@pyric/cli 0.1.0-alpha.10

package/dist/serve/worker/client/service-worker-connection.js

@@ -0,0 +1,53 @@
+/** MessagePort-shaped client transport from ServiceWorkerGlobalScope to the SharedWorker. */
+import { wirePort } from './core.js';
+import { SERVICE_WORKER_CHANNEL, } from '../service-worker-channel.js';
+function newSessionId() {
+    return typeof crypto.randomUUID === 'function'
+        ? crypto.randomUUID()
+        : `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+export function getServiceWorkerFirestore(appName) {
+    if (typeof BroadcastChannel === 'undefined') {
+        throw new Error('BroadcastChannel is required to connect firebase/messaging/sw to the Pyric backend.');
+    }
+    const channel = new BroadcastChannel(SERVICE_WORKER_CHANNEL);
+    // Stable logical id + fresh realm id lets the host replace stale subscriptions
+    // without accepting late frames from the superseded Service Worker realm.
+    const clientId = `service-worker:${encodeURIComponent(appName)}`;
+    const sessionId = newSessionId();
+    channel.postMessage({
+        direction: 'host',
+        phase: 'attach',
+        clientId,
+        sessionId,
+    });
+    const port = {
+        onmessage: null,
+        postMessage(message) {
+            channel.postMessage({
+                direction: 'host',
+                phase: 'message',
+                clientId,
+                sessionId,
+                message,
+            });
+        },
+        start() { },
+        close() {
+            channel.close();
+            port.onmessage = null;
+        },
+    };
+    channel.onmessage = (event) => {
+        const envelope = event.data;
+        if (envelope.direction !== 'client'
+            || envelope.clientId !== clientId
+            || envelope.sessionId !== sessionId)
+            return;
+        port.onmessage?.({ data: envelope.message });
+    };
+    const db = { __kind: 'client-db', port };
+    wirePort(db.port);
+    return db;
+}
+//# sourceMappingURL=service-worker-connection.js.map

package/dist/serve/worker/client/service-worker-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-worker-connection.js","sourceRoot":"","sources":["../../../../src/serve/worker/client/service-worker-connection.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EACL,sBAAsB,GAEvB,MAAM,8BAA8B,CAAC;AAEtC,SAAS,YAAY;IACnB,OAAO,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU;QAC5C,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE;QACrB,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,IAAI,OAAO,gBAAgB,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IAC7D,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,kBAAkB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,OAAO,CAAC,WAAW,CAAC;QAClB,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,QAAQ;QACf,QAAQ;QACR,SAAS;KAC4B,CAAC,CAAC;IACzC,MAAM,IAAI,GAAe;QACvB,SAAS,EAAE,IAAI;QACf,WAAW,CAAC,OAAO;YACjB,OAAO,CAAC,WAAW,CAAC;gBAClB,SAAS,EAAE,MAAM;gBACjB,KAAK,EAAE,SAAS;gBAChB,QAAQ;gBACR,SAAS;gBACT,OAAO;aAC8B,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,KAAI,CAAC;QACV,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;KACmB,CAAC;IACvB,OAAO,CAAC,SAAS,GAAG,CAAC,KAAgD,EAAE,EAAE;QACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QAC5B,IACE,QAAQ,CAAC,SAAS,KAAK,QAAQ;eAC5B,QAAQ,CAAC,QAAQ,KAAK,QAAQ;eAC9B,QAAQ,CAAC,SAAS,KAAK,SAAS;YACnC,OAAO;QACT,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAkB,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAqB,CAAC;IAC5D,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/serve/worker/client/snapshots.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Firestore snapshot machinery for the worker client — wire-form document
+ * results rehydrated into the modular SDK's snapshot shapes. Shared by the
+ * read, listener, and transaction families.
+ */
+import type { SerializedDocData } from '../protocol.js';
+import type { ClientPort, DocRefHandle } from './handles.js';
+export interface RawDocResult {
+    id: string;
+    path?: string;
+    exists: boolean;
+    data?: SerializedDocData;
+}
+export declare function makeDocSnapshot(raw: RawDocResult, port: ClientPort): ClientDocSnapshot;
+export interface RawQueryResult {
+    docs: RawDocResult[];
+}
+export declare function makeQuerySnapshot(raw: RawQueryResult, port: ClientPort): ClientQuerySnapshot;
+export interface ClientDocSnapshot {
+    readonly id: string;
+    readonly path: string;
+    /** Full port-carrying reference, usable by write APIs. */
+    readonly ref: DocRefHandle;
+    exists(): boolean;
+    data(): Record<string, unknown> | undefined;
+}
+export interface ClientQuerySnapshot {
+    readonly size: number;
+    readonly empty: boolean;
+    readonly docs: ClientDocSnapshot[];
+}
+//# sourceMappingURL=snapshots.d.ts.map

