } else {
+        result = null;
+        try {
+            var _program_body;
+            var source = node_fs.readFileSync(fileName, 'utf8');
+            var program = typescriptEstree.parse(source, {
+                range: true,
+                loc: true,
+                jsx: false
+            });
+            var importRegistry = createImportRegistry();
+            var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+            try {
+                for(var _iterator = ((_program_body = program.body) !== null && _program_body !== void 0 ? _program_body : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                    var statement = _step.value;
+                    if ((statement === null || statement === void 0 ? void 0 : statement.type) === 'ImportDeclaration') {
+                        trackImportDeclaration(importRegistry, statement);
+                    }
+                }
+            } catch (err) {
+                _didIteratorError = true;
+                _iteratorError = err;
+            } finally{
+                try {
+                    if (!_iteratorNormalCompletion && _iterator.return != null) {
+                        _iterator.return();
+                    }
+                } finally{
+                    if (_didIteratorError) {
+                        throw _iteratorError;
+                    }
+                }
+            }
+            result = {
+                program: program,
+                importRegistry: importRegistry
+            };
+        } catch (unused) {
+            result = null;
+        }
+        cache.set(fileName, result);
+    }
+    return result;
+}
+/**
+ * Finds the named top-level binding in a re-parsed module: the matching `VariableDeclarator`
+ * (with initializer) or `FunctionDeclaration`, looking through `export` wrappers.
+ *
+ * @param programNode - The module's Program node.
+ * @param name - The binding name.
+ * @returns The binding node, or null.
+ */ function findExportedBinding(programNode, name) {
+    var _ref;
+    var result = null;
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = ((_ref = programNode === null || programNode === void 0 ? void 0 : programNode.body) !== null && _ref !== void 0 ? _ref : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var statement = _step.value;
+            var _declaration_id;
+            var declaration = (statement === null || statement === void 0 ? void 0 : statement.type) === 'ExportNamedDeclaration' ? statement.declaration : statement;
+            if ((declaration === null || declaration === void 0 ? void 0 : declaration.type) === 'FunctionDeclaration' && ((_declaration_id = declaration.id) === null || _declaration_id === void 0 ? void 0 : _declaration_id.name) === name) {
+                result = declaration;
+            } else if ((declaration === null || declaration === void 0 ? void 0 : declaration.type) === 'VariableDeclaration') {
+                var _declaration_declarations;
+                var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+                try {
+                    for(var _iterator1 = ((_declaration_declarations = declaration.declarations) !== null && _declaration_declarations !== void 0 ? _declaration_declarations : [])[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                        var declarator = _step1.value;
+                        var _declarator_id;
+                        if (((_declarator_id = declarator.id) === null || _declarator_id === void 0 ? void 0 : _declarator_id.type) === 'Identifier' && declarator.id.name === name && declarator.init) {
+                            result = declarator;
+                        }
+                    }
+                } catch (err) {
+                    _didIteratorError1 = true;
+                    _iteratorError1 = err;
+                } finally{
+                    try {
+                        if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                            _iterator1.return();
+                        }
+                    } finally{
+                        if (_didIteratorError1) {
+                            throw _iteratorError1;
+                        }
+                    }
+                }
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
         try {
             if (!_iteratorNormalCompletion && _iterator.return != null) {
                 _iterator.return();
@@ -12588,10 +13851,68 @@ function evaluateStringArrayLiteral(node) {
             }
         }
     }
-    return {
-        numericConstants: numericConstants,
-        stringArrayConstants: stringArrayConstants
-    };
+    return result;
+}
+
+/**
+ * Default type name the rule looks for on top-level declarators. Variables whose type
+ * annotation resolves to this identifier are treated as upload policies and validated
+ * against `storage.rules`.
+ */ var DEFAULT_STORAGE_FILE_UPLOAD_POLICY_TYPE_NAME = 'StorageFilePurposeUploadPolicy';
+/**
+ * Default file name searched relative to the lint root when `storageRulesPath` is omitted.
+ */ var DEFAULT_STORAGE_RULES_FILENAME = 'storage.rules';
+var rulesFileCache = new Map();
+/**
+ * Reads and parses a `storage.rules` file, caching by absolute path so repeated rule
+ * activations across files in the same lint pass don't re-read disk.
+ *
+ * @param absolutePath - Absolute path to the rules file.
+ * @returns The parsed blocks, or null when the file cannot be read.
+ */ function loadParsedRulesFromPath(absolutePath) {
+    var result = null;
+    var cached = rulesFileCache.get(absolutePath);
+    if (cached) {
+        result = cached;
+    } else {
+        try {
+            var source = node_fs.readFileSync(absolutePath, 'utf8');
+            var parsed = parseStorageRules(source);
+            rulesFileCache.set(absolutePath, parsed);
+            result = parsed;
+        } catch (unused) {
+            result = null;
+        }
+    }
+    return result;
+}
+/**
+ * Extracts the cross-reference key used to pair a policy with its `storage.rules` `Mirrors`
+ * block.
+ *
+ * - When `purpose` is an `Identifier`, the constant name (e.g. `USER_AVATAR_PURPOSE`) is the
+ *   key — this is what `// Mirrors STORAGE_FILE_PURPOSE_UPLOAD_POLICIES[USER_AVATAR_PURPOSE]`
+ *   comments reference.
+ * - When `purpose` is a string literal, the literal value is used so a policy that inlines
+ *   `purpose: 'avatar'` can still pair with `Mirrors ...[avatar]`.
+ * - `TSAsExpression` is unwrapped transparently.
+ * - Anything else (computed expression, member access, function call) returns null and
+ *   triggers `unresolvedPolicyField`.
+ *
+ * @param node - The expression node for the policy's `purpose` field.
+ * @returns The mirror-cross-reference key, or null when unresolvable.
+ */ function extractPolicyKey(node) {
+    var result = null;
+    if (node) {
+        if (node.type === 'Identifier') {
+            result = node.name;
+        } else if (node.type === 'Literal' && typeof node.value === 'string') {
+            result = node.value;
+        } else if (node.type === 'TSAsExpression' && node.expression) {
+            result = extractPolicyKey(node.expression);
+        }
+    }
+    return result;
 }
 /**
  * Collects every `VariableDeclarator` directly under the Program body, looking through
@@ -12705,18 +14026,24 @@ function unwrapVariableDeclaration$1(statement) {
     return matched;
 }
 /**
- * Pulls `purpose`, `maxFileSizeBytes`, and `allowedMimeTypes` from a policy declarator's
- * object literal, folding numeric / string / string-array references via `constants`.
+ * Pulls `purpose`, `maxFileSizeBytes`, and `allowedMimeTypes` from a policy declarator's object
+ * literal. `maxFileSizeBytes` and `allowedMimeTypes` are folded with the same scope-based scalar
+ * folders the path evaluator uses, so an imported / annotated-widened const (e.g. a branded MIME
+ * constant from `@dereekb/util`) resolves to its literal value via the AST initializer rather than
+ * bailing on the checker's widened type.
