@pyric/cli 0.1.0-alpha.10

package/dist/serve/entries/auth-helper-core.js

@@ -0,0 +1,118 @@
+export class ServeAuthHelper {
+    directory;
+    pending = null;
+    listeners = new Set();
+    cached = null;
+    identities = [];
+    constructor(directory) {
+        this.directory = directory;
+        this.refreshIdentities();
+    }
+    resolver() {
+        const open = (req) => new Promise((resolve, reject) => {
+            if (this.pending)
+                this.cancel();
+            this.pending = { req, resolve, reject };
+            this.emit();
+            this.refreshIdentities();
+        });
+        return { openPopup: open, openRedirect: open };
+    }
+    subscribe(fn) {
+        this.listeners.add(fn);
+        return () => this.listeners.delete(fn);
+    }
+    snapshot() {
+        this.cached ??= {
+            request: this.pending?.req ?? null,
+            identities: this.identities,
+        };
+        return this.cached;
+    }
+    emit() {
+        this.cached = null;
+        for (const listener of this.listeners)
+            listener();
+    }
+    refreshIdentities() {
+        try {
+            const listed = this.directory.list();
+            if (listed instanceof Promise) {
+                void listed.then((identities) => {
+                    this.identities = identities;
+                    this.emit();
+                }, (error) => {
+                    const pending = this.take();
+                    pending?.reject(error);
+                });
+            }
+            else {
+                this.identities = listed;
+                this.emit();
+            }
+        }
+        catch (error) {
+            const pending = this.take();
+            pending?.reject(error);
+        }
+    }
+    pick(uid) {
+        const pending = this.take();
+        if (!pending)
+            return;
+        const identity = this.identities.find((candidate) => candidate.uid === uid);
+        if (!identity) {
+            pending.reject(authError('auth/internal-error', `unknown identity ${uid}`));
+            return;
+        }
+        pending.resolve(this.credential(identity, pending.req.providerId));
+    }
+    add(spec) {
+        const pending = this.take();
+        if (!pending)
+            return;
+        const identity = {
+            uid: `${pending.req.providerId}:${spec.email}`,
+            email: spec.email,
+            displayName: spec.displayName ?? null,
+            customClaims: spec.customClaims ?? {},
+        };
+        void Promise.resolve(this.directory.add?.(identity)).then(() => pending.resolve(this.credential(identity, pending.req.providerId)), pending.reject);
+    }
+    cancel() {
+        const pending = this.take();
+        if (!pending)
+            return;
+        pending.reject(authError('auth/popup-closed-by-user', 'The popup has been closed by the user before finalizing the operation.'));
+    }
+    take() {
+        const pending = this.pending;
+        this.pending = null;
+        this.emit();
+        return pending;
+    }
+    credential(identity, providerId) {
+        const user = {
+            uid: identity.uid,
+            email: identity.email,
+            displayName: identity.displayName,
+            isAnonymous: false,
+            getIdToken: async () => `pyric-serve-${identity.uid}`,
+            getIdTokenResult: async () => ({
+                token: `pyric-serve-${identity.uid}`,
+                claims: { sub: identity.uid, ...identity.customClaims },
+                expirationTime: new Date(Date.now() + 3600_000).toISOString(),
+                issuedAtTime: new Date().toISOString(),
+                authTime: new Date().toISOString(),
+            }),
+        };
+        return { user, providerId, operationType: 'signIn' };
+    }
+}
+function authError(code, message) {
+    const error = new Error(message);
+    error.name = 'FirebaseError';
+    error.code = code;
+    return error;
+}
+//# sourceMappingURL=auth-helper-core.js.map

