@pyric/cli 0.1.0-alpha.11 → 0.1.0-alpha.12

package/src/serve/entries/auth-helper-core.ts

@@ -0,0 +1,181 @@
+/**
+ * Framework-free provider account picker controller for `pyric dev`.
+ *
+ * The controller is intentionally backend-agnostic. It receives an identity
+ * directory and returns a Firebase-shaped credential; it never constructs an
+ * Auth handle or mutates a Sandbox. In SharedWorker mode the directory reads
+ * the worker's user pool and the picked credential is committed by
+ * `auth.acceptIdentity`. The in-page fallback supplies a small adapter over its
+ * local auth user store.
+ */
+import type {
+  AuthFlowRequest,
+  AuthFlowResolver,
+  User,
+  UserCredential,
+} from 'pyric/auth';
+
+export interface NewIdentitySpec {
+  email: string;
+  displayName?: string;
+  /** Parsed custom claims (the emulator's `customAttributes`). */
+  customClaims?: Record<string, unknown>;
+}
+
+export interface HelperIdentity {
+  uid: string;
+  email: string | null;
+  displayName: string | null;
+  customClaims: Record<string, unknown>;
+}
+
+export interface HelperIdentityDirectory {
+  list(): HelperIdentity[] | Promise<HelperIdentity[]>;
+  /** Optional on the worker path: `auth.acceptIdentity` performs the write. */
+  add?(identity: HelperIdentity): void | Promise<void>;
+}
+
+export interface HelperSnapshot {
+  /** The in-flight request, or null when no popup/redirect is pending. */
+  request: AuthFlowRequest | null;
+  identities: readonly HelperIdentity[];
+}
+
+type Pending = {
+  req: AuthFlowRequest;
+  resolve: (c: UserCredential) => void;
+  reject: (e: unknown) => void;
+};
+
+export class ServeAuthHelper {
+  private pending: Pending | null = null;
+  private readonly listeners = new Set<() => void>();
+  private cached: HelperSnapshot | null = null;
+  private identities: HelperIdentity[] = [];
+
+  constructor(private readonly directory: HelperIdentityDirectory) {
+    this.refreshIdentities();
+  }
+
+  resolver(): AuthFlowResolver {
+    const open = (req: AuthFlowRequest): Promise<UserCredential> =>
+      new Promise<UserCredential>((resolve, reject) => {
+        if (this.pending) this.cancel();
+        this.pending = { req, resolve, reject };
+        this.emit();
+        this.refreshIdentities();
+      });
+    return { openPopup: open, openRedirect: open };
+  }
+
+  subscribe(fn: () => void): () => void {
+    this.listeners.add(fn);
+    return () => this.listeners.delete(fn);
+  }
+
+  snapshot(): HelperSnapshot {
+    this.cached ??= {
+      request: this.pending?.req ?? null,
+      identities: this.identities,
+    };
+    return this.cached;
+  }
+
+  private emit(): void {
+    this.cached = null;
+    for (const listener of this.listeners) listener();
+  }
+
+  private refreshIdentities(): void {
+    try {
+      const listed = this.directory.list();
+      if (listed instanceof Promise) {
+        void listed.then(
+          (identities) => {
+            this.identities = identities;
+            this.emit();
+          },
+          (error) => {
+            const pending = this.take();
+            pending?.reject(error);
+          },
+        );
+      } else {
+        this.identities = listed;
+        this.emit();
+      }
+    } catch (error) {
+      const pending = this.take();
+      pending?.reject(error);
+    }
+  }
+
+  pick(uid: string): void {
+    const pending = this.take();
+    if (!pending) return;
+    const identity = this.identities.find((candidate) => candidate.uid === uid);
+    if (!identity) {
+      pending.reject(authError('auth/internal-error', `unknown identity ${uid}`));
+      return;
+    }