  *
  * @param declarator - The policy declarator (e.g. `USER_AVATAR_UPLOAD_POLICY = {...}`).
- * @param constants - The Program constants index.
+ * @param scope - The fold scope (import registry + cross-module resolver) for the linted file.
  * @returns The resolved policy with folded values.
- */ function buildResolvedPolicy(declarator, constants) {
+ */ function buildResolvedPolicy(declarator, scope) {
+    var _declarator_id;
     var init = declarator.init;
     while((init === null || init === void 0 ? void 0 : init.type) === 'TSAsExpression'){
         init = init.expression;
     }
+    var declaratorName = ((_declarator_id = declarator.id) === null || _declarator_id === void 0 ? void 0 : _declarator_id.type) === 'Identifier' ? declarator.id.name : null;
     var policyKey = null;
+    var buildUploadPathNode = null;
     var maxFileSizeBytes = null;
     var allowedMimeTypes = null;
     if ((init === null || init === void 0 ? void 0 : init.type) === 'ObjectExpression') {
@@ -12729,10 +14056,12 @@ function unwrapVariableDeclaration$1(statement) {
                 if (property.type === 'Property' && ((_property_key = property.key) === null || _property_key === void 0 ? void 0 : _property_key.type) === 'Identifier' && !property.computed) {
                     if (property.key.name === 'purpose') {
                         policyKey = extractPolicyKey(property.value);
+                    } else if (property.key.name === 'buildUploadPath') {
+                        buildUploadPathNode = property.value;
                     } else if (property.key.name === 'maxFileSizeBytes') {
-                        maxFileSizeBytes = evaluateNumericNode(property.value, constants.numericConstants);
+                        maxFileSizeBytes = foldNumericExpression(property.value, scope);
                     } else if (property.key.name === 'allowedMimeTypes') {
-                        allowedMimeTypes = evaluateStringArrayNode(property.value, constants.stringArrayConstants);
+                        allowedMimeTypes = foldStringArrayExpression(property.value, scope);
                     }
                 }
             }
@@ -12753,7 +14082,9 @@ function unwrapVariableDeclaration$1(statement) {
     }
     return {
         policyKey: policyKey,
+        declaratorName: declaratorName,
         policyDeclaratorNode: declarator,
+        buildUploadPathNode: buildUploadPathNode,
         maxFileSizeBytes: maxFileSizeBytes,
         allowedMimeTypes: allowedMimeTypes
     };
@@ -12847,17 +14178,25 @@ function unwrapVariableDeclaration$1(statement) {
 }
 /**
  * ESLint rule that cross-checks every `StorageFilePurposeUploadPolicy`-typed declaration in
- * a `*-firebase` component against the workspace's `storage.rules`. Each policy must have a
- * paired `// Mirrors STORAGE_FILE_PURPOSE_UPLOAD_POLICIES[<KEY>]` match block whose
- * `request.resource.size` cap and `request.resource.contentType` predicate are at least as
- * permissive as the TypeScript policy's `maxFileSizeBytes` and `allowedMimeTypes`.
+ * a `*-firebase` component against the workspace's `storage.rules`. The policy's
+ * `buildUploadPath` builder is statically folded to a concrete path template (an ordered list
+ * of literal / wildcard segments) and paired with the `storage.rules` `allow write` match
+ * block at the same path. On the paired block the `request.resource.size` cap and
+ * `request.resource.contentType` predicate must be at least as permissive as the policy's
+ * `maxFileSizeBytes` and `allowedMimeTypes`.
+ *
+ * Pairing is derived from the resolved path — not a marker comment — so the linker proves the
+ * policy's actual upload path lands in the rules block rather than trusting an unchecked
+ * assertion. When the builder cannot be folded (unknown const, unmodeled call, runtime value)
+ * the rule reports `unresolvablePolicyPath` and never guesses; genuinely dynamic builders opt
+ * out via `allowUnresolvablePolicies`.
  *
  * Reports on the TS side so drift surfaces in the normal lint pipeline; mismatches almost
  * always originate from editing one side and forgetting the other.
  *
  * @example
  * ```ts
- * // OK — storage.rules has `Mirrors ...[USER_AVATAR_PURPOSE]` block with matching constraints
+ * // OK — storage.rules has `match /uploads/u/{uid}/avatar.img` with matching constraints
  * export const USER_AVATAR_UPLOAD_POLICY: StorageFilePurposeUploadPolicy = {
  *   purpose: USER_AVATAR_PURPOSE,
  *   allowedMimeTypes: ['image/jpeg', 'image/png'],
@@ -12875,13 +14214,13 @@ function unwrapVariableDeclaration$1(statement) {
             recommended: true
         },
         messages: {
-            maxFileSizeMismatch: "Upload policy '{{policy}}' has maxFileSizeBytes {{tsValue}} but storage.rules allows < {{rulesValue}} for MIME type '{{mime}}'. Update either side so the rules cap matches or exceeds the policy cap.",
-            mimeTypeNotAllowed: "Upload policy '{{policy}}' allows MIME type '{{mime}}' but no storage.rules branch under 'Mirrors STORAGE_FILE_PURPOSE_UPLOAD_POLICIES[{{policy}}]' accepts it.",
-            missingRuleBlock: "Upload policy '{{policy}}' has no matching '// Mirrors STORAGE_FILE_PURPOSE_UPLOAD_POLICIES[{{policy}}]' block in storage.rules at {{path}}.",
-            orphanRuleBlock: "storage.rules block 'Mirrors STORAGE_FILE_PURPOSE_UPLOAD_POLICIES[{{policy}}]' (line {{line}}) has no matching StorageFilePurposeUploadPolicy declaration in this file.",
-            unsupportedRuleShape: "storage.rules block for '{{policy}}' (line {{line}}) could not be parsed: {{reason}}. Refactor the rule or extend the validator.",
+            maxFileSizeMismatch: "Upload policy '{{policy}}' has maxFileSizeBytes {{tsValue}} but storage.rules allows < {{rulesValue}} for MIME type '{{mime}}' at path '{{path}}'. Update either side so the rules cap matches or exceeds the policy cap.",
+            mimeTypeNotAllowed: "Upload policy '{{policy}}' allows MIME type '{{mime}}' but no storage.rules branch at path '{{path}}' accepts it.",
+            noMatchingRuleBlock: "Upload policy '{{policy}}' resolves to upload path '{{path}}' but storage.rules has no matching `allow write` match block. Add a match block for that path or fix the path builder.",
+            unsupportedRuleShape: "storage.rules block at path '{{path}}' (line {{line}}) could not be parsed: {{reason}}. Refactor the rule or extend the validator.",
             rulesFileMissing: 'Could not read storage.rules at {{path}}. Set the rule option `storageRulesPath` or place the file at the workspace root.',
-            unresolvedPolicyField: 'Upload policy{{policyLabel}} has unresolvable {{field}}; the rule cannot statically fold the value to compare against storage.rules.'
