@pyric/cli 0.1.0-alpha.30.2 → 0.1.0-alpha.31

package/dist/serve/site-ui/_astro/writes.Bg0YEEA7.js

@@ -1 +0,0 @@
-import{c as jt,ba as ve,aP as ne,aC as f,bb as _t,bc as Tt,b8 as le,bd as Pt,be as qt,bf as M,aK as K,bg as Vt,bh as Mt,az as et,bi as Re,ay as Oe,bj as P,bk as ke,bl as j,aQ as tt,bm as ce,bn as It,bo as zt,V as nt,H as w,aB as T,aM as $t,bp as Lt,bq as Qt,br as Wt,Q as Ee,F as I,bs as Fe,D as Ut,E as Nt,b7 as Bt,b9 as Gt,bt as Ht,bu as Yt,O as Jt,ac as Xt,bv as Kt,T as Zt,bw as en,bx as tn}from"./sandbox-controls.Bv6lfpIe.js";const nn=Symbol.for("pyric.remote.sandbox");function Ce(e){return e!=null&&e[nn]===!0}let Z;function ts(e){Z=e}function st(e){return Z?.resolve(e,!1)}function sn(){if(!Z)throw new TypeError("No default sandbox app registry is installed - import and initialize pyric/app before calling a service factory without an app.");return Z.defaultApp()}function Me(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0}function rn(e,t,n,s){const r={collectionGroup:e.split("/").filter(Boolean).at(-1)??"",queryScope:t?"COLLECTION_GROUP":"COLLECTION",filters:[],orders:[]},i=(o,a)=>{const c=Me(o);if(!c||a>12||r.filters.length>=64){r.unsupported="This query exceeds the index checker’s supported limits.";return}if(c.kind==="and"&&Array.isArray(c.filters)){c.filters.forEach(u=>i(u,a+1));return}if(c.kind!=="where"||typeof c.field!="string"||typeof c.op!="string"){r.unsupported="This query uses a filter the index checker does not support yet.";return}r.filters.push({field:c.field,op:c.op})};n.forEach(o=>i(o,0));for(const o of s.slice(0,64)){const a=Me(o);if(!a||typeof a.field!="string"||a.direction!=="asc"&&a.direction!=="desc"){r.unsupported="This sort order cannot be checked yet.";continue}r.orders.push({field:a.field,direction:a.direction})}return s.length>64&&(r.unsupported="This query exceeds the index checker’s supported limits."),r}async function se(e,t,n){try{const s=await t();return e.complete(n?.()),s}catch(s){throw e.fail(),s}}const Ie=new Set;function on(e){return Ie.add(e),()=>{Ie.delete(e)}}function ns(e={}){return jt()}function z(e){return e.replace(/^\/+|\/+$/g,"").split("/")}function rt(e){return z(e).length%2===0&&z(e).length>0}function Ae(e){return z(e).length%2===1}function re(e){const t=z(e);return t[t.length-1]??""}function it(e){return z(e).slice(0,-1).join("/")}function ot(e,t){const n=t!==void 0,s=n?ve(t):void 0;return{id:e.id,ref:e,exists:n,data:()=>n?s:void 0,get:r=>ne(s,r)}}const ze=200,B=10,an=4;function cn(e){return e.length<=ze?{type:"string",value:e}:{type:"string",value:e.slice(0,ze),truncated:!0}}function at(e,t){const n=e*1e3+Math.floor(t/1e6);if(!Number.isFinite(n))return{type:"opaque"};try{return{type:"timestamp",iso:new Date(n).toISOString()}}catch{return{type:"opaque"}}}function un(e){if(typeof e!="object"||e===null)return{type:"opaque"};const t=e;return typeof t.path=="string"?{type:"reference",path:t.path}:t.type==="timestamp"&&typeof t.seconds=="number"&&typeof t.nanoseconds=="number"?at(t.seconds,t.nanoseconds):t.type==="geo-point"&&typeof t.latitude=="number"&&typeof t.longitude=="number"?{type:"geoPoint",latitude:t.latitude,longitude:t.longitude}:t.type==="bytes"&&Array.isArray(t.values)?{type:"bytes",length:t.values.length}:t.type==="vector"&&Array.isArray(t.values)?