+    pending.resolve(this.credential(identity, pending.req.providerId));
+  }
+
+  add(spec: NewIdentitySpec): void {
+    const pending = this.take();
+    if (!pending) return;
+    const identity: HelperIdentity = {
+      uid: `${pending.req.providerId}:${spec.email}`,
+      email: spec.email,
+      displayName: spec.displayName ?? null,
+      customClaims: spec.customClaims ?? {},
+    };
+    void Promise.resolve(this.directory.add?.(identity)).then(
+      () => pending.resolve(this.credential(identity, pending.req.providerId)),
+      pending.reject,
+    );
+  }
+
+  cancel(): void {
+    const pending = this.take();
+    if (!pending) return;
+    pending.reject(
+      authError(
+        'auth/popup-closed-by-user',
+        'The popup has been closed by the user before finalizing the operation.',
+      ),
+    );
+  }
+
+  private take(): Pending | null {
+    const pending = this.pending;
+    this.pending = null;
+    this.emit();
+    return pending;
+  }
+
+  private credential(identity: HelperIdentity, providerId: string): UserCredential {
+    const user: User = {
+      uid: identity.uid,
+      email: identity.email,
+      displayName: identity.displayName,
+      isAnonymous: false,
+      getIdToken: async () => `pyric-serve-${identity.uid}`,
+      getIdTokenResult: async () => ({
+        token: `pyric-serve-${identity.uid}`,
+        claims: { sub: identity.uid, ...identity.customClaims },
+        expirationTime: new Date(Date.now() + 3600_000).toISOString(),
+        issuedAtTime: new Date().toISOString(),
+        authTime: new Date().toISOString(),
+      }),
+    };
+    return { user, providerId, operationType: 'signIn' };
+  }
+}
+
+function authError(code: string, message: string): Error & { code: string } {
+  const error = new Error(message) as Error & { code: string };
+  error.name = 'FirebaseError';
+  error.code = code;
+  return error;
+}

package/src/serve/entries/auth-helper-dom.ts

@@ -0,0 +1,134 @@
+/**
+ * The `<dialog>` shell over {@link ServeAuthHelper} — pyric dev's analog
+ * of the Auth emulator's sign-in widget. Pure-DOM (no framework): renders an
+ * account picker + an add-account form (email, display name, custom-claims
+ * JSON — emulator parity, `customAttributes`), opens when a popup/redirect
+ * request parks in the helper, closes on settle. Backdrop/Escape cancel →
+ * `auth/popup-closed-by-user` via the core.
+ *
+ * Verified through the scripted browser gate (the bun suite covers the core;
+ * this file is intentionally view-only).
+ */
+import type { ServeAuthHelper } from './auth-helper-core.js';
+
+const PROVIDER_LABEL: Record<string, string> = {
+  'google.com': 'Google',
+  'facebook.com': 'Facebook',
+  'github.com': 'GitHub',
+  'apple.com': 'Apple',
+};
+
+const STYLE = `
+  dialog[data-pyric-auth] { border: 1px solid #2a2a35; border-radius: 12px; background: #16161d;
+    color: #e8e8ee; font: 14px/1.45 system-ui, sans-serif; padding: 20px; width: min(420px, 92vw); }
+  dialog[data-pyric-auth]::backdrop { background: rgb(0 0 0 / 0.6); }
+  dialog[data-pyric-auth] h2 { margin: 0 0 4px; font-size: 16px; }
+  dialog[data-pyric-auth] p { margin: 0 0 14px; font-size: 12px; color: #9a9aa8; }
+  dialog[data-pyric-auth] .ids { display: grid; gap: 8px; margin-bottom: 14px; }
+  dialog[data-pyric-auth] .ids button { display: flex; gap: 10px; align-items: center; text-align: left;
+    padding: 8px 10px; border: 1px solid #2a2a35; border-radius: 8px; background: none; color: inherit; cursor: pointer; }
+  dialog[data-pyric-auth] .ids button:hover { border-color: #4a4a5a; background: rgb(255 255 255 / 0.05); }