package/dist/serve/worker/client/snapshots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshots.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/client/snapshots.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAsB7D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,iBAAiB,CAmBtF;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,GAAG,mBAAmB,CAO5F;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,MAAM,IAAI,OAAO,CAAC;IAClB,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC;CACpC"}

package/dist/serve/worker/client/snapshots.js

@@ -0,0 +1,46 @@
+import { deserializeDocData } from '../protocol.js';
+// ─── Rehydration (class instance restoration) ─────────────────────────────
+/**
+ * Deserialize doc data from wire form to real class instances.
+ *
+ * `deserializeDocData` (protocol.ts) now calls `rehydrateDocValue` from
+ * pyric/sandbox, which reconstructs REAL Timestamp, Bytes, and LatLng
+ * instances — not plain-object look-alikes. This means:
+ *   - `snap.data().createdAt` is a real `Timestamp` with `.seconds`/`.nanos`
+ *   - `snap.data().blob` is a real `Bytes` with `.data` (Uint8Array)
+ *   - `snap.data().where` is a real `LatLng` with `.lat`/`.lng`
+ * Consumer code that uses `instanceof` checks or method calls will work
+ * correctly after deserialization.
+ */
+function rehydrateDocData(serialized) {
+    return deserializeDocData(serialized);
+}
+export function makeDocSnapshot(raw, port) {
+    const data = raw.exists && raw.data ? rehydrateDocData(raw.data) : undefined;
+    const path = raw.path ?? raw.id;
+    const ref = {
+        __kind: 'doc-ref',
+        descriptor: { __ref: 'doc', path },
+        port,
+        id: raw.id,
+        path,
+    };
+    return {
+        id: raw.id,
+        path,
+        // Query snapshot refs are real worker handles, not path-only lookalikes:
+        // Firebase callers may pass `snapshot.ref` straight into deleteDoc/setDoc.
+        ref,
+        exists: () => raw.exists,
+        data: () => data,
+    };
+}
+export function makeQuerySnapshot(raw, port) {
+    const docs = raw.docs.map((doc) => makeDocSnapshot(doc, port));
+    return {
+        size: docs.length,
+        empty: docs.length === 0,
+        docs,
+    };
+}
+//# sourceMappingURL=snapshots.js.map