{type:"vector",length:t.values.length}:{type:"opaque"}}function he(e,t){if(e===null)return{type:"null"};if(typeof e=="string")return cn(e);if(typeof e=="number")return{type:"number",value:e};if(typeof e=="boolean")return{type:"boolean",value:e};if(typeof e!="object")return{type:"opaque"};if(t>=an)return{type:"opaque"};const n=e;if(n.type==="registered-firestore-value")return un(n.value);if(n.type==="timestamp"&&typeof n.seconds=="number"&&typeof n.nanoseconds=="number")return at(n.seconds,n.nanoseconds);if(n.type==="bytes"&&Array.isArray(n.values))return{type:"bytes",length:n.values.length};if(n.type==="array"&&Array.isArray(n.values)){const s=n.values.slice(0,B).map(r=>he(r,t+1));return n.values.length>B?{type:"array",values:s,truncated:!0}:{type:"array",values:s}}if(n.type==="map"&&Array.isArray(n.entries)){const s=n.entries.slice(0,B).filter(r=>Array.isArray(r)&&typeof r[0]=="string").map(([r,i])=>[r,he(i,t+1)]);return n.entries.length>B?{type:"map",entries:s,truncated:!0}:{type:"map",entries:s}}return{type:"opaque"}}function $e(e){return he(e,0)}function fe(e){if(e===null||typeof e!="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(n=>fe(n)).join(",")}]`;const t=e;return`{${Object.keys(t).sort().map(n=>`${JSON.stringify(n)}:${fe(t[n])}`).join(",")}}`}function dn(e){if(e!==null&&typeof e=="object"){const n="type"in e&&e.type==="timestamp",s="seconds"in e&&typeof e.seconds=="number",r="nanoseconds"in e&&typeof e.nanoseconds=="number";return n&&s&&r}return!1}function E(e){return new f({code:"invalid-argument",message:e})}function pe(e,t,n,s=!1,r=!1){if(e===null||typeof e=="string"||typeof e=="boolean")return{comparison:e,execution:e};if(typeof e=="number")return{comparison:e,execution:e};if(typeof e>"u"||typeof e=="bigint"||typeof e=="function"||typeof e=="symbol")throw E(`Unsupported Firestore query value: ${typeof e}.`);if(typeof e!="object")throw E("Unsupported Firestore query value.");const u=_t(e);if(u!==void 0){const m=Tt(e);if(m!==void 0&&n!==void 0&&m!==n)throw E("Document reference belongs to a different Firestore database.");if(dn(u)){const p=Math.floor(u.nanoseconds/1e3)*1e3,g=new le(u.seconds,p);return{comparison:{type:"registered-firestore-value",value:Object.freeze({type:"timestamp",seconds:g.seconds,nanoseconds:p})},execution:g}}return{comparison:{type:"registered-firestore-value",value:u},execution:Pt(e)}}if(e instanceof Date){const m=e.getTime();if(!Number.isFinite(m))throw E("Invalid Date query value.");const S=Math.floor(m/1e3),p=Object.freeze({seconds:S,nanoseconds:Math.floor((m-S*1e3)*1e6)}),g={type:"timestamp",...p};return qt(p,g,()=>Object.freeze({...p})),{comparison:{type:"registered-firestore-value",value:g},execution:p}}if(e instanceof Uint8Array){const m=e.slice();return{comparison:{type:"bytes",values:Array.from(m)},execution:m}}if(t.has(e))throw E("Cyclic query operands are not Firestore values.");const b=Object.getPrototypeOf(e);if(b!==Object.prototype&&b!==null&&!Array.isArray(e))throw E("Firestore query maps must be plain objects.");t.add(e);try{if(Array.isArray(e)){if(r&&!s)throw E("Nested arrays are not supported.");const g=e.map(q=>pe(q,t,n,s,!0)),N=g.map(q=>q.execution);return M(N,K(e)),{comparison:{type:"array",values:g.map(q=>q.comparison)},execution:N}}const O=Object.keys(e).sort().map(p=>({key:p,captured:pe(e[p],t,n,s,!1)})),S=Object.fromEntries(O.map(({key:p,captured:g})=>[p,g.execution]));return M(S,K(e)),{comparison:{type:"map",entries:O.map(({key:p,captured:g})=>[p,g.comparison])},execution:S}}finally{t.delete(e)}}function ct(e,t,n=!1){try{const s=pe(e,new Set,t,n);return Object.freeze({kind:"canonical",value:s.comparison,executionValue:s.execution})}catch(s){if(s instanceof f)throw s;const r=s instanceof Error?s.message:String(s);throw E(`Invalid Firestore query value: ${r}`)}}function ut(e,t){return Vt(e.value,t.value)}const ln=["<","<=","==","!