+            unresolvedPolicyField: 'Upload policy{{policyLabel}} has unresolvable {{field}}; the rule cannot statically fold the value to compare against storage.rules.',
+            unresolvablePolicyPath: "Upload policy '{{policy}}' has a buildUploadPath that cannot be statically folded to a concrete path: {{reason}}. Make the builder a composition of literals, consts, and @dereekb/util path combinators, or add the purpose/declarator name to the `allowUnresolvablePolicies` option."
         },
         schema: [
             {
@@ -12896,54 +14235,116 @@ function unwrapVariableDeclaration$1(statement) {
                     },
                     policyTypeName: {
                         type: 'string'
+                    },
+                    allowUnresolvablePolicies: {
+                        type: 'array',
+                        items: {
+                            type: 'string'
+                        }
                     }
                 }
             }
         ]
     },
     create: function create(context) {
-        var _context_options_, _options_policyTypeName, _context_cwd;
+        var _context_options_, _options_policyTypeName, _context_cwd, _options_allowUnresolvablePolicies;
         var options = (_context_options_ = context.options[0]) !== null && _context_options_ !== void 0 ? _context_options_ : {};
         var policyTypeName = (_options_policyTypeName = options.policyTypeName) !== null && _options_policyTypeName !== void 0 ? _options_policyTypeName : DEFAULT_STORAGE_FILE_UPLOAD_POLICY_TYPE_NAME;
         var cwd = (_context_cwd = context.cwd) !== null && _context_cwd !== void 0 ? _context_cwd : process.cwd();
+        var allowUnresolvable = new Set((_options_allowUnresolvablePolicies = options.allowUnresolvablePolicies) !== null && _options_allowUnresolvablePolicies !== void 0 ? _options_allowUnresolvablePolicies : []);
         return {
             Program: function Program(programNode) {
-                var _rulesResolution_blocks, _rulesResolution_absolutePath;
+                var _rulesResolution_blocks;
                 var typedDeclarators = collectTypedPolicyDeclarators(programNode, policyTypeName);
                 if (typedDeclarators.length === 0) return;
                 var rulesResolution = loadParsedRules(options, cwd);
                 if (rulesResolution.error) {
-                    var _rulesResolution_absolutePath1;
+                    var _rulesResolution_absolutePath;
                     context.report({
                         node: typedDeclarators[0],
                         messageId: 'rulesFileMissing',
                         data: {
-                            path: (_rulesResolution_absolutePath1 = rulesResolution.absolutePath) !== null && _rulesResolution_absolutePath1 !== void 0 ? _rulesResolution_absolutePath1 : DEFAULT_STORAGE_RULES_FILENAME
+                            path: (_rulesResolution_absolutePath = rulesResolution.absolutePath) !== null && _rulesResolution_absolutePath !== void 0 ? _rulesResolution_absolutePath : DEFAULT_STORAGE_RULES_FILENAME
                         }
                     });
                     return;
                 }
                 var parsedBlocks = (_rulesResolution_blocks = rulesResolution.blocks) !== null && _rulesResolution_blocks !== void 0 ? _rulesResolution_blocks : [];
-                var constants = indexProgramConstants(programNode);
+                var scope = buildFoldScope(programNode, context);
                 var resolvedPolicies = typedDeclarators.map(function(declarator) {
-                    return buildResolvedPolicy(declarator, constants);
-                });
-                compareResolvedPolicies({
-                    resolvedPolicies: resolvedPolicies,
-                    parsedBlocks: parsedBlocks,
-                    rulesPath: (_rulesResolution_absolutePath = rulesResolution.absolutePath) !== null && _rulesResolution_absolutePath !== void 0 ? _rulesResolution_absolutePath : DEFAULT_STORAGE_RULES_FILENAME,
-                    context: context
-                });
-                reportOrphanRuleBlocks({
-                    parsedBlocks: parsedBlocks,
-                    resolvedPolicies: resolvedPolicies,
-                    programNode: programNode,
-                    context: context
+                    return buildResolvedPolicy(declarator, scope);
                 });
+                var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                try {
+                    for(var _iterator = resolvedPolicies[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                        var policy = _step.value;
+                        evaluatePolicy({
+                            policy: policy,
+                            parsedBlocks: parsedBlocks,
+                            scope: scope,
+                            allowUnresolvable: allowUnresolvable,
+                            context: context
+                        });
+                    }
+                } catch (err) {
+                    _didIteratorError = true;
+                    _iteratorError = err;
+                } finally{
+                    try {
+                        if (!_iteratorNormalCompletion && _iterator.return != null) {
+                            _iterator.return();
+                        }
+                    } finally{
+                        if (_didIteratorError) {
+                            throw _iteratorError;
+                        }
+                    }
+                }
             }
         };
     }
 };
+/**
+ * Builds the {@link FoldScope} for the linted file: the module's import registry plus a
+ * type-checker-backed cross-module resolver when parser services are available (a no-op
+ * resolver otherwise, so pure-AST folding still works).
+ *
+ * @param programNode - The Program AST node.
+ * @param context - The ESLint rule context.
+ * @returns The fold scope.
+ */ function buildFoldScope(programNode, context) {
+    var _programNode_body, _ref, _ref1;
+    var _context_sourceCode;
+    var importRegistry = createImportRegistry();
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = ((_programNode_body = programNode.body) !== null && _programNode_body !== void 0 ? _programNode_body : [])[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var statement = _step.value;
+            if ((statement === null || statement === void 0 ? void 0 : statement.type) === 'ImportDeclaration') {
+                trackImportDeclaration(importRegistry, statement);
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    var services = (_ref = (_ref1 = (_context_sourceCode = context.sourceCode) === null || _context_sourceCode === void 0 ? void 0 : _context_sourceCode.parserServices) !== null && _ref1 !== void 0 ? _ref1 : context.parserServices) !== null && _ref !== void 0 ? _ref : null;
+    return {
+        program: programNode,
+        importRegistry: importRegistry,
+        resolver: createImportedBindingResolver(services)
+    };
+}
 /**
  * Loads parsed `storage.rules` blocks from either the inline `virtualStorageRules` option
  * (used by specs) or the resolved rules-file path.
@@ -12975,17 +14376,123 @@ function unwrapVariableDeclaration$1(statement) {
     return result;
 }
 /**
- * Reports each resolved policy that mismatches the parsed `storage.rules` blocks.
+ * Returns the human-readable label for a policy in diagnostics: its `purpose` key, else its
+ * declarator name, else a placeholder.
+ *
+ * @param policy - The resolved policy.
+ * @returns The display label.
+ */ function policyLabelOf(policy) {
+    var _ref, _policy_policyKey;
+    return (_ref = (_policy_policyKey = policy.policyKey) !== null && _policy_policyKey !== void 0 ? _policy_policyKey : policy.declaratorName) !== null && _ref !== void 0 ? _ref : '(anonymous policy)';
+}
+/**
+ * Returns true when a policy is opted out of path folding via `allowUnresolvablePolicies`
+ * (matched by `purpose` key or declarator name).
+ *
+ * @param policy - The resolved policy.
+ * @param allowUnresolvable - The opt-out set.