package/dist/serve/entries/auth-helper-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-core.js","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-core.ts"],"names":[],"mappings":"AAiDA,MAAM,OAAO,eAAe;IAMG;IALrB,OAAO,GAAmB,IAAI,CAAC;IACtB,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAC3C,MAAM,GAA0B,IAAI,CAAC;IACrC,UAAU,GAAqB,EAAE,CAAC;IAE1C,YAA6B,SAAkC;QAAlC,cAAS,GAAT,SAAS,CAAyB;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,CAAC,GAAoB,EAA2B,EAAE,CAC7D,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACL,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,SAAS,CAAC,EAAc;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,MAAM,KAAK;YACd,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI;YAClC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS;YAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,CACd,CAAC,UAAU,EAAE,EAAE;oBACb,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;oBAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;oBACR,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBACzB,CAAC,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;gBACzB,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAW;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,EAAE,oBAAoB,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,GAAG,CAAC,IAAqB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,QAAQ,GAAmB;YAC/B,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,EAAE;YAC9C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;SACtC,CAAC;QACF,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CACvD,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EACxE,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,OAAO,CAAC,MAAM,CACZ,SAAS,CACP,2BAA2B,EAC3B,wEAAwE,CACzE,CACF,CAAC;IACJ,CAAC;IAEO,IAAI;QACV,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,UAAU,CAAC,QAAwB,EAAE,UAAkB;QAC7D,MAAM,IAAI,GAAS;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,QAAQ,CAAC,GAAG,EAAE;YACrD,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC7B,KAAK,EAAE,eAAe,QAAQ,CAAC,GAAG,EAAE;gBACpC,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE;gBACvD,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;gBAC7D,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACtC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACnC,CAAC;SACH,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;IACvD,CAAC;CACF;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAA6B,CAAC;IAC7D,KAAK,CAAC,IAAI,GAAG,eAAe,CAAC;IAC7B,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/serve/entries/auth-helper-dom.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The `<dialog>` shell over {@link ServeAuthHelper} — pyric dev's analog
+ * of the Auth emulator's sign-in widget. Pure-DOM (no framework): renders an
+ * account picker + an add-account form (email, display name, custom-claims
+ * JSON — emulator parity, `customAttributes`), opens when a popup/redirect
+ * request parks in the helper, closes on settle. Backdrop/Escape cancel →
+ * `auth/popup-closed-by-user` via the core.
+ *
+ * Verified through the scripted browser gate (the bun suite covers the core;
+ * this file is intentionally view-only).
+ */
+import type { ServeAuthHelper } from './auth-helper-core.js';
+export declare function mountAuthHelperDialog(helper: ServeAuthHelper): void;
+//# sourceMappingURL=auth-helper-dom.d.ts.map

package/dist/serve/entries/auth-helper-dom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-dom.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-dom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA8B7D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CA4FnE"}

package/dist/serve/entries/auth-helper-dom.js

@@ -0,0 +1,116 @@
+const PROVIDER_LABEL = {
+    'google.com': 'Google',
+    'facebook.com': 'Facebook',
+    'github.com': 'GitHub',
+    'apple.com': 'Apple',
+};
+const STYLE = `
+  dialog[data-pyric-auth] { border: 1px solid #2a2a35; border-radius: 12px; background: #16161d;
+    color: #e8e8ee; font: 14px/1.45 system-ui, sans-serif; padding: 20px; width: min(420px, 92vw); }
+  dialog[data-pyric-auth]::backdrop { background: rgb(0 0 0 / 0.6); }
+  dialog[data-pyric-auth] h2 { margin: 0 0 4px; font-size: 16px; }
+  dialog[data-pyric-auth] p { margin: 0 0 14px; font-size: 12px; color: #9a9aa8; }
+  dialog[data-pyric-auth] .ids { display: grid; gap: 8px; margin-bottom: 14px; }
+  dialog[data-pyric-auth] .ids button { display: flex; gap: 10px; align-items: center; text-align: left;
+    padding: 8px 10px; border: 1px solid #2a2a35; border-radius: 8px; background: none; color: inherit; cursor: pointer; }
+  dialog[data-pyric-auth] .ids button:hover { border-color: #4a4a5a; background: rgb(255 255 255 / 0.05); }
+  dialog[data-pyric-auth] form { display: grid; gap: 8px; border-top: 1px solid #2a2a35; padding-top: 14px; }
+  dialog[data-pyric-auth] input, dialog[data-pyric-auth] textarea { background: none; color: inherit;
+    border: 1px solid #2a2a35; border-radius: 8px; padding: 8px 10px; font: inherit; }
+  dialog[data-pyric-auth] textarea { font-family: ui-monospace, monospace; font-size: 12px; }
+  dialog[data-pyric-auth] .row { display: flex; justify-content: flex-end; gap: 8px; margin-top: 6px; }
+  dialog[data-pyric-auth] .row button { padding: 8px 14px; border-radius: 8px; border: none; cursor: pointer; font: inherit; }
+  dialog[data-pyric-auth] .cancel { background: none; color: #9a9aa8; }
+  dialog[data-pyric-auth] .submit { background: #5b5bd6; color: white; }
+  dialog[data-pyric-auth] .err { color: #ff6b6b; font-size: 12px; }
+`;
+export function mountAuthHelperDialog(helper) {
+    const style = document.createElement('style');
+    style.textContent = STYLE;
+    document.head.appendChild(style);
+    const dialog = document.createElement('dialog');
+    dialog.setAttribute('data-pyric-auth', '');
+    document.body.appendChild(dialog);
+    // <dialog> cancel (Escape) + backdrop click → cancel the flow.
+    dialog.addEventListener('cancel', () => helper.cancel());
+    dialog.addEventListener('click', (e) => {
+        if (e.target === dialog)
+            helper.cancel(); // backdrop only
+    });
+    const render = () => {
+        const snap = helper.snapshot();
+        if (!snap.request) {
+            if (dialog.open)
+                dialog.close();
+            return;
+        }
+        const provider = PROVIDER_LABEL[snap.request.providerId] ?? snap.request.providerId;
+        dialog.replaceChildren();
+        const h2 = document.createElement('h2');
+        h2.textContent = `Sign in with ${provider}`;
+        const p = document.createElement('p');
+        p.textContent =
+            'pyric dev sign-in helper — pick a test account or add one. Custom claims let rules using request.auth.token.* run against this identity.';
+        dialog.append(h2, p);
+        if (snap.identities.length > 0) {
+            const ids = document.createElement('div');
+            ids.className = 'ids';
+            for (const id of snap.identities) {
+                const btn = document.createElement('button');
+                btn.type = 'button';
+                const label = id.displayName || id.email || id.uid;
+                btn.textContent = id.email && id.displayName ? `${label} — ${id.email}` : label;
+                btn.addEventListener('click', () => helper.pick(id.uid));
+                ids.appendChild(btn);
+            }
+            dialog.appendChild(ids);
+        }
+        const form = document.createElement('form');
+        form.method = 'dialog';
+        const email = document.createElement('input');
+        email.type = 'email';
+        email.placeholder = 'email@example.com';
+        email.required = true;
+        const name = document.createElement('input');
+        name.type = 'text';
+        name.placeholder = 'Display name (optional)';
+        const claims = document.createElement('textarea');
+        claims.rows = 3;
+        claims.placeholder = 'Custom claims JSON (optional)\ne.g. { "admin": true }';
+        const err = document.createElement('div');
+        err.className = 'err';
+        const row = document.createElement('div');
+        row.className = 'row';
+        const cancel = document.createElement('button');
+        cancel.type = 'button';
+        cancel.className = 'cancel';
+        cancel.textContent = 'Cancel';
+        cancel.addEventListener('click', () => helper.cancel());
+        const submit = document.createElement('button');
+        submit.type = 'submit';
+        submit.className = 'submit';
+        submit.textContent = 'Sign in';
+        row.append(cancel, submit);
+        form.append(email, name, claims, err, row);
+        form.addEventListener('submit', (e) => {
+            e.preventDefault();
+            let parsed;
+            if (claims.value.trim()) {
+                try {
+                    parsed = JSON.parse(claims.value);
+                }
+                catch {
+                    err.textContent = 'Custom claims must be valid JSON.';
+                    return;
+                }
+            }
+            helper.add({ email: email.value.trim(), displayName: name.value.trim() || undefined, customClaims: parsed });
+        });
+        dialog.appendChild(form);
+        if (!dialog.open)
+            dialog.showModal();
+    };
+    helper.subscribe(render);
+    render();
+}
+//# sourceMappingURL=auth-helper-dom.js.map