=",">=",">","in","not-in","array-contains","array-contains-any"],hn=new Set(ln);function fn(e,t){if(!hn.has(e))throw new f({code:"invalid-argument",message:"Unsupported Firestore filter operator."});if((e==="in"||e==="not-in"||e==="array-contains-any")&&!Array.isArray(t))throw new f({code:"invalid-argument",message:`Firestore ${e} filter requires an array operand.`})}function H(e,t){if(e.kind==="where"){fn(e.op,e.value);const s="comparisonValue"in e,r=e.op==="in"||e.op==="not-in",i=s?e.comparisonValue:ct(e.value,t,r);return Object.freeze({kind:"where",field:e.field,op:e.op,value:i.executionValue,comparisonValue:i})}return Object.freeze({kind:e.kind,filters:Object.freeze(e.filters.map(s=>H(s,t)))})}function G(e,t,n,s){const r=e.map(i=>ct(i,s));return Object.freeze({values:Object.freeze(r.map(i=>i.executionValue)),comparisonValues:Object.freeze(r),inclusive:t,fromSnapshot:n})}function dt(e,t){return e.length!==t.length?!1:e.every((n,s)=>{const r=t[s];return n.kind!==r.kind?!1:n.kind==="where"&&r.kind==="where"?n.field===r.field&&n.op===r.op&&ut(n.comparisonValue,r.comparisonValue):n.kind!=="where"&&r.kind!=="where"&&dt(n.filters,r.filters)})}function Le(e,t){return e===void 0||t===void 0?e===t:e.inclusive===t.inclusive&&e.comparisonValues.length===t.comparisonValues.length&&e.comparisonValues.every((n,s)=>ut(n,t.comparisonValues[s]))}function pn(e,t){return e.kind!==t.kind?!1:e.kind==="collection"&&t.kind==="collection"?e.path===t.path:e.kind==="collection-group"&&t.kind==="collection-group"&&e.collectionId===t.collectionId}function lt(e){return e.kind==="where"?Object.freeze({kind:e.kind,field:e.field,op:e.op,value:e.value}):Object.freeze({kind:e.kind,filters:Object.freeze(e.filters.map(lt))})}function Qe(e){if(e!==void 0)return Object.freeze({values:e.values,inclusive:e.inclusive,fromSnapshot:e.fromSnapshot})}function mn(e,t){return dt(e.filters,t.filters)&&e.orders.length===t.orders.length&&e.orders.every((n,s)=>{const r=t.orders[s];return n.field===r.field&&n.direction===r.direction})&&e.limitCount===t.limitCount&&e.limitFromEnd===t.limitFromEnd&&Le(e.start,t.start)&&Le(e.end,t.end)}const ht="__name__";function We(e,t){const n=e.data();if(n===void 0)throw new f({code:"not-found",message:`Snapshot-based cursors require an existing document — got an empty snapshot for ${e.id??"<unknown>"}.`});return t.map(s=>s.field===ht?e.ref:n[s.field])}class ${env;auth;collectionPath;clauses;orders;limitCount;limitFromEnd;start;end;bypassRules;documentRef;constructor(t){this.env=t.env,this.auth=t.auth,this.collectionPath=t.collectionPath,this.documentRef=t.documentRef,this.clauses=Object.freeze((t.clauses??[]).map(n=>H(n))),this.orders=Object.freeze((t.orders??