+ * @returns True when the policy is exempt from `unresolvablePolicyPath`.
+ */ function isPolicyOptedOut(policy, allowUnresolvable) {
+    return typeof policy.policyKey === 'string' && allowUnresolvable.has(policy.policyKey) || typeof policy.declaratorName === 'string' && allowUnresolvable.has(policy.declaratorName);
+}
+/**
+ * Folds one policy's `buildUploadPath`, pairs it with the matching `storage.rules` leaf block
+ * by path, then cross-checks the block's size + MIME constraints. Reports the first failure on
+ * the policy declarator; an unfoldable builder reports `unresolvablePolicyPath` unless opted out.
+ *
+ * @param input - The policy, parsed blocks, fold scope, opt-out set, and ESLint context.
+ */ function evaluatePolicy(input) {
+    var policy = input.policy, parsedBlocks = input.parsedBlocks, scope = input.scope, allowUnresolvable = input.allowUnresolvable, context = input.context;
+    var label = policyLabelOf(policy);
+    var fold = policy.buildUploadPathNode ? foldUploadPath(policy.buildUploadPathNode, scope) : {
+        ok: false,
+        reason: 'policy has no buildUploadPath property'
+    };
+    if (!fold.ok) {
+        if (!isPolicyOptedOut(policy, allowUnresolvable)) {
+            context.report({
+                node: policy.policyDeclaratorNode,
+                messageId: 'unresolvablePolicyPath',
+                data: {
+                    policy: label,
+                    reason: fold.reason
+                }
+            });
+        }
+        return;
+    }
+    var folded = fold.path;
+    var pathDisplay = describeFoldedPath(folded);
+    var block = findMatchingBlock(parsedBlocks, folded);
+    if (!block) {
+        context.report({
+            node: policy.policyDeclaratorNode,
+            messageId: 'noMatchingRuleBlock',
+            data: {
+                policy: label,
+                path: pathDisplay
+            }
+        });
+        return;
+    }
+    if (block.unsupported) {
+        context.report({
+            node: policy.policyDeclaratorNode,
+            messageId: 'unsupportedRuleShape',
+            data: {
+                path: pathDisplay,
+                line: String(block.sourceLine),
+                reason: block.unsupported
+            }
+        });
+        return;
+    }
+    if (typeof policy.maxFileSizeBytes !== 'number') {
+        context.report({
+            node: policy.policyDeclaratorNode,
+            messageId: 'unresolvedPolicyField',
+            data: {
+                policyLabel: " '".concat(label, "'"),
+                field: 'maxFileSizeBytes'
+            }
+        });
+        return;
+    }
+    if (!policy.allowedMimeTypes) {
+        context.report({
+            node: policy.policyDeclaratorNode,
+            messageId: 'unresolvedPolicyField',
+            data: {
+                policyLabel: " '".concat(label, "'"),
+                field: 'allowedMimeTypes'
+            }
+        });
+        return;
+    }
+    comparePolicyToBlock({
+        policyLabel: label,
+        pathDisplay: pathDisplay,
+        policy: policy,
+        block: block,
+        context: context
+    });
+}
+/**
+ * Finds the first parsed leaf block whose match path structurally matches the folded upload
+ * path (literal==literal, wildcard=={var}).
  *
- * @param input - Bundle of resolved policies, parsed blocks, rules path, and ESLint context.
- */ function compareResolvedPolicies(input) {
-    var resolvedPolicies = input.resolvedPolicies, parsedBlocks = input.parsedBlocks, rulesPath = input.rulesPath, context = input.context;
-    var blocksByKey = new Map();
+ * @param parsedBlocks - The parsed leaf blocks.
+ * @param folded - The folded upload path.
+ * @returns The matching block, or null.
+ */ function findMatchingBlock(parsedBlocks, folded) {
+    var result = null;
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
     try {
         for(var _iterator = parsedBlocks[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
             var block = _step.value;
-            blocksByKey.set(block.mirrorsPolicyKey, block);
+            if (!result && foldedPathMatchesRuleSegments(folded, rulesMatchPathToSegments(block.matchPath))) {
+                result = block;
+            }
         }
     } catch (err) {
         _didIteratorError = true;
@@ -12996,102 +14503,20 @@ function unwrapVariableDeclaration$1(statement) {
                 _iterator.return();
             }
         } finally{
-            if (_didIteratorError) {
-                throw _iteratorError;
-            }
-        }
-    }
-    var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
-    try {
-        for(var _iterator1 = resolvedPolicies[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-            var policy = _step1.value;
-            if (typeof policy.policyKey !== 'string') {
-                context.report({
-                    node: policy.policyDeclaratorNode,
-                    messageId: 'unresolvedPolicyField',
-                    data: {
-                        policyLabel: '',
-                        field: 'purpose'
-                    }
-                });
-                continue;
-            }
-            var policyKey = policy.policyKey;
-            var block1 = blocksByKey.get(policyKey);
-            if (!block1) {
-                context.report({
-                    node: policy.policyDeclaratorNode,
-                    messageId: 'missingRuleBlock',
-                    data: {
-                        policy: policyKey,
-                        path: rulesPath
-                    }
-                });
-                continue;
-            }
-            if (block1.unsupported) {
-                context.report({
-                    node: policy.policyDeclaratorNode,
-                    messageId: 'unsupportedRuleShape',
-                    data: {
-                        policy: policyKey,
-                        line: String(block1.sourceLine),
-                        reason: block1.unsupported
-                    }
-                });
-                continue;
-            }
-            if (typeof policy.maxFileSizeBytes !== 'number') {
-                context.report({
-                    node: policy.policyDeclaratorNode,
-                    messageId: 'unresolvedPolicyField',
-                    data: {
-                        policyLabel: " '".concat(policyKey, "'"),
-                        field: 'maxFileSizeBytes'
-                    }
-                });
-                continue;
-            }
-            if (!policy.allowedMimeTypes) {
-                context.report({
-                    node: policy.policyDeclaratorNode,
-                    messageId: 'unresolvedPolicyField',
-                    data: {
-                        policyLabel: " '".concat(policyKey, "'"),
-                        field: 'allowedMimeTypes'
-                    }
-                });
-                continue;
-            }
-            comparePolicyToBlock({
-                policyKey: policyKey,
-                policy: policy,
-                block: block1,
-                context: context
-            });
-        }
-    } catch (err) {
-        _didIteratorError1 = true;
-        _iteratorError1 = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
-                _iterator1.return();
-            }
-        } finally{
-            if (_didIteratorError1) {
-                throw _iteratorError1;
+            if (_didIteratorError) {
+                throw _iteratorError;
             }
         }
     }
+    return result;
 }
 /**
  * Validates that each MIME the policy permits is accepted by at least one branch and that
  * the branch's size cap is ≥ the policy cap. Emits ESLint reports for any mismatch.
  *
- * @param input - Policy/block pair plus the ESLint context.
+ * @param input - Policy/block pair, the display path, and the ESLint context.