package/dist/serve/worker/client/snapshots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshots.js","sourceRoot":"","sources":["../../../../src/serve/worker/client/snapshots.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,6EAA6E;AAE7E;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CAAC,UAA6B;IACrD,OAAO,kBAAkB,CAAC,UAAU,CAA4B,CAAC;AACnE,CAAC;AAWD,MAAM,UAAU,eAAe,CAAC,GAAiB,EAAE,IAAgB;IACjE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;IAChC,MAAM,GAAG,GAAiB;QACxB,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE;QAClC,IAAI;QACJ,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI;KACL,CAAC;IACF,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI;QACJ,yEAAyE;QACzE,2EAA2E;QAC3E,GAAG;QACH,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM;QACxB,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI;KACjB,CAAC;AACJ,CAAC;AAMD,MAAM,UAAU,iBAAiB,CAAC,GAAmB,EAAE,IAAgB;IACrE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,MAAM;QACjB,KAAK,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC;QACxB,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/serve/worker/client/storage.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Worker-backed FirebaseStorage mirror (Pyric Studio data browse) — client-side
+ * ref path math plus `listAll`/`getMetadata`/`getBlob`/`getDownloadURL` reads and the base64
+ * byte ops (`uploadBytes`/`getBytes`/`deleteObject`) over the worker port.
+ */
+import type { FullMetadata } from 'pyric/storage';
+import type { ClientDb, ClientPort } from './handles.js';
+/** Worker-backed Storage handle (carries the shared `MessagePort`). */
+export interface ClientFirebaseStorage {
+    readonly __kind: 'client-storage';
+    readonly port: ClientPort;
+}
+/** Worker-backed Storage reference (path + name; carries the port for ops). */
+export interface ClientStorageReference {
+    readonly __kind: 'storage-ref';
+    readonly port: ClientPort;
+    readonly fullPath: string;
+    readonly name: string;
+}
+/**
+ * Get the worker-backed Storage handle. Like `getAuth`, accepts an existing
+ * `ClientDb` (reusing its port) or a worker URL (standalone).
+ */
+export declare function getStorage(source: ClientDb | string | URL, name?: string): ClientFirebaseStorage;
+/** Build a Storage reference. Mirrors `pyric/storage`'s `ref(storage, path?)` /
+ *  `ref(parentRef, path)`. Client-side path math; no RPC. */
+export declare function ref(parent: ClientFirebaseStorage | ClientStorageReference, path?: string): ClientStorageReference;
+/** Enumerate immediate child items + sub-prefixes under a ref (Pyric Studio
+ *  data browse). The host enforces `read` rules on the scanned prefix. */
+export declare function listAll(reference: ClientStorageReference): Promise<{
+    items: ClientStorageReference[];
+    prefixes: ClientStorageReference[];
+}>;
+/** Read an object's metadata (Pyric Studio inspector). */
+export declare function getMetadata(reference: ClientStorageReference): Promise<FullMetadata>;
+/** Read an object's bytes as a Blob (Pyric Studio inspector preview).
+ *  MessagePort-only — a Blob cannot cross the JSON bridge relay. */
+export declare function getBlob(reference: ClientStorageReference): Promise<Blob>;
+/** Return a page-owned URL for an object read through the SharedWorker. */
+export declare function getDownloadURL(reference: ClientStorageReference): Promise<string>;
+/** Mirror of `pyric/storage`'s `SettableMetadata` (plain JSON on the wire). */
+export interface ClientSettableMetadata {
+    contentType?: string;
+    cacheControl?: string;
+    contentDisposition?: string;
+    contentEncoding?: string;
+    contentLanguage?: string;
+    customMetadata?: {
+        [key: string]: string;
+    };
+}
+/** Upload bytes at the reference's path (replaces existing content).
+ *  Mirrors `pyric/storage`'s `uploadBytes` result shape. */
+export declare function uploadBytes(reference: ClientStorageReference, data: Blob | Uint8Array | ArrayBuffer, metadata?: ClientSettableMetadata): Promise<{
+    ref: ClientStorageReference;
+    metadata: FullMetadata;
+}>;
+/** Read an object's bytes (JSON-safe base64 op → `ArrayBuffer`). Mirrors
+ *  `pyric/storage`'s `getBytes`, including the optional client-side cap. */
+export declare function getBytes(reference: ClientStorageReference, maxDownloadSizeBytes?: number): Promise<ArrayBuffer>;
+/** Delete the object at the reference's path (idempotent — missing = no-op,
+ *  matching the sandbox backend's delete semantics). */
+export declare function deleteObject(reference: ClientStorageReference): Promise<void>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/serve/worker/client/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/client/storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAOzD,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAOD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,qBAAqB,CAoBhG;AAED;6DAC6D;AAC7D,wBAAgB,GAAG,CACjB,MAAM,EAAE,qBAAqB,GAAG,sBAAsB,EACtD,IAAI,CAAC,EAAE,MAAM,GACZ,sBAAsB,CAUxB;AAED;0EAC0E;AAC1E,wBAAsB,OAAO,CAC3B,SAAS,EAAE,sBAAsB,GAChC,OAAO,CAAC;IAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAAC,QAAQ,EAAE,sBAAsB,EAAE,CAAA;CAAE,CAAC,CAQlF;AAED,0DAA0D;AAC1D,wBAAsB,WAAW,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAI1F;AAED;oEACoE;AACpE,wBAAsB,OAAO,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9E;AAED,2EAA2E;AAC3E,wBAAsB,cAAc,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvF;AAeD,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED;4DAC4D;AAC5D,wBAAsB,WAAW,CAC/B,SAAS,EAAE,sBAAsB,EACjC,IAAI,EAAE,IAAI,GAAG,UAAU,GAAG,WAAW,EACrC,QAAQ,CAAC,EAAE,sBAAsB,GAChC,OAAO,CAAC;IAAE,GAAG,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,CAAC,CAuBlE;AAED;4EAC4E;AAC5E,wBAAsB,QAAQ,CAC5B,SAAS,EAAE,sBAAsB,EACjC,oBAAoB,CAAC,EAAE,MAAM,GAC5B,OAAO,CAAC,WAAW,CAAC,CActB;AAED;wDACwD;AACxD,wBAAsB,YAAY,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAInF"}