[]).map(n=>Object.freeze({...n}))),this.limitCount=t.limitCount,this.limitFromEnd=t.limitFromEnd??!1,this.start=t.start===void 0?void 0:Object.freeze({...t.start,values:Object.freeze(t.start.comparisonValues.map(n=>n.executionValue)),comparisonValues:t.start.comparisonValues}),this.end=t.end===void 0?void 0:Object.freeze({...t.end,values:Object.freeze(t.end.comparisonValues.map(n=>n.executionValue)),comparisonValues:t.end.comparisonValues}),this.bypassRules=t.bypassRules??!1}where(t,n,s){return this.clone({clauses:[...this.clauses,H({kind:"where",field:t,op:n,value:s})]})}applyFilter(t){return this.clone({clauses:[...this.clauses,H(t)]})}orderBy(t,n="asc"){if(n!=="asc"&&n!=="desc")throw new f({code:"invalid-argument",message:"orderBy() direction must be 'asc' or 'desc'."});return this.clone({orders:[...this.orders,{field:t,direction:n}]})}limit(t){return Ue(t),this.clone({limitCount:t,limitFromEnd:!1})}limitToLast(t){return Ue(t),this.clone({limitCount:t,limitFromEnd:!0})}startCursor(t,n){return this.clone({start:G(this.normalizeExplicitCursorValues(t),n,!1)})}endCursor(t,n){return this.clone({end:G(this.normalizeExplicitCursorValues(t),n,!1)})}startCursorFromSnapshot(t,n){return this.clone({start:G(We(t,this.normalizedOrders()),n,!0)})}endCursorFromSnapshot(t,n){return this.clone({end:G(We(t,this.normalizedOrders()),n,!0)})}isStructurallyEqual(t){return t instanceof $?this.env===t.env&&this.bypassRules===t.bypassRules&&pn(this.queryScope(),t.queryScope())&&mn(this.comparableExecutionSpec(),t.comparableExecutionSpec()):!1}clone(t){return new $({env:this.env,auth:this.auth,collectionPath:this.collectionPath,documentRef:this.documentRef,clauses:t.clauses??this.clauses,orders:t.orders??this.orders,limitCount:"limitCount"in t?t.limitCount:this.limitCount,limitFromEnd:t.limitFromEnd??this.limitFromEnd,start:"start"in t?t.start:this.start,end:"end"in t?t.end:this.end,bypassRules:this.bypassRules})}queryScope(){return{kind:"collection",path:this.collectionPath}}sdkActivitySource(){const t=this.queryScope();return{service:"firestore",target:t.kind==="collection"?t.path:t.collectionId,key:fe({scope:t,query:this.activityQuery()}),isQuery:!0,indexQuery:rn(t.kind==="collection"?t.path:t.collectionId,t.kind==="collection-group",this.clauses,this.orders)}}readQueryRows(t){const n=t?.auth!==void 0?t.auth:this.auth;let s;try{s=this.env.runQuery({scope:this.queryScope(),auth:n,execution:this.executionSpec(),bypassRules:this.bypassRules,activityQuery:this.activityQuery()})}catch(r){const i=r?.simError;throw i?new f(i):r}if(!s.allowed)throw new f(s.error);return s.docs}activityQuery(){const t=s=>s.kind==="where"?{kind:"where",field:s.field,op:s.op,value:K(s.value),display:$e(s.comparisonValue.value)}:{kind:s.kind,filters:s.filters.map(t)},n=s=>s===void 0?null:{values:s.values.map(r=>K(r)),display:s.comparisonValues.map(r=>$e(r.value)),inclusive:s.inclusive,fromSnapshot:s.fromSnapshot};return{scope:this.activityScope(),filters:this.clauses.map(t),orderBy:this.orders.map(s=>({...s})),limit:this.limitCount??null,limitFromEnd:this.limitFromEnd,start:n(this.start),end:n(this.end)}}activityScope(){return{kind:"collection"}}normalizedOrders(){return Mt(this.executionSpec())}normalizeExplicitCursorValues(t){const n=this.orders;return t.map((s,r)=>{if(n[r]?.field!==ht)return s;if(typeof s!="string")throw new f({code:"invalid-argument",message:"Expected a string for a document ID cursor value."