package/dist/serve/entries/auth-helper-dom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-dom.js","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-dom.ts"],"names":[],"mappings":"AAaA,MAAM,cAAc,GAA2B;IAC7C,YAAY,EAAE,QAAQ;IACtB,cAAc,EAAE,UAAU;IAC1B,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,OAAO;CACrB,CAAC;AAEF,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;CAmBb,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAElC,+DAA+D;IAC/D,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,gBAAgB;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpF,MAAM,CAAC,eAAe,EAAE,CAAC;QAEzB,MAAM,EAAE,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACxC,EAAE,CAAC,WAAW,GAAG,gBAAgB,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,WAAW;YACX,0IAA0I,CAAC;QAC7I,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAErB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC1C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC7C,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;gBACpB,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;gBACnD,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAChF,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzD,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QACrB,KAAK,CAAC,WAAW,GAAG,mBAAmB,CAAC;QACxC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,yBAAyB,CAAC;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAChB,MAAM,CAAC,WAAW,GAAG,uDAAuD,CAAC;QAC7E,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC5B,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC;QAC9B,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC5B,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACpC,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,IAAI,MAA2C,CAAC;YAChD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAA4B,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,WAAW,GAAG,mCAAmC,CAAC;oBACtD,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzB,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IACvC,CAAC,CAAC;IAEF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC;AACX,CAAC"}

package/dist/serve/entries/auth-helper-runtime.d.ts

@@ -0,0 +1,5 @@
+/** Shared resolver slot connecting the injected init entry to firebase/auth. */
+import type { AuthFlowRequest, AuthFlowResolver, UserCredential } from 'pyric/auth';
+export declare function installServeAuthResolver(next: AuthFlowResolver): void;
+export declare function resolveServeAuthFlow(request: AuthFlowRequest, kind: 'popup' | 'redirect'): Promise<UserCredential>;
+//# sourceMappingURL=auth-helper-runtime.d.ts.map

package/dist/serve/entries/auth-helper-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-runtime.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-runtime.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIpF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAErE;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,OAAO,GAAG,UAAU,GACzB,OAAO,CAAC,cAAc,CAAC,CAOzB"}

package/dist/serve/entries/auth-helper-runtime.js

@@ -0,0 +1,11 @@
+let resolver = null;
+export function installServeAuthResolver(next) {
+    resolver = next;
+}
+export function resolveServeAuthFlow(request, kind) {
+    if (!resolver) {
+        return Promise.reject(new Error('pyric dev provider helper is not initialized; load /__pyric/sdk/init.js first'));
+    }
+    return kind === 'popup' ? resolver.openPopup(request) : resolver.openRedirect(request);
+}
+//# sourceMappingURL=auth-helper-runtime.js.map