package/dist/serve/worker/client/storage.js

@@ -0,0 +1,125 @@
+/**
+ * Worker-backed FirebaseStorage mirror (Pyric Studio data browse) — client-side
+ * ref path math plus `listAll`/`getMetadata`/`getBlob`/`getDownloadURL` reads and the base64
+ * byte ops (`uploadBytes`/`getBytes`/`deleteObject`) over the worker port.
+ */
+import { bytesToBase64, base64ToBytes, storagePayloadTooLarge, MAX_STORAGE_OP_BYTES } from '../protocol.js';
+import { dataRpc, nextId, wirePort } from './core.js';
+import { lastSegment } from './handles.js';
+/** Strip leading/trailing slashes (the worker keyspace uses bare paths). */
+function normalizeStorageRefPath(path) {
+    return path.replace(/^\/+|\/+$/g, '');
+}
+/**
+ * Get the worker-backed Storage handle. Like `getAuth`, accepts an existing
+ * `ClientDb` (reusing its port) or a worker URL (standalone).
+ */
+export function getStorage(source, name) {
+    let port;
+    if (typeof source === 'object' && '__kind' in source && source.__kind === 'client-db') {
+        port = source.port;
+    }
+    else {
+        if (typeof SharedWorker === 'undefined') {
+            throw new Error('SharedWorker is not available. ' +
+                'Open this page over http:// (not file://) and use a supported browser.');
+        }
+        const worker = new SharedWorker(source, {
+            type: 'classic',
+            name: name ?? 'pyric-shared-worker',
+        });
+        port = worker.port;
+        port.start();
+        wirePort(port);
+    }
+    return { __kind: 'client-storage', port };
+}
+/** Build a Storage reference. Mirrors `pyric/storage`'s `ref(storage, path?)` /
+ *  `ref(parentRef, path)`. Client-side path math; no RPC. */
+export function ref(parent, path) {
+    const rel = normalizeStorageRefPath(path ?? '');
+    let fullPath;
+    if (parent.__kind === 'client-storage') {
+        fullPath = rel;
+    }
+    else {
+        const base = parent.fullPath;
+        fullPath = rel ? (base ? `${base}/${rel}` : rel) : base;
+    }
+    return { __kind: 'storage-ref', port: parent.port, fullPath, name: lastSegment(fullPath) };
+}
+/** Enumerate immediate child items + sub-prefixes under a ref (Pyric Studio
+ *  data browse). The host enforces `read` rules on the scanned prefix. */
+export async function listAll(reference) {
+    const r = (await dataRpc(reference.port, {
+        t: 'op', id: nextId(), method: 'storage.listAll', path: reference.fullPath,
+    }));
+    const mk = (e) => ({
+        __kind: 'storage-ref', port: reference.port, fullPath: e.fullPath, name: e.name,
+    });
+    return { items: r.items.map(mk), prefixes: r.prefixes.map(mk) };
+}
+/** Read an object's metadata (Pyric Studio inspector). */
+export async function getMetadata(reference) {
+    return (await dataRpc(reference.port, {
+        t: 'op', id: nextId(), method: 'storage.getMetadata', path: reference.fullPath,
+    }));
+}
+/** Read an object's bytes as a Blob (Pyric Studio inspector preview).
+ *  MessagePort-only — a Blob cannot cross the JSON bridge relay. */
+export async function getBlob(reference) {
+    return (await dataRpc(reference.port, {
+        t: 'op', id: nextId(), method: 'storage.getBlob', path: reference.fullPath,
+    }));
+}
+/** Return a page-owned URL for an object read through the SharedWorker. */
+export async function getDownloadURL(reference) {
+    return URL.createObjectURL(await getBlob(reference));
+}
+/** Upload bytes at the reference's path (replaces existing content).
+ *  Mirrors `pyric/storage`'s `uploadBytes` result shape. */
+export async function uploadBytes(reference, data, metadata) {
+    const bytes = data instanceof Blob
+        ? new Uint8Array(await data.arrayBuffer())
+        : data instanceof ArrayBuffer
+            ? new Uint8Array(data)
+            : data;
+    if (bytes.byteLength > MAX_STORAGE_OP_BYTES) {
+        throw storagePayloadTooLarge(bytes.byteLength, `uploadBytes payload for '${reference.fullPath}'`);
+    }
+    // contentType precedence mirrors pyric/storage: caller metadata → Blob.type.
+    const contentType = metadata?.contentType ?? (data instanceof Blob && data.type ? data.type : undefined);
+    const stored = (await dataRpc(reference.port, {
+        t: 'op',
+        id: nextId(),
+        method: 'storage.putBytes',
+        path: reference.fullPath,
+        dataB64: bytesToBase64(bytes),
+        ...(contentType !== undefined ? { contentType } : {}),
+        ...(metadata !== undefined ? { metadata: metadata } : {}),
+    }));
+    return { ref: reference, metadata: stored };
+}
+/** Read an object's bytes (JSON-safe base64 op → `ArrayBuffer`). Mirrors
+ *  `pyric/storage`'s `getBytes`, including the optional client-side cap. */
+export async function getBytes(reference, maxDownloadSizeBytes) {
+    const res = (await dataRpc(reference.port, {
+        t: 'op', id: nextId(), method: 'storage.getBytes', path: reference.fullPath,
+    }));
+    if (typeof maxDownloadSizeBytes === 'number' && res.size > maxDownloadSizeBytes) {
+        const err = new Error(`storage/quota-exceeded: object at '${reference.fullPath}' is ${res.size} bytes — ` +
+            `over the requested maxDownloadSizeBytes (${maxDownloadSizeBytes}).`);
+        err.code = 'storage/quota-exceeded';
+        throw err;
+    }
+    const bytes = base64ToBytes(res.dataB64);
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+/** Delete the object at the reference's path (idempotent — missing = no-op,
+ *  matching the sandbox backend's delete semantics). */
+export async function deleteObject(reference) {
+    await dataRpc(reference.port, {
+        t: 'op', id: nextId(), method: 'storage.deleteObject', path: reference.fullPath,
+    });
+}
+//# sourceMappingURL=storage.js.map