});const i=s.includes("/")?s:`${this.collectionPath}/${s}`;return this.documentRef(i)})}executionSpec(){const t={filters:Object.freeze(this.clauses.map(lt)),orders:this.orders,limitCount:this.limitCount,limitFromEnd:this.limitFromEnd,start:Qe(this.start),end:Qe(this.end)};return Object.freeze(t)}comparableExecutionSpec(){return{filters:this.clauses,orders:this.orders,limitCount:this.limitCount,limitFromEnd:this.limitFromEnd,start:this.start,end:this.end}}snapshotScope(){return this.queryScope()}snapshotConstraints(){return Object.freeze({execution:this.executionSpec(),activityQuery:this.activityQuery()})}async get(t){const s=this.readQueryRows(t).map(r=>{const i=this.documentRef(r.path),o=ve(r.data);return{id:i.id,ref:i,exists:!0,data:()=>o,get:a=>ne(o,a)}});return{size:s.length,empty:s.length===0,docs:s,forEach:et(s)}}async aggregate(t,n){const s=this.readQueryRows(n),r={};for(const i of Object.keys(t))r[i]=bn(t[i],s);return{data:()=>r}}}function yn(e,t){if(!t.includes("."))return e[t];let n=e;for(const s of t.split(".")){if(typeof n!="object"||n===null||Array.isArray(n))return;n=n[s]}return n}function bn(e,t){if(e.kind==="count")return t.length;let n=0,s=0;for(const r of t){const i=yn(r.data,e.field);typeof i=="number"&&Number.isFinite(i)&&(n+=i,s++)}return e.kind==="sum"?n:s===0?null:n/s}function Ue(e){if(!Number.isFinite(e))throw new f({code:"invalid-argument",message:"Query limit must be a finite number."})}function D(e,t){if(e.error)throw new f(e.error);const n=e.debugMessages.length>0?e.debugMessages.join("; "):"(no debug message)";throw new f(j("permission-denied",`${t}: ${n}`))}class gn{env;auth;bypassRules;collectionRef;id;path;constructor(t,n,s,r=!1,i){this.env=t,this.auth=n,this.bypassRules=r,this.collectionRef=i,this.path=s,this.id=re(s),M(this,Re("reference",s)),Oe(this,s,t)}get parent(){return this.collectionRef(it(this.path))}collection(t){return this.collectionRef(`${this.path}/${t}`)}async get(t){const n=this.env.execute({method:"get",path:this.path,auth:t?.auth!==void 0?t.auth:this.auth,bypassRules:this.bypassRules});n.allowed||D(n,"get denied");const s=n.data===void 0||n.data===null?void 0:n.data;return ot(this,s)}async create(t,n){const s=this.env.execute({method:"create",path:this.path,data:t,auth:n?.auth!==void 0?n.auth:this.auth,bypassRules:this.bypassRules});s.allowed||D(s,"create denied")}async set(t,n){const s=n?.auth!==void 0?n.auth:this.auth;if(n?.mergeFields!==void 0){const i=n.mergeFields.map(u=>String(u)),a=this.env.getDocument(this.path)===null?"create":"update",c=this.env.execute({method:a,path:this.path,data:t,auth:s,merge:{mergeFields:i},bypassRules:this.bypassRules});c.allowed||D(c,`set denied (as ${a})`);return}if(n?.merge===!0){const o=this.env.getDocument(this.path)===null?"create":"update",a=this.env.execute({method:o,path:this.path,data:t,auth:s,merge:!0,bypassRules:this.bypassRules});a.allowed||D(a,`set denied (as ${o})`);return}const r=this.env.execute({method:"set",path:this.path,data:t,auth:s,bypassRules:this.bypassRules});r.allowed||D(r,"set denied")}update(t,...n){const{fields:s,options:r}=P(t,n);return this.commitUpdate(s,r)}async commitUpdate(t,n){const s=this.env.execute({method:"update",path:this.path,data:ke(t),auth:n?.auth!==void 0?n.auth:this.auth,bypassRules:this.bypassRules});s.allowed||D(s,"update denied")}async delete(t){const n=this.env.execute({method:"delete",path:this.path,auth:t?.auth!