+  dialog[data-pyric-auth] form { display: grid; gap: 8px; border-top: 1px solid #2a2a35; padding-top: 14px; }
+  dialog[data-pyric-auth] input, dialog[data-pyric-auth] textarea { background: none; color: inherit;
+    border: 1px solid #2a2a35; border-radius: 8px; padding: 8px 10px; font: inherit; }
+  dialog[data-pyric-auth] textarea { font-family: ui-monospace, monospace; font-size: 12px; }
+  dialog[data-pyric-auth] .row { display: flex; justify-content: flex-end; gap: 8px; margin-top: 6px; }
+  dialog[data-pyric-auth] .row button { padding: 8px 14px; border-radius: 8px; border: none; cursor: pointer; font: inherit; }
+  dialog[data-pyric-auth] .cancel { background: none; color: #9a9aa8; }
+  dialog[data-pyric-auth] .submit { background: #5b5bd6; color: white; }
+  dialog[data-pyric-auth] .err { color: #ff6b6b; font-size: 12px; }
+`;
+
+export function mountAuthHelperDialog(helper: ServeAuthHelper): void {
+  const style = document.createElement('style');
+  style.textContent = STYLE;
+  document.head.appendChild(style);
+
+  const dialog = document.createElement('dialog');
+  dialog.setAttribute('data-pyric-auth', '');
+  document.body.appendChild(dialog);
+
+  // <dialog> cancel (Escape) + backdrop click → cancel the flow.
+  dialog.addEventListener('cancel', () => helper.cancel());
+  dialog.addEventListener('click', (e) => {
+    if (e.target === dialog) helper.cancel(); // backdrop only
+  });
+
+  const render = (): void => {
+    const snap = helper.snapshot();
+    if (!snap.request) {
+      if (dialog.open) dialog.close();
+      return;
+    }
+    const provider = PROVIDER_LABEL[snap.request.providerId] ?? snap.request.providerId;
+    dialog.replaceChildren();
+
+    const h2 = document.createElement('h2');
+    h2.textContent = `Sign in with ${provider}`;
+    const p = document.createElement('p');
+    p.textContent =
+      'pyric dev sign-in helper — pick a test account or add one. Custom claims let rules using request.auth.token.* run against this identity.';
+    dialog.append(h2, p);
+
+    if (snap.identities.length > 0) {
+      const ids = document.createElement('div');
+      ids.className = 'ids';
+      for (const id of snap.identities) {
+        const btn = document.createElement('button');
+        btn.type = 'button';
+        const label = id.displayName || id.email || id.uid;
+        btn.textContent = id.email && id.displayName ? `${label} — ${id.email}` : label;
+        btn.addEventListener('click', () => helper.pick(id.uid));
+        ids.appendChild(btn);
+      }
+      dialog.appendChild(ids);
+    }
+
+    const form = document.createElement('form');
+    form.method = 'dialog';
+    const email = document.createElement('input');
+    email.type = 'email';
+    email.placeholder = 'email@example.com';
+    email.required = true;
+    const name = document.createElement('input');
+    name.type = 'text';
+    name.placeholder = 'Display name (optional)';
+    const claims = document.createElement('textarea');
+    claims.rows = 3;
+    claims.placeholder = 'Custom claims JSON (optional)\ne.g. { "admin": true }';
+    const err = document.createElement('div');
+    err.className = 'err';
+    const row = document.createElement('div');
+    row.className = 'row';
+    const cancel = document.createElement('button');
+    cancel.type = 'button';
+    cancel.className = 'cancel';
+    cancel.textContent = 'Cancel';
+    cancel.addEventListener('click', () => helper.cancel());
+    const submit = document.createElement('button');
+    submit.type = 'submit';
+    submit.className = 'submit';
+    submit.textContent = 'Sign in';