package/dist/serve/worker/client/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../../../src/serve/worker/client/storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE5G,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAsB3C,4EAA4E;AAC5E,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAA+B,EAAE,IAAa;IACvE,IAAI,IAAgB,CAAC;IACrB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtF,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,YAAY,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,iCAAiC;gBACjC,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAsB,EAAE;YACtD,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI,IAAI,qBAAqB;SACpC,CAAC,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACnB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;6DAC6D;AAC7D,MAAM,UAAU,GAAG,CACjB,MAAsD,EACtD,IAAa;IAEb,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,QAAgB,CAAC;IACrB,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACvC,QAAQ,GAAG,GAAG,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;0EAC0E;AAC1E,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,SAAiC;IAEjC,MAAM,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACvC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ;KAC3E,CAAC,CAA8G,CAAC;IACjH,MAAM,EAAE,GAAG,CAAC,CAAqC,EAA0B,EAAE,CAAC,CAAC;QAC7E,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;KAChF,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAiC;IACjE,OAAO,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACpC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ;KAC/E,CAAC,CAAiB,CAAC;AACtB,CAAC;AAED;oEACoE;AACpE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAiC;IAC7D,OAAO,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACpC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ;KAC3E,CAAC,CAAS,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiC;IACpE,OAAO,GAAG,CAAC,eAAe,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AACvD,CAAC;AAyBD;4DAC4D;AAC5D,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiC,EACjC,IAAqC,EACrC,QAAiC;IAEjC,MAAM,KAAK,GACT,IAAI,YAAY,IAAI;QAClB,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,CAAC,CAAC,IAAI,YAAY,WAAW;YAC3B,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;YACtB,CAAC,CAAC,IAAI,CAAC;IACb,IAAI,KAAK,CAAC,UAAU,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,4BAA4B,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,6EAA6E;IAC7E,MAAM,WAAW,GACf,QAAQ,EAAE,WAAW,IAAI,CAAC,IAAI,YAAY,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QAC5C,CAAC,EAAE,IAAI;QACP,EAAE,EAAE,MAAM,EAAE;QACZ,MAAM,EAAE,kBAAkB;QAC1B,IAAI,EAAE,SAAS,CAAC,QAAQ;QACxB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;QAC7B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAmC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC,CAAiB,CAAC;IACpB,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED;4EAC4E;AAC5E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,SAAiC,EACjC,oBAA6B;IAE7B,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACzC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ;KAC5E,CAAC,CAAsC,CAAC;IACzC,IAAI,OAAO,oBAAoB,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,sCAAsC,SAAS,CAAC,QAAQ,QAAQ,GAAG,CAAC,IAAI,WAAW;YACjF,4CAA4C,oBAAoB,IAAI,CAC3C,CAAC;QAC9B,GAAG,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACpC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAC;AAClG,CAAC;AAED;wDACwD;AACxD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiC;IAClE,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QAC5B,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ;KAChF,CAAC,CAAC;AACL,CAAC"}