  */ function comparePolicyToBlock(input) {
-    var policyKey = input.policyKey, policy = input.policy, block = input.block, context = input.context;
+    var policyLabel = input.policyLabel, pathDisplay = input.pathDisplay, policy = input.policy, block = input.block, context = input.context;
     var tsCap = policy.maxFileSizeBytes;
     var mimes = policy.allowedMimeTypes;
     var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
@@ -13104,8 +14529,9 @@ function unwrapVariableDeclaration$1(statement) {
                     node: policy.policyDeclaratorNode,
                     messageId: 'mimeTypeNotAllowed',
                     data: {
-                        policy: policyKey,
-                        mime: mime
+                        policy: policyLabel,
+                        mime: mime,
+                        path: pathDisplay
                     }
                 });
             } else {
@@ -13137,10 +14563,11 @@ function unwrapVariableDeclaration$1(statement) {
                         node: policy.policyDeclaratorNode,
                         messageId: 'maxFileSizeMismatch',
                         data: {
-                            policy: policyKey,
+                            policy: policyLabel,
                             tsValue: String(tsCap),
                             rulesValue: String(largest),
-                            mime: mime
+                            mime: mime,
+                            path: pathDisplay
                         }
                     });
                 }
@@ -13161,75 +14588,14 @@ function unwrapVariableDeclaration$1(statement) {
         }
     }
 }
-/**
- * Reports each parsed rules block whose `mirrorsPolicyKey` has no corresponding typed
- * declaration in this file — signals stale `Mirrors ...` markers left over after a policy
- * was removed.
- *
- * @param input - Parsed blocks, resolved policies, program node, and ESLint context.
- */ function reportOrphanRuleBlocks(input) {
-    var parsedBlocks = input.parsedBlocks, resolvedPolicies = input.resolvedPolicies, programNode = input.programNode, context = input.context;
-    var knownKeys = new Set();
-    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-    try {
-        for(var _iterator = resolvedPolicies[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var policy = _step.value;
-            if (typeof policy.policyKey === 'string') {
-                knownKeys.add(policy.policyKey);
-            }
-        }
-    } catch (err) {
-        _didIteratorError = true;
-        _iteratorError = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion && _iterator.return != null) {
-                _iterator.return();
-            }
-        } finally{
-            if (_didIteratorError) {
-                throw _iteratorError;
-            }
-        }
-    }
-    var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
-    try {
-        for(var _iterator1 = parsedBlocks[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-            var block = _step1.value;
-            if (!knownKeys.has(block.mirrorsPolicyKey)) {
-                context.report({
-                    node: programNode,
-                    messageId: 'orphanRuleBlock',
-                    data: {
-                        policy: block.mirrorsPolicyKey,
-                        line: String(block.sourceLine)
-                    }
-                });
-            }
-        }
-    } catch (err) {
-        _didIteratorError1 = true;
-        _iteratorError1 = err;
-    } finally{
-        try {
-            if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
-                _iterator1.return();
-            }
-        } finally{
-            if (_didIteratorError1) {
-                throw _iteratorError1;
-            }
-        }
-    }
-}
 
-function _array_like_to_array$2(arr, len) {
+function _array_like_to_array$3(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
 }
 function _array_without_holes$1(arr) {
-    if (Array.isArray(arr)) return _array_like_to_array$2(arr);
+    if (Array.isArray(arr)) return _array_like_to_array$3(arr);
 }
 function _iterable_to_array$1(iter) {
     if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
@@ -13238,15 +14604,15 @@ function _non_iterable_spread$1() {
     throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _to_consumable_array$1(arr) {
-    return _array_without_holes$1(arr) || _iterable_to_array$1(arr) || _unsupported_iterable_to_array$2(arr) || _non_iterable_spread$1();
+    return _array_without_holes$1(arr) || _iterable_to_array$1(arr) || _unsupported_iterable_to_array$3(arr) || _non_iterable_spread$1();
 }
-function _unsupported_iterable_to_array$2(o, minLen) {
+function _unsupported_iterable_to_array$3(o, minLen) {
     if (!o) return;
-    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
+    if (typeof o === "string") return _array_like_to_array$3(o, minLen);
     var n = Object.prototype.toString.call(o).slice(8, -1);
     if (n === "Object" && o.constructor) n = o.constructor.name;
     if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$3(o, minLen);
 }
 var ALLOW_RE = /\ballow\s+([A-Za-z, \t]+?)\s*:\s*if\b/g;
 var COLLECTION_GROUP_PREFIX = /^\/\{[A-Za-z_]\w*=\*\*\}\//;
@@ -13452,6 +14818,14 @@ var BARE_IDENTIFIER_RE = /^[A-Za-z_]\w*$/;
     return walkBlock(masked, 0, source);
 }
 
+function _array_like_to_array$2(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes$1(arr) {
+    if (Array.isArray(arr)) return arr;
+}
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -13465,6 +14839,33 @@ function _define_property(obj, key, value) {
     }
     return obj;
 }
+function _iterable_to_array_limit$1(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest$1() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
 function _object_spread(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
@@ -13480,6 +14881,36 @@ function _object_spread(target) {
     }
     return target;
 }
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _sliced_to_array$1(arr, i) {
+    return _array_with_holes$1(arr) || _iterable_to_array_limit$1(arr, i) || _unsupported_iterable_to_array$2(arr, i) || _non_iterable_rest$1();
+}
+function _unsupported_iterable_to_array$2(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$2(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$2(o, minLen);
+}
 /**
  * Default file name searched relative to the lint root when `firestoreRulesPath` is omitted.
  */ var DEFAULT_FIRESTORE_RULES_FILENAME = 'firestore.rules';
@@ -13500,6 +14931,18 @@ function _object_spread(target) {
     'components/*/src/lib/model/**/*.ts',
     'apps/*/src/app/**/*.ts'
 ];
+/**
+ * Identity-type-reference names emitted into `@dereekb/firebase`'s shipped `.d.ts` for the two
+ * `firestoreModelIdentity(...)` return shapes. Downstream consumers only have these declaration
+ * files (no `firestoreModelIdentity(...)` call expressions), so the rule reads model name +
+ * collection name + parent chain from these type annotations — they carry every literal inline,
+ * e.g. `FirestoreModelIdentityWithParent<RootFirestoreModelIdentity<"notificationBox","nb">, "notification","nbn">`.
+ */ var ROOT_IDENTITY_TYPE_NAME = 'RootFirestoreModelIdentity';
+var WITH_PARENT_IDENTITY_TYPE_NAME = 'FirestoreModelIdentityWithParent';
+/**
+ * Cheap substring used to skip files that cannot contain an identity type-annotation before paying
+ * for a full parse (`RootFirestoreModelIdentity` / `FirestoreModelIdentityWithParent` both contain it).