+    row.append(cancel, submit);
+    form.append(email, name, claims, err, row);
+    form.addEventListener('submit', (e) => {
+      e.preventDefault();
+      let parsed: Record<string, unknown> | undefined;
+      if (claims.value.trim()) {
+        try {
+          parsed = JSON.parse(claims.value) as Record<string, unknown>;
+        } catch {
+          err.textContent = 'Custom claims must be valid JSON.';
+          return;
+        }
+      }
+      helper.add({ email: email.value.trim(), displayName: name.value.trim() || undefined, customClaims: parsed });
+    });
+    dialog.appendChild(form);
+
+    if (!dialog.open) dialog.showModal();
+  };
+
+  helper.subscribe(render);
+  render();
+}

package/src/serve/entries/auth-helper-runtime.ts

@@ -0,0 +1,20 @@
+/** Shared resolver slot connecting the injected init entry to firebase/auth. */
+import type { AuthFlowRequest, AuthFlowResolver, UserCredential } from 'pyric/auth';
+
+let resolver: AuthFlowResolver | null = null;
+
+export function installServeAuthResolver(next: AuthFlowResolver): void {
+  resolver = next;
+}
+
+export function resolveServeAuthFlow(
+  request: AuthFlowRequest,
+  kind: 'popup' | 'redirect',
+): Promise<UserCredential> {
+  if (!resolver) {
+    return Promise.reject(
+      new Error('pyric dev provider helper is not initialized; load /__pyric/sdk/init.js first'),
+    );
+  }
+  return kind === 'popup' ? resolver.openPopup(request) : resolver.openRedirect(request);
+}

package/src/serve/entries/auth.ts

@@ -0,0 +1,255 @@
+/**
+ * The bundle the import map serves for `firebase/auth`.
+ *
+ * DUAL-PATH (Phase 3c): when a SharedWorker is available, auth routes to the
+ * ONE worker-hosted sandbox — shared user pool + data, PER-TAB sessions
+ * (#754: each tab signs in as its own user). Otherwise it runs against the
+ * in-page sandbox — the unchanged fallback. Branch picked ONCE at load
+ * (`useWorker`).
+ *
+ * PROVIDER SIGN-IN: the picker UI lives in-page, but its controller is
+ * backend-free. In worker mode it lists identities from the worker and returns
+ * a plain credential to `auth.acceptIdentity`; no page-local Auth handle signs
+ * in or seeds a user. Email/password + anonymous also go straight to the
+ * worker. The COMPLETE surface is exported on both paths (import-time parity).
+ */
+import * as ipAuth from 'pyric/auth';
+import { getAuth as pyricGetAuth, setPersistence as pyricSetPersistence } from 'pyric/auth';
+import * as wcRaw from '../worker/client.js';
+import { acceptProviderCredential, restorePortSession } from '../worker/client.js';
+import { useWorker } from './worker-runtime.js';
+import { sessionStoreForApp } from './app-session-store.js';
+import { resolveServeAuthFlow } from './auth-helper-runtime.js';
+import type { SessionMode } from './session-store.js';
+import { getApp, type FirebaseApp } from 'pyric/app';
+import { workerClientForApp } from './app-client.js';
+
+// Worker-client auth, cast to the canonical pyric/auth surface for the picked
+// bindings (same names + shapes). Provider-bridge specifics are explicit below.
+const wc = wcRaw as unknown as typeof ipAuth;
+
+/** Observers + email/anon sign-in: worker-client or in-page. */
+const A = useWorker ? wc : ipAuth;
+export const onAuthStateChanged = A.onAuthStateChanged;
+export const onIdTokenChanged = A.onIdTokenChanged;
+/**
+ * Worker mode: the gate can't run before a worker-committed transition
+ * (see `worker/client.ts`'s `beforeAuthStateChanged` doc) — registering
+ * throws immediately rather than silently accepting a no-op callback.
+ * In-page mode: full block-and-abort semantics via `pyric/auth`.