package/dist/serve/entries/auth-helper-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-runtime.js","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-runtime.ts"],"names":[],"mappings":"AAGA,IAAI,QAAQ,GAA4B,IAAI,CAAC;AAE7C,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAC7D,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAwB,EACxB,IAA0B;IAE1B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AACzF,CAAC"}

package/dist/serve/entries/auth.d.ts

@@ -0,0 +1,77 @@
+/**
+ * The bundle the import map serves for `firebase/auth`.
+ *
+ * DUAL-PATH (Phase 3c): when a SharedWorker is available, auth routes to the
+ * ONE worker-hosted sandbox — shared user pool + data, PER-TAB sessions
+ * (#754: each tab signs in as its own user). Otherwise it runs against the
+ * in-page sandbox — the unchanged fallback. Branch picked ONCE at load
+ * (`useWorker`).
+ *
+ * PROVIDER SIGN-IN: the picker UI lives in-page, but its controller is
+ * backend-free. In worker mode it lists identities from the worker and returns
+ * a plain credential to `auth.acceptIdentity`; no page-local Auth handle signs
+ * in or seeds a user. Email/password + anonymous also go straight to the
+ * worker. The COMPLETE surface is exported on both paths (import-time parity).
+ */
+import * as ipAuth from 'pyric/auth';
+import { getAuth as pyricGetAuth, setPersistence as pyricSetPersistence } from 'pyric/auth';
+export declare const onAuthStateChanged: typeof ipAuth.onAuthStateChanged;
+export declare const onIdTokenChanged: typeof ipAuth.onIdTokenChanged;
+/**
+ * Worker mode: the gate can't run before a worker-committed transition
+ * (see `worker/client.ts`'s `beforeAuthStateChanged` doc) — registering
+ * throws immediately rather than silently accepting a no-op callback.
+ * In-page mode: full block-and-abort semantics via `pyric/auth`.
+ */
+export declare const beforeAuthStateChanged: typeof ipAuth.beforeAuthStateChanged;
+export declare const signInAnonymously: typeof ipAuth.signInAnonymously;
+export declare const signInWithEmailAndPassword: typeof ipAuth.signInWithEmailAndPassword;
+export declare const createUserWithEmailAndPassword: typeof ipAuth.createUserWithEmailAndPassword;
+export declare const signOut: typeof ipAuth.signOut;
+export declare const connectAuthEmulator: typeof ipAuth.connectAuthEmulator;
+/**
+ * `updateProfile(user, { displayName?, photoURL? })` — updates the signed-in
+ * user's profile on the picked path (worker or in-page). Both `wc` and `ipAuth`
+ * export a top-level `updateProfile`; cast to the canonical `pyric/auth` shape.
+ * (Fixes #746: the served `firebase/auth` entry didn't re-export this at all.)
+ */
+export declare const updateProfile: typeof ipAuth.updateProfile;
+export declare const GoogleAuthProvider: typeof ipAuth.GoogleAuthProvider;
+export declare const EmailAuthProvider: typeof ipAuth.EmailAuthProvider;
+export declare const FacebookAuthProvider: typeof ipAuth.FacebookAuthProvider;
+export declare const GithubAuthProvider: typeof ipAuth.GithubAuthProvider;
+export declare const OAuthProvider: typeof ipAuth.OAuthProvider;
+export declare const browserLocalPersistence: ipAuth.Persistence;
+export declare const browserSessionPersistence: ipAuth.Persistence;
+export declare const inMemoryPersistence: ipAuth.Persistence;
+export declare const getAuth: typeof pyricGetAuth;
+/** `setPersistence`: selects which web storage holds THIS TAB's session (and
+ *  migrates the current one). On the worker path the record is still client-
+ *  side (#754 — per-port sessions restore via `auth.restorePortSession`); the
+ *  RPC just keeps the worker's surface-parity mode in sync. */
+export declare const setPersistence: typeof pyricSetPersistence;
+export declare const signInWithPopup: typeof ipAuth.signInWithPopup;
+/**
+ * `signInWithRedirect` over the worker resolves like popup — the pyric
+ * emulator helper does not actually navigate, so the identity is picked + the
+ * worker signs in immediately. The result is delivered through the sign-in +
+ * `onAuthStateChanged`; `getRedirectResult` returns null on the worker path
+ * (there is no deferred post-navigation result to replay). v1 behavior.
+ */
+export declare const signInWithRedirect: typeof ipAuth.signInWithRedirect;
+export declare const getRedirectResult: typeof ipAuth.getRedirectResult;
+/** Direct credential sign-in: unsupported over the worker in v1 (the
+ *  worker-client rejects with a clear error); in-page passes through. */
+export declare const signInWithCredential: typeof ipAuth.signInWithCredential;
+/** `initializeAuth(app, deps?)` — aliases the picked `getAuth` (worker- or
+ *  in-page-backed). Path-independent: `deps` is accepted for parity, ignored. */
+export declare const initializeAuth: typeof ipAuth.initializeAuth;
+/** `useDeviceLanguage(auth)` — accepted no-op (no device locale in the served
+ *  sandbox). Path-independent. */
+export declare const useDeviceLanguage: typeof ipAuth.useDeviceLanguage;
+export declare const deleteUser: typeof ipAuth.deleteUser;
+export declare const updateEmail: typeof ipAuth.updateEmail;
+export declare const updatePassword: typeof ipAuth.updatePassword;
+export declare const reload: typeof ipAuth.reload;
+export declare const updateCurrentUser: typeof ipAuth.updateCurrentUser;
+//# sourceMappingURL=auth.d.ts.map