package/dist/serve/worker/client/studio.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Pyric Studio cross-service surfaces over the worker port — the unified event
+ * stream (`subscribeEvents`/`eventHistory`) and the sandbox snapshot export
+ * used by the rules re-run flow.
+ */
+import type { SandboxEvent, SandboxSnapshot } from 'pyric/sandbox';
+import type { ClientDb, Unsubscribe } from './handles.js';
+/**
+ * Subscribe to the worker sandbox's unified event stream. The callback fires
+ * with each delivered BATCH of events — the FIRST call carries the initial
+ * `history()` snapshot (possibly empty), each subsequent call carries one live
+ * event. Returns an unsubscribe that deregisters on the worker.
+ *
+ * This is the live counterpart to `sandbox.onEvent` + an initial `history()`
+ * fold, collapsed into one subscription so a late subscriber never misses the
+ * backlog.
+ */
+export declare function subscribeEvents(db: ClientDb, callback: (events: readonly SandboxEvent[]) => void): Unsubscribe;
+/**
+ * Fetch the worker sandbox's event history as a one-shot snapshot (every event
+ * so far). Opens a transient stream sub, resolves with the initial history
+ * batch, and tears the sub down immediately — so it never holds a live
+ * subscription. Useful for a late, snapshot-only consumer.
+ */
+export declare function eventHistory(db: ClientDb): Promise<readonly SandboxEvent[]>;
+/**
+ * Export the current sandbox snapshot (Pyric Studio rules re-run). Studio forks
+ * it locally to test a denied op against edited rules or re-issue it as the
+ * attempting user, on a throwaway branch (no live mutation).
+ */
+export declare function getSnapshot(db: ClientDb): Promise<SandboxSnapshot>;
+//# sourceMappingURL=studio.d.ts.map

package/dist/serve/worker/client/studio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"studio.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/client/studio.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAgB1D;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,KAAK,IAAI,GAClD,WAAW,CAYb;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAQ3E;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAExE"}

package/dist/serve/worker/client/studio.js

@@ -0,0 +1,61 @@
+/**
+ * Pyric Studio cross-service surfaces over the worker port — the unified event
+ * stream (`subscribeEvents`/`eventHistory`) and the sandbox snapshot export
+ * used by the rules re-run flow.
+ */
+import { closeSubscription, nextId, nextSubId, openEventSubscription, rpc } from './core.js';
+// ════════════════════════════════════════════════════════════════════════
+//  EVENT STREAM (Pyric Studio keystone — onEvent/history over the port)
+// ════════════════════════════════════════════════════════════════════════
+//
+// Surfaces the worker sandbox's unified cross-service event stream to the page.
+// `subscribeEvents(db, cb)` registers a stream sub: the worker first delivers
+// `sandbox.history()` as one batch, then streams each live `SandboxEvent` as a
+// single-element batch. `eventHistory(db)` is a one-shot history fetch (a fresh
+// short-lived sub) for consumers that want a snapshot without staying live.
+//
+// These mirror `sandbox.onEvent(cb)` / `sandbox.history()` so a consumer can
+// adapt them into the same `{ onEvent, history }`-shaped source the in-process
+// sandbox exposes (e.g. Studio's `feedFromSandboxLike`).
+/**
+ * Subscribe to the worker sandbox's unified event stream. The callback fires
+ * with each delivered BATCH of events — the FIRST call carries the initial
+ * `history()` snapshot (possibly empty), each subsequent call carries one live
+ * event. Returns an unsubscribe that deregisters on the worker.
+ *
+ * This is the live counterpart to `sandbox.onEvent` + an initial `history()`
+ * fold, collapsed into one subscription so a late subscriber never misses the
+ * backlog.
+ */
+export function subscribeEvents(db, callback) {
+    const subId = nextSubId();
+    const port = db.port;
+    openEventSubscription(port, subId, callback, { t: 'sub', subId, target: 'events' });
+    return () => {
+        closeSubscription(port, subId);
+    };
+}
+/**
+ * Fetch the worker sandbox's event history as a one-shot snapshot (every event
+ * so far). Opens a transient stream sub, resolves with the initial history
+ * batch, and tears the sub down immediately — so it never holds a live
+ * subscription. Useful for a late, snapshot-only consumer.
+ */
+export function eventHistory(db) {
+    return new Promise((resolve) => {
+        const unsub = subscribeEvents(db, (events) => {
+            // The first delivery is the history snapshot; resolve + unsubscribe.
+            unsub();
+            resolve(events);
+        });
+    });
+}
+/**
+ * Export the current sandbox snapshot (Pyric Studio rules re-run). Studio forks
+ * it locally to test a denied op against edited rules or re-issue it as the
+ * attempting user, on a throwaway branch (no live mutation).
+ */
+export async function getSnapshot(db) {
+    return (await rpc(db.port, { t: 'op', id: nextId(), method: 'getSnapshot' }));
+}
+//# sourceMappingURL=studio.js.map