==void 0?t.auth:this.auth,bypassRules:this.bypassRules});n.allowed||D(n,"delete denied")}}function V(e,t,n,s){return new gn(e,t,n,s,r=>new ft(e,t,r,s))}class ft extends ${id;path;constructor(t,n,s,r=!1){super({env:t,auth:n,collectionPath:s,bypassRules:r,documentRef:i=>V(t,n,i,r)}),this.path=s,this.id=re(s)}doc(t){const n=t??tt();return V(this.env,this.auth,`${this.path}/${n}`,this.bypassRules)}async add(t,n){const s=n?.auth!==void 0?n.auth:this.auth,{path:r,result:i}=this.env.createWithAutoId(this.path,t,s,this.bypassRules);if(!i.allowed){if(i.error)throw new f(i.error);let o="(no debug message)";throw i.debugMessages.length>0&&(o=i.debugMessages.join("; ")),new f(j("permission-denied",`set denied: ${o}`))}return V(this.env,this.auth,r,this.bypassRules)}}class De extends ${collectionId;constructor(t){super({...t,collectionPath:"",documentRef:n=>V(t.env,t.auth,n,t.bypassRules??!1)}),this.collectionId=t.collectionId}clone(t){return new De({env:this.env,auth:this.auth,collectionId:this.collectionId,clauses:t.clauses??this.clauses,orders:t.orders??this.orders,limitCount:"limitCount"in t?t.limitCount:this.limitCount,limitFromEnd:t.limitFromEnd??this.limitFromEnd,start:"start"in t?t.start:this.start,end:"end"in t?t.end:this.end,bypassRules:this.bypassRules})}queryScope(){return{kind:"collection-group",collectionId:this.collectionId}}activityScope(){return{kind:"collection-group"}}}class wn{env;auth;bypassRules;ops=[];constructor(t,n,s=!1){this.env=t,this.auth=n,this.bypassRules=s}create(t,n){return this.ops.push({method:"create",path:t.path,data:ce(n)}),this}set(t,n,s){const r={method:"set",path:t.path,data:ce(n)},i=s?.mergeFields;return i!==void 0?r.merge={mergeFields:[...i]}:s?.merge===!0&&(r.merge=!0),this.ops.push(r),this}update(t,n,...s){const{fields:r}=P(n,s);return this.ops.push({method:"update",path:t.path,data:ce(ke(r))}),this}delete(t){return this.ops.push({method:"delete",path:t.path}),this}async commit(t){if(this.ops.length===0)return;const s=t?.auth,r=s!==void 0,i=this.env.batch(this.ops,r?s:this.auth,this.bypassRules),{allowed:o,error:a}=i;if(o)return;if(a!==void 0)throw new f(a);const y=i.results.find(d=>!d.allowed)?.debugMessages.join("; ")??"batch denied";throw new f(j("permission-denied",`batch failed: ${y}`))}}function xn(e){return typeof e.where=="function"}class Sn{simTx;constructor(t){this.simTx=t}async get(t){if(xn(t)){const i=await t.get();return i.size>0&&this.simTx.getAll(...i.docs.map(a=>a.ref.path)),i}const r=this.simTx.get(t.path).data();return ot(t,r)}create(t,n){return this.simTx.create(t.path,n),this}set(t,n,s){const r=s?.mergeFields;if(r!==void 0)return this.simTx.set(t.path,n,{mergeFields:r}),this;const o=s?.merge===!0;return this.simTx.set(t.path,n,o?!0:void 0),this}update(t,n,...s){const{fields:r}=P(n,s);return this.simTx.update(t.path,ke(r)),this}delete(t){return this.simTx.delete(t.path),this}}class vn{env;auth;bypassRules;provenance;constructor(t,n,s=!1,r){this.env=t,this.auth=n,this.bypassRules=s,this.provenance=r}collection(t){if(!Ae(t))throw new f(j("invalid-argument",`collection path must have an odd number of segments: ${t}`));return new ft(this.env,this.auth,t,this.bypassRules)}doc(t){if(!rt(t))throw new f(j("invalid-argument",`document path must have an even number of segments: ${t}`));return V(this.env,this.auth,t,this.bypassRules)}collectionGroup(t){if(t.length===0||t.includes("/"))throw new f(j("invalid-argument",`collection group id must be a single non-empty segment with no '/': ${t}`));return new De({env:this.env,auth:this.auth,collectionId:t,bypassRules:this.bypassRules})}batch(){return new wn(this.env,this.auth,this.bypassRules)}async runTransaction(t,n){let s;try{s=await this.env.transaction(r=>{const i=new Sn(r);return t(i)},{auth:n?.auth!