package/dist/serve/entries/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,cAAc,IAAI,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAgB5F,eAAO,MAAM,kBAAkB,kCAAuB,CAAC;AACvD,eAAO,MAAM,gBAAgB,gCAAqB,CAAC;AACnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,sCAA2B,CAAC;AAC/D,eAAO,MAAM,iBAAiB,iCAAsB,CAAC;AACrD,eAAO,MAAM,0BAA0B,0CAA+B,CAAC;AACvE,eAAO,MAAM,8BAA8B,8CAAmC,CAAC;AAC/E,eAAO,MAAM,OAAO,uBAAY,CAAC;AACjC,eAAO,MAAM,mBAAmB,mCAAwB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAA4D,OAAO,MAAM,CAAC,aAAa,CAAC;AAGlH,eAAO,MAAM,kBAAkB,kCAA4B,CAAC;AAC5D,eAAO,MAAM,iBAAiB,iCAA2B,CAAC;AAC1D,eAAO,MAAM,oBAAoB,oCAA8B,CAAC;AAChE,eAAO,MAAM,kBAAkB,kCAA4B,CAAC;AAC5D,eAAO,MAAM,aAAa,6BAAuB,CAAC;AAClD,eAAO,MAAM,uBAAuB,oBAAiC,CAAC;AACtE,eAAO,MAAM,yBAAyB,oBAAmC,CAAC;AAC1E,eAAO,MAAM,mBAAmB,oBAA6B,CAAC;AAiC9D,eAAO,MAAM,OAAO,EAgBd,OAAO,YAAY,CAAC;AAiB1B;;;+DAG+D;AAC/D,eAAO,MAAM,cAAc,EAgBtB,OAAO,mBAAmB,CAAC;AAoChC,eAAO,MAAM,eAAe,EAKvB,OAAO,MAAM,CAAC,eAAe,CAAC;AAEnC;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAK1B,OAAO,MAAM,CAAC,kBAAkB,CAAC;AAEtC,eAAO,MAAM,iBAAiB,EAIzB,OAAO,MAAM,CAAC,iBAAiB,CAAC;AAErC;yEACyE;AACzE,eAAO,MAAM,oBAAoB,EAE5B,OAAO,MAAM,CAAC,oBAAoB,CAAC;AAWxC;iFACiF;AACjF,eAAO,MAAM,cAAc,EACC,OAAO,MAAM,CAAC,cAAc,CAAC;AAEzD;kCACkC;AAClC,eAAO,MAAM,iBAAiB,EAAgC,OAAO,MAAM,CAAC,iBAAiB,CAAC;AAM9F,eAAO,MAAM,UAAU,EAElB,OAAO,MAAM,CAAC,UAAU,CAAC;AAC9B,eAAO,MAAM,WAAW,EAEnB,OAAO,MAAM,CAAC,WAAW,CAAC;AAC/B,eAAO,MAAM,cAAc,EAEtB,OAAO,MAAM,CAAC,cAAc,CAAC;AAClC,eAAO,MAAM,MAAM,EAEd,OAAO,MAAM,CAAC,MAAM,CAAC;AAC1B,eAAO,MAAM,iBAAiB,EAEzB,OAAO,MAAM,CAAC,iBAAiB,CAAC"}