+ */
+export const beforeAuthStateChanged = A.beforeAuthStateChanged;
+export const signInAnonymously = A.signInAnonymously;
+export const signInWithEmailAndPassword = A.signInWithEmailAndPassword;
+export const createUserWithEmailAndPassword = A.createUserWithEmailAndPassword;
+export const signOut = A.signOut;
+export const connectAuthEmulator = A.connectAuthEmulator;
+
+/**
+ * `updateProfile(user, { displayName?, photoURL? })` — updates the signed-in
+ * user's profile on the picked path (worker or in-page). Both `wc` and `ipAuth`
+ * export a top-level `updateProfile`; cast to the canonical `pyric/auth` shape.
+ * (Fixes #746: the served `firebase/auth` entry didn't re-export this at all.)
+ */
+export const updateProfile = (useWorker ? wc.updateProfile : ipAuth.updateProfile) as typeof ipAuth.updateProfile;
+
+// ── Provider value classes + persistence markers — path-independent ───────
+export const GoogleAuthProvider = ipAuth.GoogleAuthProvider;
+export const EmailAuthProvider = ipAuth.EmailAuthProvider;
+export const FacebookAuthProvider = ipAuth.FacebookAuthProvider;
+export const GithubAuthProvider = ipAuth.GithubAuthProvider;
+export const OAuthProvider = ipAuth.OAuthProvider;
+export const browserLocalPersistence = ipAuth.browserLocalPersistence;
+export const browserSessionPersistence = ipAuth.browserSessionPersistence;
+export const inMemoryPersistence = ipAuth.inMemoryPersistence;
+
+// ── getAuth — worker-backed auth (reusing the shared worker port) or in-page.
+const workerAuthByApp = new WeakMap<FirebaseApp, ReturnType<typeof pyricGetAuth>>();
+const persistenceWired = new WeakSet<FirebaseApp>();
+
+function wireAppPersistence(
+  app: FirebaseApp,
+  auth: ReturnType<typeof pyricGetAuth>,
+): void {
+  if (persistenceWired.has(app)) return;
+  persistenceWired.add(app);
+  const store = sessionStoreForApp(app);
+  const stored = store.load();
+  if (useWorker && stored) {
+    // Posting restore before listener registration preserves FIFO ordering on
+    // this app's MessagePort, so the initial listener value is the restore.
+    void restorePortSession(auth as never, stored.uid).then((user) => {
+      if (!user) store.clear();
+    });
+  } else if (!useWorker && stored) {
+    try {
+      ipAuth.sandbox.restoreSession(auth, stored.uid);
+    } catch {
+      store.clear();
+    }
+  }
+  A.onAuthStateChanged(auth, (user) => {
+    if (user) store.save(user.uid);
+    else store.clear();
+  });
+}
+
+export const getAuth = ((app?: FirebaseApp) => {
+  const resolved = app ?? getApp();
+  if (!useWorker) {
+    const handle = pyricGetAuth(resolved);
+    wireAppPersistence(resolved, handle);
+    return handle;
+  }
+  const existing = workerAuthByApp.get(resolved);
+  if (existing) return existing;
+  const client = workerClientForApp(resolved);
+  const handle = Object.assign(wc.getAuth(client as never), {
+    app: resolved,
+  }) as unknown as ReturnType<typeof pyricGetAuth>;
+  workerAuthByApp.set(resolved, handle);
+  wireAppPersistence(resolved, handle);
+  return handle;
+}) as typeof pyricGetAuth;
+
+/**
+ * Narrow a `Persistence.type` to the three web-storage slots the session store
+ * actually has.
+ *
+ * `'COOKIE'` (upstream's `browserCookiePersistence`, for SSR) is the fourth
+ * member of the union and has no slot of its own here. It maps to `'LOCAL'`:
+ * both are long-lived session storage, and the distinction is invisible to
+ * consumer code once the session is restored either way. The alternative —
+ * widening SessionMode — would add a storage backend the serve layer does not
+ * have.