+ */ var IDENTITY_TYPE_SOURCE_MARKER = 'FirestoreModelIdentity';
 var firestoreRulesFileCache = new Map();
 var identityRegistryCache = new Map();
 /**
@@ -13621,6 +15064,181 @@ var identityRegistryCache = new Map();
  */ function isStringLiteralNode(node) {
     return (node === null || node === void 0 ? void 0 : node.type) === 'Literal' && typeof node.value === 'string';
 }
+/**
+ * Walks a parsed file's Program body for top-level `export declare const <name>: <IdentityType>`
+ * declarations and records each resolvable identity. This is the downstream path: a consumer only
+ * has `@dereekb/firebase`'s shipped `.d.ts`, which carries no `firestoreModelIdentity(...)` calls —
+ * only the identity *type annotation* on each exported const. The parent chain is embedded inline in
+ * the type arguments, so the parent's model name is captured here and linked to its declaring
+ * variable in a later pass ({@link resolveTypeAnnotationParents}).
+ *
+ * @param programNode - The Program AST node.
+ * @param state - The scan state whose accumulator + pending-parent map are populated.
+ */ function collectIdentityTypeAnnotationsFromProgram(programNode, state) {
+    var declarators = collectTopLevelDeclarators(programNode);
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = declarators[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var declarator = _step.value;
+            var _id_typeAnnotation;
+            var id = declarator.id;
+            if ((id === null || id === void 0 ? void 0 : id.type) !== 'Identifier' || state.accumulator.has(id.name)) continue;
+            var typeNode = (_id_typeAnnotation = id.typeAnnotation) === null || _id_typeAnnotation === void 0 ? void 0 : _id_typeAnnotation.typeAnnotation;
+            if (!typeNode) continue;
+            var parsed = parseIdentityTypeAnnotation(typeNode);
+            if (parsed) {
+                state.accumulator.set(id.name, {
+                    modelName: parsed.modelName,
+                    collectionName: parsed.collectionName,
+                    identityVariableName: id.name
+                });
+                if (parsed.parentModelName != null) {
+                    state.pendingParentModelNameByVariable.set(id.name, parsed.parentModelName);
+                }
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+}
+/**
+ * Reduces an identity type annotation (`RootFirestoreModelIdentity<M, C>` or
+ * `FirestoreModelIdentityWithParent<<ParentType>, M, C>`, whether written as a `TSTypeReference` or
+ * the `import("…").X<…>` `TSImportType` shape the compiler emits in `.d.ts`) to its model name,
+ * collection name, and — for the nested form — its parent's model name.
+ *
+ * @param typeNode - The type-annotation node.
+ * @returns The resolved identity, or null when the type is not a recognized identity shape.
+ */ function parseIdentityTypeAnnotation(typeNode) {
+    var result = null;
+    var name = referencedTypeName(typeNode);
+    var args = typeReferenceTypeArguments(typeNode);
+    if (name === ROOT_IDENTITY_TYPE_NAME && args && args.length >= 2) {
+        var modelName = tsLiteralStringValue(args[0]);
+        var collectionName = tsLiteralStringValue(args[1]);
+        if (modelName != null && collectionName != null) {
+            result = {
+                modelName: modelName,
+                collectionName: collectionName
+            };
+        }
+    } else if (name === WITH_PARENT_IDENTITY_TYPE_NAME && args && args.length >= 3) {
+        var modelName1 = tsLiteralStringValue(args[1]);
+        var collectionName1 = tsLiteralStringValue(args[2]);
+        var parentModelName = identityTypeAnnotationModelName(args[0]);
+        if (modelName1 != null && collectionName1 != null) {
+            result = _object_spread({
+                modelName: modelName1,
+                collectionName: collectionName1
+            }, parentModelName != null ? {
+                parentModelName: parentModelName
+            } : {});
+        }
+    }
+    return result;
+}
+/**
+ * Resolves just the model name from an identity type annotation node (root or with-parent shape),
+ * used to recover a parent identity's model name from its embedded type.
+ *
+ * @param typeNode - The type-annotation node.
+ * @returns The model name, or null when the type is not a recognized identity shape.
+ */ function identityTypeAnnotationModelName(typeNode) {
+    var result = null;
+    var name = referencedTypeName(typeNode);
+    var args = typeReferenceTypeArguments(typeNode);
+    if (name === ROOT_IDENTITY_TYPE_NAME && args && args.length >= 1) {
+        result = tsLiteralStringValue(args[0]);
+    } else if (name === WITH_PARENT_IDENTITY_TYPE_NAME && args && args.length >= 2) {
+        result = tsLiteralStringValue(args[1]);
+    }
+    return result;
+}
+/**
+ * Returns the string value of a `TSLiteralType` wrapping a string literal (e.g. the `"nu"` in
+ * `RootFirestoreModelIdentity<"notificationUser", "nu">`).
+ *
+ * @param node - The type-argument node.
+ * @returns The literal string, or null when the node is not a string-literal type.
+ */ function tsLiteralStringValue(node) {
+    var _node_literal;
+    var result = null;
+    if ((node === null || node === void 0 ? void 0 : node.type) === 'TSLiteralType' && ((_node_literal = node.literal) === null || _node_literal === void 0 ? void 0 : _node_literal.type) === 'Literal' && typeof node.literal.value === 'string') {
+        result = node.literal.value;
+    }
+    return result;
+}
+/**
+ * Links each type-annotation-discovered child identity to its parent's declaring variable by
+ * matching the parent's model name (captured from the inline parent type) to an accumulated entry.
+ * Entries already carrying a parent reference (e.g. from a call-expression scan) are left untouched.
+ *
+ * @param state - The scan state; its accumulator is mutated in place using the pending-parent map.
+ */ function resolveTypeAnnotationParents(state) {
+    var accumulator = state.accumulator, pendingParentModelNameByVariable = state.pendingParentModelNameByVariable;
+    if (pendingParentModelNameByVariable.size === 0) return;
+    var variableByModelName = new Map();
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = accumulator.values()[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var entry = _step.value;
+            if (!variableByModelName.has(entry.modelName)) {
+                variableByModelName.set(entry.modelName, entry.identityVariableName);
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+    try {
+        for(var _iterator1 = pendingParentModelNameByVariable[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+            var _step_value = _sliced_to_array$1(_step1.value, 2), variableName = _step_value[0], parentModelName = _step_value[1];
+            var entry1 = accumulator.get(variableName);
+            if (!entry1 || entry1.parentIdentityVariableName) continue;
+            var parentVariableName = variableByModelName.get(parentModelName);
+            if (parentVariableName) {
+                accumulator.set(variableName, _object_spread_props(_object_spread({}, entry1), {
+                    parentIdentityVariableName: parentVariableName
+                }));
+            }
+        }
+    } catch (err) {
+        _didIteratorError1 = true;
+        _iteratorError1 = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                _iterator1.return();
+            }
+        } finally{
+            if (_didIteratorError1) {
+                throw _iteratorError1;
+            }
+        }
+    }
+}
 /**
  * Collects every `VariableDeclarator` directly under the Program body, looking through
  * `ExportNamedDeclaration` wrappers.
@@ -13685,50 +15303,67 @@ function unwrapVariableDeclaration(statement) {
     return result;
 }
 /**
- * Builds the workspace identity registry by globbing each search root and parsing each
- * matched `.ts` file. Results are cached by the joined absolute-glob-pattern key.