package/dist/serve/entries/auth.js

@@ -0,0 +1,201 @@
+/**
+ * The bundle the import map serves for `firebase/auth`.
+ *
+ * DUAL-PATH (Phase 3c): when a SharedWorker is available, auth routes to the
+ * ONE worker-hosted sandbox — shared user pool + data, PER-TAB sessions
+ * (#754: each tab signs in as its own user). Otherwise it runs against the
+ * in-page sandbox — the unchanged fallback. Branch picked ONCE at load
+ * (`useWorker`).
+ *
+ * PROVIDER SIGN-IN: the picker UI lives in-page, but its controller is
+ * backend-free. In worker mode it lists identities from the worker and returns
+ * a plain credential to `auth.acceptIdentity`; no page-local Auth handle signs
+ * in or seeds a user. Email/password + anonymous also go straight to the
+ * worker. The COMPLETE surface is exported on both paths (import-time parity).
+ */
+import * as ipAuth from 'pyric/auth';
+import { getAuth as pyricGetAuth, setPersistence as pyricSetPersistence } from 'pyric/auth';
+import * as wcRaw from '../worker/client.js';
+import { acceptProviderCredential, restorePortSession } from '../worker/client.js';
+import { useWorker } from './worker-runtime.js';
+import { sessionStoreForApp } from './app-session-store.js';
+import { resolveServeAuthFlow } from './auth-helper-runtime.js';
+import { getApp } from 'pyric/app';
+import { workerClientForApp } from './app-client.js';
+// Worker-client auth, cast to the canonical pyric/auth surface for the picked
+// bindings (same names + shapes). Provider-bridge specifics are explicit below.
+const wc = wcRaw;
+/** Observers + email/anon sign-in: worker-client or in-page. */
+const A = useWorker ? wc : ipAuth;
+export const onAuthStateChanged = A.onAuthStateChanged;
+export const onIdTokenChanged = A.onIdTokenChanged;
+/**
+ * Worker mode: the gate can't run before a worker-committed transition
+ * (see `worker/client.ts`'s `beforeAuthStateChanged` doc) — registering
+ * throws immediately rather than silently accepting a no-op callback.
+ * In-page mode: full block-and-abort semantics via `pyric/auth`.
+ */
+export const beforeAuthStateChanged = A.beforeAuthStateChanged;
+export const signInAnonymously = A.signInAnonymously;
+export const signInWithEmailAndPassword = A.signInWithEmailAndPassword;
+export const createUserWithEmailAndPassword = A.createUserWithEmailAndPassword;
+export const signOut = A.signOut;
+export const connectAuthEmulator = A.connectAuthEmulator;
+/**
+ * `updateProfile(user, { displayName?, photoURL? })` — updates the signed-in
+ * user's profile on the picked path (worker or in-page). Both `wc` and `ipAuth`
+ * export a top-level `updateProfile`; cast to the canonical `pyric/auth` shape.
+ * (Fixes #746: the served `firebase/auth` entry didn't re-export this at all.)
+ */
+export const updateProfile = (useWorker ? wc.updateProfile : ipAuth.updateProfile);
+// ── Provider value classes + persistence markers — path-independent ───────
+export const GoogleAuthProvider = ipAuth.GoogleAuthProvider;
+export const EmailAuthProvider = ipAuth.EmailAuthProvider;
+export const FacebookAuthProvider = ipAuth.FacebookAuthProvider;
+export const GithubAuthProvider = ipAuth.GithubAuthProvider;
+export const OAuthProvider = ipAuth.OAuthProvider;
+export const browserLocalPersistence = ipAuth.browserLocalPersistence;
+export const browserSessionPersistence = ipAuth.browserSessionPersistence;
+export const inMemoryPersistence = ipAuth.inMemoryPersistence;
+// ── getAuth — worker-backed auth (reusing the shared worker port) or in-page.
+const workerAuthByApp = new WeakMap();
+const persistenceWired = new WeakSet();
+function wireAppPersistence(app, auth) {
+    if (persistenceWired.has(app))
+        return;
+    persistenceWired.add(app);
+    const store = sessionStoreForApp(app);
+    const stored = store.load();
+    if (useWorker && stored) {
+        // Posting restore before listener registration preserves FIFO ordering on
+        // this app's MessagePort, so the initial listener value is the restore.
+        void restorePortSession(auth, stored.uid).then((user) => {
+            if (!user)
+                store.clear();
+        });
+    }
+    else if (!useWorker && stored) {
+        try {
+            ipAuth.sandbox.restoreSession(auth, stored.uid);
+        }
+        catch {
+            store.clear();
+        }
+    }
+    A.onAuthStateChanged(auth, (user) => {
+        if (user)
+            store.save(user.uid);
+        else
+            store.clear();
+    });
+}
+export const getAuth = ((app) => {
+    const resolved = app ?? getApp();
+    if (!useWorker) {
+        const handle = pyricGetAuth(resolved);
+        wireAppPersistence(resolved, handle);
+        return handle;
+    }
+    const existing = workerAuthByApp.get(resolved);
+    if (existing)
+        return existing;
+    const client = workerClientForApp(resolved);
+    const handle = Object.assign(wc.getAuth(client), {
+        app: resolved,
+    });
+    workerAuthByApp.set(resolved, handle);
+    wireAppPersistence(resolved, handle);
+    return handle;
+});
+/**
+ * Narrow a `Persistence.type` to the three web-storage slots the session store
+ * actually has.
+ *
+ * `'COOKIE'` (upstream's `browserCookiePersistence`, for SSR) is the fourth
+ * member of the union and has no slot of its own here. It maps to `'LOCAL'`:
+ * both are long-lived session storage, and the distinction is invisible to
+ * consumer code once the session is restored either way. The alternative —
+ * widening SessionMode — would add a storage backend the serve layer does not
+ * have.
+ */
+function toSessionMode(type) {
+    return type === 'COOKIE' ? 'LOCAL' : type;
+}
+/** `setPersistence`: selects which web storage holds THIS TAB's session (and
+ *  migrates the current one). On the worker path the record is still client-
+ *  side (#754 — per-port sessions restore via `auth.restorePortSession`); the
+ *  RPC just keeps the worker's surface-parity mode in sync. */
+export const setPersistence = (useWorker
+    ? (async (auth, persistence) => {
+        sessionStoreForApp(auth.app ?? getApp()).setMode(toSessionMode(persistence.type));
+        return wc.setPersistence(auth, persistence);
+    })
+    : async (auth, persistence) => {
+        sessionStoreForApp(auth.app ?? getApp()).setMode(toSessionMode(persistence.type));
+        return pyricSetPersistence(auth, persistence);
+    });
+// ── Provider sign-in (popup/redirect) — the in-page→worker bridge ─────────
+/**
+ * Resolve a provider identity through the backend-free ServeAuthHelper, then
+ * hand it to the worker. The
+ * helper seeds `{ sub, ...claims }` into the resolved credential's token, so we
+ * strip `sub` to recover the original custom claims for the worker seed.
+ *
+ * Enforcement lives at the hand-off: `auth.acceptIdentity` gates against the
+ * WORKER's provider config and rejects `auth/operation-not-allowed` for a
+ * disabled provider (matching prod, where the popup opens and the error
+ * surfaces after the interaction).
+ */
+async function bridgeProviderSignIn(auth, provider, kind) {
+    const providerId = provider.providerId ?? 'oidc';
+    const cred = await resolveServeAuthFlow({ providerId, authType: 'signIn' }, kind);
+    const tokenResult = await cred.user.getIdTokenResult();
+    const { sub: _sub, ...customClaims } = (tokenResult.claims ?? {});
+    return acceptProviderCredential(auth, {
+        uid: cred.user.uid,
+        email: cred.user.email,
+        displayName: cred.user.displayName,
+        customClaims,
+        providerId,
+    });
+}
+export const signInWithPopup = (useWorker
+    ? (auth, provider) => bridgeProviderSignIn(auth, provider, 'popup')
+    : ipAuth.signInWithPopup);
+/**
+ * `signInWithRedirect` over the worker resolves like popup — the pyric
+ * emulator helper does not actually navigate, so the identity is picked + the
+ * worker signs in immediately. The result is delivered through the sign-in +
+ * `onAuthStateChanged`; `getRedirectResult` returns null on the worker path
+ * (there is no deferred post-navigation result to replay). v1 behavior.
+ */
+export const signInWithRedirect = (useWorker
+    ? (auth, provider) => bridgeProviderSignIn(auth, provider, 'redirect')
+    : ipAuth.signInWithRedirect);
+export const getRedirectResult = (useWorker
+    ? async (_auth) => null
+    : ipAuth.getRedirectResult);
+/** Direct credential sign-in: unsupported over the worker in v1 (the
+ *  worker-client rejects with a clear error); in-page passes through. */
+export const signInWithCredential = (useWorker ? wc.signInWithCredential : ipAuth.signInWithCredential);
+// ── Low-hanging-fruit exports (issue #149) ────────────────────────────────
+function unsupportedWorkerAuthApi(name) {
+    throw new Error(`firebase/auth ${name}() is not supported over the pyric SharedWorker yet. ` +
+        'Use the in-page fallback for this operation.');
+}
+/** `initializeAuth(app, deps?)` — aliases the picked `getAuth` (worker- or
+ *  in-page-backed). Path-independent: `deps` is accepted for parity, ignored. */
+export const initializeAuth = ((app, _deps) => getAuth(app));
+/** `useDeviceLanguage(auth)` — accepted no-op (no device locale in the served
+ *  sandbox). Path-independent. */
+export const useDeviceLanguage = ((_auth) => { });
+// User-mutation ops act on a `User` object. In-page they route through the
+// sandbox User's dispatch hook; over the SharedWorker the client has no
+// client-facing binding for them yet, so worker mode throws the standard
+// "use the in-page fallback" error (mirrors the RTDB entry's unsupported ops).
+export const deleteUser = (useWorker ? (() => unsupportedWorkerAuthApi('deleteUser')) : ipAuth.deleteUser);
+export const updateEmail = (useWorker ? (() => unsupportedWorkerAuthApi('updateEmail')) : ipAuth.updateEmail);
+export const updatePassword = (useWorker ? (() => unsupportedWorkerAuthApi('updatePassword')) : ipAuth.updatePassword);
+export const reload = (useWorker ? (() => unsupportedWorkerAuthApi('reload')) : ipAuth.reload);
+export const updateCurrentUser = (useWorker ? (() => unsupportedWorkerAuthApi('updateCurrentUser')) : ipAuth.updateCurrentUser);
+//# sourceMappingURL=auth.js.map