+ */
+function toSessionMode(type: 'LOCAL' | 'SESSION' | 'NONE' | 'COOKIE'): SessionMode {
+  return type === 'COOKIE' ? 'LOCAL' : type;
+}
+
+/** `setPersistence`: selects which web storage holds THIS TAB's session (and
+ *  migrates the current one). On the worker path the record is still client-
+ *  side (#754 — per-port sessions restore via `auth.restorePortSession`); the
+ *  RPC just keeps the worker's surface-parity mode in sync. */
+export const setPersistence = (
+  useWorker
+    ? (async (
+        auth: Parameters<typeof pyricSetPersistence>[0],
+        persistence: Parameters<typeof pyricSetPersistence>[1],
+      ) => {
+        sessionStoreForApp(auth.app ?? getApp()).setMode(toSessionMode(persistence.type));
+        return (wc.setPersistence as typeof pyricSetPersistence)(auth, persistence);
+      })
+    : async (
+        auth: Parameters<typeof pyricSetPersistence>[0],
+        persistence: Parameters<typeof pyricSetPersistence>[1],
+      ) => {
+        sessionStoreForApp(auth.app ?? getApp()).setMode(toSessionMode(persistence.type));
+        return pyricSetPersistence(auth, persistence);
+      }
+) as typeof pyricSetPersistence;
+
+// ── Provider sign-in (popup/redirect) — the in-page→worker bridge ─────────
+
+/**
+ * Resolve a provider identity through the backend-free ServeAuthHelper, then
+ * hand it to the worker. The
+ * helper seeds `{ sub, ...claims }` into the resolved credential's token, so we
+ * strip `sub` to recover the original custom claims for the worker seed.
+ *
+ * Enforcement lives at the hand-off: `auth.acceptIdentity` gates against the
+ * WORKER's provider config and rejects `auth/operation-not-allowed` for a
+ * disabled provider (matching prod, where the popup opens and the error
+ * surfaces after the interaction).
+ */
+async function bridgeProviderSignIn(
+  auth: Parameters<typeof ipAuth.signInWithPopup>[0],
+  provider: Parameters<typeof ipAuth.signInWithPopup>[1],
+  kind: 'popup' | 'redirect',
+): Promise<unknown> {
+  const providerId = (provider as { providerId?: string }).providerId ?? 'oidc';
+  const cred = await resolveServeAuthFlow(
+    { providerId, authType: 'signIn' },
+    kind,
+  );
+  const tokenResult = await cred.user.getIdTokenResult();
+  const { sub: _sub, ...customClaims } = (tokenResult.claims ?? {}) as Record<string, unknown>;
+  return acceptProviderCredential(auth as never, {
+    uid: cred.user.uid,
+    email: cred.user.email,
+    displayName: cred.user.displayName,
+    customClaims,
+    providerId,
+  });
+}
+
+export const signInWithPopup = (
+  useWorker
+    ? (auth: Parameters<typeof ipAuth.signInWithPopup>[0], provider: Parameters<typeof ipAuth.signInWithPopup>[1]) =>
+        bridgeProviderSignIn(auth, provider, 'popup')
+    : ipAuth.signInWithPopup
+) as typeof ipAuth.signInWithPopup;
+
+/**
+ * `signInWithRedirect` over the worker resolves like popup — the pyric
+ * emulator helper does not actually navigate, so the identity is picked + the
+ * worker signs in immediately. The result is delivered through the sign-in +
+ * `onAuthStateChanged`; `getRedirectResult` returns null on the worker path
+ * (there is no deferred post-navigation result to replay). v1 behavior.