package/dist/serve/worker/client/studio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"studio.js","sourceRoot":"","sources":["../../../../src/serve/worker/client/studio.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAG7F,2EAA2E;AAC3E,wEAAwE;AACxE,2EAA2E;AAC3E,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,yDAAyD;AAEzD;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,EAAY,EACZ,QAAmD;IAEnD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;IACrB,qBAAqB,CACnB,IAAI,EACJ,KAAK,EACL,QAAQ,EACR,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAA2B,CAC/D,CAAC;IACF,OAAO,GAAG,EAAE;QACV,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,EAAY;IACvC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;YAC3C,qEAAqE;YACrE,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAY;IAC5C,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAoB,CAAC;AACnG,CAAC"}

package/dist/serve/worker/client.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Worker client SDK — mirrors `pyric/firestore` (+ `pyric/auth`, `pyric/storage`,
+ * and the RTDB modular subset) for the SharedWorker data plane. App code can
+ * swap its `pyric/firestore` import for this module (via an import-map) and have
+ * every operation route to the single worker-hosted sandbox instead of an
+ * in-page one — same function names, same argument shapes, same return types.
+ *
+ * This module is a re-export barrel over the per-family modules under `client/`:
+ *   - `core`            transport singleton (RPC correlation, subscriber maps,
+ *                       port wiring, the Studio auth-lens + op-issuer stamp)
+ *   - `handles`         opaque port-carrying handle types + `Unsubscribe`
+ *   - `snapshots`       firestore snapshot rehydration + snapshot types
+ *   - `connection`      connect, worker version/instance, state/branches, relay
+ *   - `firestore-refs`  ref / query / sentinel descriptor factories (no RPC)
+ *   - `firestore-reads` read + aggregate execution + `onSnapshot`
+ *   - `firestore-writes` writes + `writeBatch` + `runTransaction`
+ *   - `rules`           Firestore/RTDB rules deploy + status
+ *   - `admin-firestore` admin-lens document ops
+ *   - `rtdb`            RTDB modular subset
+ *   - `studio`          event stream, confirm-policy, sandbox snapshot
+ *   - `auth`            per-port auth surface
+ *   - `storage`         worker-backed storage mirror
+ *   - `messaging`       token lifecycle + foreground/background subscriptions
+ *
+ * The barrel is part of the worker's PUBLIC shape: `serve/worker/index.ts`
+ * re-exports from here for the `@pyric/cli/serve/worker` package subpath.
+ */
+export { setLens, getLens, setOpIssuer } from './client/core.js';
+export type { ClientDb, ClientRtdb, RtdbRefHandle, RtdbDataSnapshot, DocRefHandle, CollRefHandle, QueryHandle, AnyHandle, Unsubscribe, } from './client/handles.js';
+export type { ClientDocSnapshot, ClientQuerySnapshot } from './client/snapshots.js';
+export * from './client/connection.js';
+export * from './client/firestore-refs.js';
+export * from './client/firestore-reads.js';
+export * from './client/firestore-writes.js';
+export * from './client/rules.js';
+export * from './client/admin-firestore.js';
+export * from './client/rtdb.js';
+export * from './client/studio.js';
+export * from './client/presence.js';
+export * from './client/auth.js';
+export * from './client/storage.js';
+export * from './client/ai.js';
+//# sourceMappingURL=client.d.ts.map

package/dist/serve/worker/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/serve/worker/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjE,YAAY,EACV,QAAQ,EACR,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAIpF,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC"}