package/dist/serve/entries/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/serve/entries/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,cAAc,IAAI,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,MAAM,EAAoB,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,EAAE,GAAG,KAAiC,CAAC;AAE7C,gEAAgE;AAChE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAClC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,CAAC;AACnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,sBAAsB,CAAC;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,0BAA0B,CAAC;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,8BAA8B,CAAC;AAC/E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAgC,CAAC;AAElH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;AAClD,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,CAAC;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;AAE9D,+EAA+E;AAC/E,MAAM,eAAe,GAAG,IAAI,OAAO,EAAgD,CAAC;AACpF,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAe,CAAC;AAEpD,SAAS,kBAAkB,CACzB,GAAgB,EAChB,IAAqC;IAErC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IACtC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,0EAA0E;QAC1E,wEAAwE;QACxE,KAAK,kBAAkB,CAAC,IAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/D,IAAI,CAAC,IAAI;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IACD,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QAClC,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAC1B,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAiB,EAAE,EAAE;IAC5C,MAAM,QAAQ,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC;IACjC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAe,CAAC,EAAE;QACxD,GAAG,EAAE,QAAQ;KACd,CAA+C,CAAC;IACjD,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAwB,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,IAA6C;IAClE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;+DAG+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAS;IACP,CAAC,CAAC,CAAC,KAAK,EACJ,IAA+C,EAC/C,WAAsD,EACtD,EAAE;QACF,kBAAkB,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,OAAQ,EAAE,CAAC,cAA6C,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC;IACJ,CAAC,CAAC,KAAK,EACH,IAA+C,EAC/C,WAAsD,EACtD,EAAE;QACF,kBAAkB,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,OAAO,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC,CACwB,CAAC;AAEhC,6EAA6E;AAE7E;;;;;;;;;;GAUG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkD,EAClD,QAAsD,EACtD,IAA0B;IAE1B,MAAM,UAAU,GAAI,QAAoC,CAAC,UAAU,IAAI,MAAM,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACrC,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAClC,IAAI,CACL,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACvD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IAC7F,OAAO,wBAAwB,CAAC,IAAa,EAAE;QAC7C,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;QAClB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;QACtB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;QAClC,YAAY;QACZ,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,SAAS;IACP,CAAC,CAAC,CAAC,IAAkD,EAAE,QAAsD,EAAE,EAAE,CAC7G,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;IACjD,CAAC,CAAC,MAAM,CAAC,eAAe,CACM,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAAS;IACP,CAAC,CAAC,CAAC,IAAqD,EAAE,QAAyD,EAAE,EAAE,CACnH,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;IACpD,CAAC,CAAC,MAAM,CAAC,kBAAkB,CACM,CAAC;AAEtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,SAAS;IACP,CAAC,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE,CAAC,IAAI;IACjC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACM,CAAC;AAErC;yEACyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAC5B,CAAC;AAExC,6EAA6E;AAE7E,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,uDAAuD;QAC1E,8CAA8C,CACjD,CAAC;AACJ,CAAC;AAED;iFACiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,GAAa,EAAE,KAAe,EAAE,EAAE,CAChE,OAAO,CAAC,GAAY,CAAC,CAAiC,CAAC;AAEzD;kCACkC;AAClC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAe,EAAE,EAAE,GAAE,CAAC,CAAoC,CAAC;AAE9F,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CACnD,CAAC;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CACpD,CAAC;AAC/B,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CACvD,CAAC;AAClC,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAC/C,CAAC;AAC1B,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAC1D,CAAC"}