+ */
+export const signInWithRedirect = (
+  useWorker
+    ? (auth: Parameters<typeof ipAuth.signInWithRedirect>[0], provider: Parameters<typeof ipAuth.signInWithRedirect>[1]) =>
+        bridgeProviderSignIn(auth, provider, 'redirect')
+    : ipAuth.signInWithRedirect
+) as typeof ipAuth.signInWithRedirect;
+
+export const getRedirectResult = (
+  useWorker
+    ? async (_auth?: unknown) => null
+    : ipAuth.getRedirectResult
+) as typeof ipAuth.getRedirectResult;
+
+/** Direct credential sign-in: unsupported over the worker in v1 (the
+ *  worker-client rejects with a clear error); in-page passes through. */
+export const signInWithCredential = (
+  useWorker ? wc.signInWithCredential : ipAuth.signInWithCredential
+) as typeof ipAuth.signInWithCredential;
+
+// ── Low-hanging-fruit exports (issue #149) ────────────────────────────────
+
+function unsupportedWorkerAuthApi(name: string): never {
+  throw new Error(
+    `firebase/auth ${name}() is not supported over the pyric SharedWorker yet. ` +
+      'Use the in-page fallback for this operation.',
+  );
+}
+
+/** `initializeAuth(app, deps?)` — aliases the picked `getAuth` (worker- or
+ *  in-page-backed). Path-independent: `deps` is accepted for parity, ignored. */
+export const initializeAuth = ((app?: unknown, _deps?: unknown) =>
+  getAuth(app as never)) as typeof ipAuth.initializeAuth;
+
+/** `useDeviceLanguage(auth)` — accepted no-op (no device locale in the served
+ *  sandbox). Path-independent. */
+export const useDeviceLanguage = ((_auth?: unknown) => {}) as typeof ipAuth.useDeviceLanguage;
+
+// User-mutation ops act on a `User` object. In-page they route through the
+// sandbox User's dispatch hook; over the SharedWorker the client has no
+// client-facing binding for them yet, so worker mode throws the standard
+// "use the in-page fallback" error (mirrors the RTDB entry's unsupported ops).
+export const deleteUser = (
+  useWorker ? (() => unsupportedWorkerAuthApi('deleteUser')) : ipAuth.deleteUser
+) as typeof ipAuth.deleteUser;
+export const updateEmail = (
+  useWorker ? (() => unsupportedWorkerAuthApi('updateEmail')) : ipAuth.updateEmail
+) as typeof ipAuth.updateEmail;
+export const updatePassword = (
+  useWorker ? (() => unsupportedWorkerAuthApi('updatePassword')) : ipAuth.updatePassword
+) as typeof ipAuth.updatePassword;
+export const reload = (
+  useWorker ? (() => unsupportedWorkerAuthApi('reload')) : ipAuth.reload
+) as typeof ipAuth.reload;
+export const updateCurrentUser = (
+  useWorker ? (() => unsupportedWorkerAuthApi('updateCurrentUser')) : ipAuth.updateCurrentUser
+) as typeof ipAuth.updateCurrentUser;

package/src/serve/entries/bridge-url.ts

@@ -0,0 +1,31 @@
+/**
+ * Re-anchor a bridge WebSocket URL to the page's own origin.
+ *
+ * `pyric dev` / the vite plugin bake their OWN host into the bridge URL it
+ * sends the page (e.g. `ws://localhost:5173/__pyric/sandbox`). But the page may
+ * have been loaded over a different host (Tailscale, a LAN IP) or scheme
+ * (`https` via `tailscale serve`, which then requires `wss`). Connecting to the
+ * baked `localhost` from a remote tab dials the WRONG machine (the client's own
+ * localhost), so the WS fails.
+ *
+ * Keep only the PATH from the server's URL and rebuild the scheme + host from the
+ * page's `location`. The bridge is always mounted on the same server that served
+ * the page, so the page's origin is the correct target wherever it is reached,
+ * with no plugin configuration. This also sidesteps the localhost / 127.0.0.1 /
+ * ::1 family ambiguity, because the browser dials the exact host it loaded from.
+ *
+ * Pure (location is injected) so it is unit-testable. Returns `raw` unchanged if
+ * it cannot be parsed.
+ */
+export function toPageOriginWsUrl(
+  raw: string,
+  loc: { href: string; protocol: string; host: string },
+): string {
+  try {
+    const path = new URL(raw, loc.href).pathname;
+    const scheme = loc.protocol === 'https:' ? 'wss:' : 'ws:';
+    return `${scheme}//${loc.host}${path}`;
+  } catch {
+    return raw;
+  }
+}