package/dist/serve/worker/client.js

@@ -0,0 +1,44 @@
+/**
+ * Worker client SDK — mirrors `pyric/firestore` (+ `pyric/auth`, `pyric/storage`,
+ * and the RTDB modular subset) for the SharedWorker data plane. App code can
+ * swap its `pyric/firestore` import for this module (via an import-map) and have
+ * every operation route to the single worker-hosted sandbox instead of an
+ * in-page one — same function names, same argument shapes, same return types.
+ *
+ * This module is a re-export barrel over the per-family modules under `client/`:
+ *   - `core`            transport singleton (RPC correlation, subscriber maps,
+ *                       port wiring, the Studio auth-lens + op-issuer stamp)
+ *   - `handles`         opaque port-carrying handle types + `Unsubscribe`
+ *   - `snapshots`       firestore snapshot rehydration + snapshot types
+ *   - `connection`      connect, worker version/instance, state/branches, relay
+ *   - `firestore-refs`  ref / query / sentinel descriptor factories (no RPC)
+ *   - `firestore-reads` read + aggregate execution + `onSnapshot`
+ *   - `firestore-writes` writes + `writeBatch` + `runTransaction`
+ *   - `rules`           Firestore/RTDB rules deploy + status
+ *   - `admin-firestore` admin-lens document ops
+ *   - `rtdb`            RTDB modular subset
+ *   - `studio`          event stream, confirm-policy, sandbox snapshot
+ *   - `auth`            per-port auth surface
+ *   - `storage`         worker-backed storage mirror
+ *   - `messaging`       token lifecycle + foreground/background subscriptions
+ *
+ * The barrel is part of the worker's PUBLIC shape: `serve/worker/index.ts`
+ * re-exports from here for the `@pyric/cli/serve/worker` package subpath.
+ */
+// Shared core: lens/issuer controls + the handle and snapshot types.
+export { setLens, getLens, setOpIssuer } from './client/core.js';
+// API families. Each module exports only its public surface; internal helpers
+// stay unexported, so `export *` re-exports exactly the published symbols.
+export * from './client/connection.js';
+export * from './client/firestore-refs.js';
+export * from './client/firestore-reads.js';
+export * from './client/firestore-writes.js';
+export * from './client/rules.js';
+export * from './client/admin-firestore.js';
+export * from './client/rtdb.js';
+export * from './client/studio.js';
+export * from './client/presence.js';
+export * from './client/auth.js';
+export * from './client/storage.js';
+export * from './client/ai.js';
+//# sourceMappingURL=client.js.map

package/dist/serve/worker/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/serve/worker/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,qEAAqE;AACrE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAcjE,8EAA8E;AAC9E,2EAA2E;AAC3E,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC"}

package/dist/serve/worker/entry.d.ts

@@ -0,0 +1,40 @@
+/**
+ * SharedWorker entry point — the actual SharedWorker script.
+ *
+ * WHY A SEPARATE ENTRY
+ * --------------------
+ * `host.ts` is pure-ish: it accepts an injected `{ db, sandbox }` and
+ * fake ports, so tests can drive it without a real SharedWorker runtime.
+ * This file is the integration shell: it creates the ONE real sandbox,
+ * attaches IDB persistence, deploys permissive starter rules, and wires
+ * every connecting port to `handleMessage`.
+ *
+ * Do NOT import this file in tests — import `host.ts` directly.
+ *
+ * LIFECYCLE
+ * ---------
+ * The SharedWorker lives while at least one tab holds a port. When all
+ * tabs close or navigate away, the worker is GC'd. IDB persistence means
+ * data survives full close → reopen cycles: on the next connect the sandbox
+ * restores from IDB, and the tab reconnects to a warm state.
+ *
+ * PERSISTENCE KEY
+ * ---------------
+ * Using `'pyric-shared-worker'` as the IDB persistence key. This is a
+ * package-level default; serve integration (Phase 3) may want to scope
+ * it per-project or per-port. Phase 1 keeps it simple.
+ *
+ * RULES
+ * -----
+ * We deploy a permissive starter ruleset on first init. Callers change
+ * rules at runtime via `{ t:'op', method:'setRules', source }` messages.
+ *
+ * SINGLE SANDBOX GUARANTEE
+ * ------------------------
+ * `_ctx` is module-level. The first `connect` event lazily creates it;
+ * all subsequent ports reuse the same ctx — one sandbox, one Firestore
+ * backend for all tabs. This is the architectural invariant the whole
+ * SharedWorker approach depends on.
+ */
+export {};
+//# sourceMappingURL=entry.d.ts.map

package/dist/serve/worker/entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.d.ts","sourceRoot":"","sources":["../../../src/serve/worker/entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG"}