+ * Builds the workspace identity registry from two complementary discovery passes that feed one
+ * accumulator.
+ *
+ * 1. The cwd-relative `searchRoots` globs — pick up `firestoreModelIdentity(...)` call expressions
+ *    in the in-repo source and in consumer-local `components/*` / `apps/*` model files.
+ * 2. The installed `@dereekb/firebase` package's `src/lib/model` directory (resolved from `cwd` via
+ *    {@link resolveInstalledFirebaseModelDir}) — picks up framework identities downstream, where the
+ *    package ships `.d.ts` declarations (identity type-annotations) rather than scannable call
+ *    expressions. No-op inside the monorepo, where pass 1 already covers the framework source.
+ *
+ * Each file is parsed once and run through both the call-expression and type-annotation extractors;
+ * the first writer per identity-variable name wins, so consumer-local declarations always take
+ * precedence over framework ones. Results are cached by cwd + factory + roots + framework dir.
  *
  * @param cwd - ESLint working directory.
  * @param searchRoots - Relative glob patterns.
  * @param identityFactoryName - The call-expression name to match.
  * @returns The registry indexed by identity variable name and model name.
  */ function buildIdentityRegistry(cwd, searchRoots, identityFactoryName) {
-    var cacheKey = "".concat(cwd, "::").concat(identityFactoryName, "::").concat(searchRoots.join('|'));
+    var frameworkModelDir = resolveInstalledFirebaseModelDir(cwd);
+    var cacheKey = "".concat(cwd, "::").concat(identityFactoryName, "::").concat(searchRoots.join('|'), "::").concat(frameworkModelDir !== null && frameworkModelDir !== void 0 ? frameworkModelDir : '');
     var cached = identityRegistryCache.get(cacheKey);
     if (cached) {
         return cached;
     }
-    var accumulator = new Map();
+    var state = {
+        accumulator: new Map(),
+        pendingParentModelNameByVariable: new Map()
+    };
     var seenFiles = new Set();
-    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-    try {
-        for(var _iterator = searchRoots[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-            var pattern = _step.value;
-            var files = safeGlobSync(pattern, cwd);
-            var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+    var scanFiles = function scanFiles(relativeFiles, baseDir) {
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = relativeFiles[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var relativeFile = _step.value;
+                var absoluteFile = node_path.isAbsolute(relativeFile) ? relativeFile : node_path.resolve(baseDir, relativeFile);
+                if (seenFiles.has(absoluteFile)) continue;
+                seenFiles.add(absoluteFile);
+                scanIdentityFile(absoluteFile, identityFactoryName, state);
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
             try {
-                for(var _iterator1 = files[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
-                    var relativeFile = _step1.value;
-                    var absoluteFile = node_path.isAbsolute(relativeFile) ? relativeFile : node_path.resolve(cwd, relativeFile);
-                    if (seenFiles.has(absoluteFile)) continue;
-                    seenFiles.add(absoluteFile);
-                    scanIdentityFile(absoluteFile, identityFactoryName, accumulator);
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
                 }
-            } catch (err) {
-                _didIteratorError1 = true;
-                _iteratorError1 = err;
             } finally{
-                try {
-                    if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
-                        _iterator1.return();
-                    }
-                } finally{
-                    if (_didIteratorError1) {
-                        throw _iteratorError1;
-                    }
+                if (_didIteratorError) {
+                    throw _iteratorError;
                 }
             }
         }
+    };
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = searchRoots[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var pattern = _step.value;
+            scanFiles(safeGlobSync$1(pattern, cwd), cwd);
+        }
     } catch (err) {
         _didIteratorError = true;
         _iteratorError = err;
@@ -13743,11 +15378,30 @@ function unwrapVariableDeclaration(statement) {
             }
         }
     }
-    var registry = finalizeIdentityRegistry(accumulator);
+    if (frameworkModelDir) {
+        scanFiles(safeGlobSync$1('**/*.ts', frameworkModelDir), frameworkModelDir);
+    }
+    resolveTypeAnnotationParents(state);
+    var registry = finalizeIdentityRegistry(state.accumulator);
     identityRegistryCache.set(cacheKey, registry);
     return registry;
 }
-function safeGlobSync(pattern, cwd) {
+/**
+ * Converts a {@link VirtualModelIdentity} stub into a registry {@link IdentityEntry}, omitting
+ * the optional parent reference when absent.
+ *
+ * @param virtual - The identity stub.
+ * @returns The identity entry.
+ */ function virtualModelIdentityToEntry(virtual) {
+    return _object_spread({
+        modelName: virtual.modelName,
+        collectionName: virtual.collectionName,
+        identityVariableName: virtual.identityVariableName
+    }, virtual.parentIdentityVariableName ? {
+        parentIdentityVariableName: virtual.parentIdentityVariableName
+    } : {});
+}
+function safeGlobSync$1(pattern, cwd) {
     var result;
     try {
         result = node_fs.globSync(pattern, {
@@ -13758,10 +15412,13 @@ function safeGlobSync(pattern, cwd) {
     }
     return result;
 }
-function scanIdentityFile(absoluteFile, identityFactoryName, accumulator) {
+function scanIdentityFile(absoluteFile, identityFactoryName, state) {
+    if (absoluteFile.endsWith('.spec.ts') || absoluteFile.endsWith('.test.ts') || absoluteFile.endsWith('.id.ts')) {
+        return;
+    }
     try {
         var source = node_fs.readFileSync(absoluteFile, 'utf8');
-        if (source.includes(identityFactoryName)) {
+        if (source.includes(identityFactoryName) || source.includes(IDENTITY_TYPE_SOURCE_MARKER)) {
             var programNode = parser.parse(source, {
                 ecmaVersion: 2022,
                 sourceType: 'module',
@@ -13769,7 +15426,8 @@ function scanIdentityFile(absoluteFile, identityFactoryName, accumulator) {
                 range: false,
                 jsx: false
             });
-            collectIdentityCallsFromProgram(programNode, identityFactoryName, accumulator);
+            collectIdentityCallsFromProgram(programNode, identityFactoryName, state.accumulator);
+            collectIdentityTypeAnnotationsFromProgram(programNode, state);
         }
     } catch (unused) {
     // Best-effort discovery — unparsable files are skipped silently so the rule does not
@@ -13823,13 +15481,7 @@ function scanIdentityFile(absoluteFile, identityFactoryName, accumulator) {
     try {
         for(var _iterator = virtualIdentities[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
             var virtual = _step.value;
-            accumulator.set(virtual.identityVariableName, _object_spread({
-                modelName: virtual.modelName,
-                collectionName: virtual.collectionName,
-                identityVariableName: virtual.identityVariableName
-            }, virtual.parentIdentityVariableName ? {
-                parentIdentityVariableName: virtual.parentIdentityVariableName
-            } : {}));
+            accumulator.set(virtual.identityVariableName, virtualModelIdentityToEntry(virtual));
         }
     } catch (err) {
         _didIteratorError = true;
@@ -14612,13 +16264,17 @@ function _unsupported_iterable_to_array$1(o, minLen) {
     if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$1(o, minLen);
 }
 /**
- * Default glob patterns (relative to ESLint `cwd`) used to locate model + factory source files.