==void 0?n.auth:this.auth,bypassRules:this.bypassRules,provenance:this.provenance,maxAttempts:n?.maxAttempts})}catch(r){throw r instanceof It?new f(r.simError):r instanceof zt?new f(r.simError):r}if(!s.allowed){if(s.error)throw new f(s.error);const i=s.writes.find(o=>!o.allowed)?.debugMessages.join("; ")??"transaction denied at commit";throw new f(j("permission-denied",`transaction failed: ${i}`))}return s.returnValue}}function Rn(e,t){return new vn(e,t?.auth??null,t?.bypassRules??!1,t?.provenance)}const On=Symbol("pyric/sandbox/context"),kn=Symbol("pyric/sandbox/bypassRules");let me=null;function ss(e){me=e}const En=Symbol.for("pyric.firestore.modular-value");function Ne(e){return En in e}function Fn(e){const t=e;return typeof t.path=="string"&&t.path.length>0||typeof t.collectionPath=="string"&&t.collectionPath.length>0||typeof t.snapshotScope=="function"}function Cn(e){const t=e.trim();if(!t)return[];const n=t.indexOf(": ");if(n!==-1){const r=t.slice(n+2).trim().split("; ").map(i=>i.trim()).filter(i=>i.length>0);if(r.length>0)return r}return[t]}function Be(e,t){if(e instanceof f===!1)return e;const s=e.code;if(s==="permission-denied"===!1)return new w(s,e.message);const i={engine:"firestore",auth:t.auth,reasons:Cn(e.message)},o=e.simError;if(o!==void 0){if(o.queryProof!==void 0&&(i.queryProof=o.queryProof),o.request!==void 0){const l=o.request;i.request={method:l.method,path:l.path},l.resourceData!==void 0&&(i.request.resourceData=l.resourceData),l.updateMask!==void 0&&(i.request.updateMask=l.updateMask)}if(o.resource!==void 0&&(i.resource={data:o.resource.data,exists:o.resource.exists}),o.query!==void 0&&(i.query=o.query),o.rule!==void 0&&(i.rule=o.rule),o.repro!==void 0&&(i.repro=o.repro),o.remediation!==void 0)return new w({code:s,message:e.message,denialContext:i,remediation:o.remediation})}return new w(s,e.message,i)}function ee(e,t,n=!1){return new Proxy(e,{get(s,r,i){if(r===On)return t;if(r===kn)return n;if(r==="onSnapshot"&&me!==null&&!(r in s)&&Fn(s))return(...a)=>me(i,...a);const o=Reflect.get(s,r,i);return typeof o!="function"?o:function(...a){let c;try{const u=()=>o.apply(s,a);c=typeof t.sandbox.runWithProvenance=="function"?t.sandbox.runWithProvenance(nt(t.operationContext),u):u()}catch(u){throw Be(u,t)}return c instanceof Promise?c.then(u=>u&&typeof u=="object"&&!Ne(u)?ee(u,t,n):u).catch(u=>{throw Be(u,t)}):c&&typeof c=="object"&&!Ne(c)?ee(c,t,n):c}}})}function pt(e,t=!1){if(Ce(e.sandbox))throw new Error("pyric/sandbox/admin-firestore: internal — a remote sandbox context reached the local engine builder; remote dispatch should have handled it. Please report this.");const n=()=>Rn(T(e.sandbox),{auth:e.auth,bypassRules:t,provenance:nt(e.operationContext)});return{collection(s){return n().collection(s)},doc(s){return n().doc(s)},collectionGroup(s){return n().collectionGroup(s)},batch(){return n().batch()},runTransaction(s,r){return n().runTransaction(s,r)},setRules(s){return T(e.sandbox).deployRules(s)},seed(s){const r=T(e.sandbox);return r.seed({rules:r.getRules(),documents:s?.documents??{}})},snapshot(){return T(e.sandbox).snapshot()}}}function ye(e){if(e instanceof w)return e;if(e!