package/dist/serve/entries/bridge-url.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Re-anchor a bridge WebSocket URL to the page's own origin.
+ *
+ * `pyric dev` / the vite plugin bake their OWN host into the bridge URL it
+ * sends the page (e.g. `ws://localhost:5173/__pyric/sandbox`). But the page may
+ * have been loaded over a different host (Tailscale, a LAN IP) or scheme
+ * (`https` via `tailscale serve`, which then requires `wss`). Connecting to the
+ * baked `localhost` from a remote tab dials the WRONG machine (the client's own
+ * localhost), so the WS fails.
+ *
+ * Keep only the PATH from the server's URL and rebuild the scheme + host from the
+ * page's `location`. The bridge is always mounted on the same server that served
+ * the page, so the page's origin is the correct target wherever it is reached,
+ * with no plugin configuration. This also sidesteps the localhost / 127.0.0.1 /
+ * ::1 family ambiguity, because the browser dials the exact host it loaded from.
+ *
+ * Pure (location is injected) so it is unit-testable. Returns `raw` unchanged if
+ * it cannot be parsed.
+ */
+export declare function toPageOriginWsUrl(raw: string, loc: {
+    href: string;
+    protocol: string;
+    host: string;
+}): string;
+//# sourceMappingURL=bridge-url.d.ts.map

package/dist/serve/entries/bridge-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-url.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/bridge-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpD,MAAM,CAQR"}