- * Mirrors {@link require-firestore-rule-for-service-model}'s search roots so the orphan rule
- * picks up factories declared anywhere a model interface might also live.
+ * Default glob pattern (relative to ESLint `cwd`) used to locate `@dbxModelServiceFactory` source
+ * files. A single layout-agnostic `**\/*.ts` scan finds a consumer's own factory declarations no
+ * matter where they live, rather than assuming the dbx-components monorepo layout
+ * (`components/*\/src/lib/model`, `apps/*\/src/app`) — which a downstream consumer of
+ * `@dereekb/firebase` does not share. The walk prunes `node_modules`/build dirs
+ * (see {@link discoveryGlobExcludeFilter}) and the cheap `text.includes('@'+factoryTag)` pre-filter
+ * in {@link collectFactoryModelTypesFromFile} keeps it from parsing files that carry no tag, so the
+ * broad glob stays fast even in a large consumer repo. In-repo this is a superset of the former
+ * monorepo-specific roots, so the demo app's framework + local factories still resolve.
  */ var DEFAULT_FACTORY_SEARCH_ROOTS = [
-    'packages/firebase/src/lib/model/**/*.ts',
-    'components/*/src/lib/model/**/*.ts',
-    'apps/*/src/app/**/*.ts'
+    '**/*.ts'
 ];
 /**
  * Default name of the `@dbxModel` marker tag that triggers the orphan check.
@@ -14627,6 +16283,11 @@ function _unsupported_iterable_to_array$1(o, minLen) {
  * Default name of the `@dbxModelServiceFactory <modelType>` tag the rule cross-references.
  */ var DEFAULT_FACTORY_TAG = 'dbxModelServiceFactory';
 var MODEL_TYPE_VALUE_PATTERN = /^[a-z][A-Za-z0-9_$]*$/;
+/**
+ * Cache of discovered factory model-type sets keyed by `cwd + factoryTag + searchRoots`. ESLint
+ * calls `create()` once per linted file; without this the broad `**\/*.ts` scan would re-run for
+ * every file. The set is stable for the lifetime of a lint process.
+ */ var factoryModelTypeSetCache = new Map();
 /**
  * ESLint rule that flags every `@dbxModel`-marked interface that has no matching
  * `@dbxModelServiceFactory <modelType>` declaration elsewhere in the workspace.
@@ -14692,16 +16353,18 @@ var MODEL_TYPE_VALUE_PATTERN = /^[a-z][A-Za-z0-9_$]*$/;
             var _options_factorySearchRoots;
             if (options.virtualFactoryModelTypes) return new Set(options.virtualFactoryModelTypes);
             var roots = (_options_factorySearchRoots = options.factorySearchRoots) !== null && _options_factorySearchRoots !== void 0 ? _options_factorySearchRoots : DEFAULT_FACTORY_SEARCH_ROOTS;
+            var cacheKey = "".concat(cwd, "::").concat(factoryTag, "::").concat(roots.join('|'));
+            var cached = factoryModelTypeSetCache.get(cacheKey);
+            if (cached) return cached;
             var out = new Set();
+            var exclude = discoveryGlobExcludeFilter();
             var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
             try {
                 for(var _iterator = roots[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                     var pattern = _step.value;
                     var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                     try {
-                        for(var _iterator1 = node_fs.globSync(pattern, {
-                            cwd: cwd
-                        })[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                        for(var _iterator1 = safeGlobSync(pattern, cwd, exclude)[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
                             var rel = _step1.value;
                             collectFactoryModelTypesFromFile({
                                 rel: rel,
@@ -14739,6 +16402,7 @@ var MODEL_TYPE_VALUE_PATTERN = /^[a-z][A-Za-z0-9_$]*$/;
                     }
                 }
             }
+            factoryModelTypeSetCache.set(cacheKey, out);
             return out;
         }
         function visitInterface(node) {
@@ -14776,9 +16440,22 @@ var MODEL_TYPE_VALUE_PATTERN = /^[a-z][A-Za-z0-9_$]*$/;
 function lowercaseFirstLetter(name) {
     return name.length === 0 ? name : name.charAt(0).toLowerCase() + name.slice(1);
 }
+function safeGlobSync(pattern, cwd, exclude) {
+    var result;
+    try {
+        result = node_fs.globSync(pattern, {
+            cwd: cwd,
+            exclude: exclude
+        });
+    } catch (unused) {
+        result = [];
+    }
+    return result;
+}
 function collectFactoryModelTypesFromFile(input) {
     var rel = input.rel, cwd = input.cwd, factoryTag = input.factoryTag, out = input.out;
     if (typeof rel !== 'string') return;
+    if (rel.endsWith('.spec.ts') || rel.endsWith('.test.ts')) return;
     var abs = node_path.resolve(cwd, rel);
     var text;
     try {
@@ -15587,6 +17264,7 @@ exports.DEFAULT_API_DETAILS_FACTORY_NAME = DEFAULT_API_DETAILS_FACTORY_NAME;
 exports.DEFAULT_CONSTRAINT_FACTORY_NAMES = DEFAULT_CONSTRAINT_FACTORY_NAMES;
 exports.DEFAULT_CRUD_FUNCTION_TYPE_VERBS = DEFAULT_CRUD_FUNCTION_TYPE_VERBS;
 exports.DEFAULT_CRUD_VERB_NAMES = DEFAULT_CRUD_VERB_NAMES;
+exports.DEFAULT_DISCOVERY_EXCLUDED_DIRS = DEFAULT_DISCOVERY_EXCLUDED_DIRS;
 exports.DEFAULT_FACTORY_SEARCH_ROOTS = DEFAULT_FACTORY_SEARCH_ROOTS;
 exports.DEFAULT_FACTORY_TAG = DEFAULT_FACTORY_TAG;
 exports.DEFAULT_FIRESTORE_RULES_FILENAME = DEFAULT_FIRESTORE_RULES_FILENAME;
@@ -15619,6 +17297,7 @@ exports.INPUT_TYPE_PROPERTY_NAME = INPUT_TYPE_PROPERTY_NAME;
 exports.MIRRORS_POLICY_KEY_MARKER_REGEX = MIRRORS_POLICY_KEY_MARKER_REGEX;
 exports.MODEL_FIREBASE_CRUD_FUNCTION_CONFIG_MAP_TYPE_NAME = MODEL_FIREBASE_CRUD_FUNCTION_CONFIG_MAP_TYPE_NAME;
 exports.QUERY_SUFFIX = QUERY_SUFFIX;
+exports.discoveryGlobExcludeFilter = discoveryGlobExcludeFilter;
 exports.firebaseESLintPlugin = firebaseESLintPlugin;
 exports.parseFirestoreRules = parseFirestoreRules;
 exports.parseStorageRules = parseStorageRules;