==null&&typeof e=="object"){const t=e;if(typeof t.code=="string"&&typeof t.message=="string"){const n=t.denialContext!==null&&typeof t.denialContext=="object"?t.denialContext:void 0;return new w(t.code,t.message,n)}}return e}function k(e){return new w("invalid-argument",e)}async function x(e,t){try{return await e.sandbox.channel.op({...t,actAs:e.lens})}catch(n){throw ye(n)}}const An=new Set(["serverTimestamp","increment","arrayUnion","arrayRemove","deleteField"]);function Dn(e){return e!==null&&typeof e=="object"&&typeof e.__type=="string"&&An.has(e.__type)}function jn(e){switch(e.__type){case"serverTimestamp":return{__sentinel:"serverTimestamp"};case"increment":return{__sentinel:"increment",n:e.value};case"arrayUnion":return{__sentinel:"arrayUnion",values:e.values.map(v)};case"arrayRemove":return{__sentinel:"arrayRemove",values:e.values.map(v)};case"deleteField":return{__sentinel:"deleteField"}}}function v(e){if(e===null||typeof e!="object")return e;if(Dn(e))return jn(e);if(e instanceof le)return e.toJSON();if(e instanceof Date)return le.fromDate(e).toJSON();if(Array.isArray(e))return e.map(v);const t=Object.getPrototypeOf(e);if(t!==Object.prototype&&t!==null){const s=e.toJSON;if(typeof s=="function")return s.call(e);throw k(`remote Firestore: cannot serialize a ${t.constructor?.name??"class"} instance for the wire — use plain data, Timestamp, Date, or FieldValue sentinels.`)}const n={};for(const[s,r]of Object.entries(e))n[s]=v(r);return n}function _(e){return v(e)}function je(e){return e.map(t=>({path:[...t.path],value:v(t.value)}))}function be(e){return $t(JSON.parse(e.json),e.valueEncoding)}function mt(e){return ve(be(e))}function yt(e,t){const n=t.exists&&t.data?mt(t.data):void 0;return{id:e.id,ref:e,exists:t.exists,data:()=>n,get:s=>ne(n,s)}}function bt(e,t){const n=t.docs.map(s=>{const r=s.path??s.id,i=te(e,r),o=s.data?mt(s.data):{};return{id:i.id,ref:i,exists:!0,data:()=>o,get:a=>ne(o,a)}});return{size:n.length,empty:n.length===0,docs:n,forEach:et(n)}}const _e=Symbol("pyric/sandbox/admin-firestore/remoteSnapshotRegistrar");function rs(e){if(e===null||typeof e!="object")return;const t=e[_e];return typeof t=="function"?t:void 0}let ge=null;function is(e){ge=e}function gt(...e){if(ge===null)throw new w("failed-precondition","remote Firestore: onSnapshot is not wired yet — import pyric-admin/firestore (or pyric/sandbox/admin-firestore) before subscribing.");return ge(this,...e)}function wt(e,t,n,s,r){const i=n.includeMetadataChanges!==!0;let o;function a(u){const y=ye(u);r!==void 0?r(y):console.error("pyric remote Firestore: uncaught onSnapshot error:",y)}let c;try{c=e.sandbox.channel.subscribe({target:t,actAs:e.lens},u=>{if(s===void 0)return;let d;try{const l=u,b=l.docs;if(Array.isArray(b)){const m=b.map(O=>{const S=O.data,p=S!==void 0;return{path:O.path??O.id,data:p?be(S):{}}});d=Lt({path:xt(t)},m,{excludesMetadataChanges:i},o),o=m}else{const m=l.id;if(typeof m=="string"){const S=l.path??m,p=l.data,N=l.exists===!0&&p!==void 0?be(p):null;d=Qt(S,N)}}}catch(l){c(),a(l);return}d!==void 0&&s(d)},a)}catch(u){throw ye(u)}return c}function xt(e){switch(e.__ref){case"query":return xt(e.source);case"group":return e.collectionId;default:return e.path}}const St=Symbol("pyric/sandbox/admin-firestore/remoteQueryState");function _n(e){if(!(e===null||typeof e!="object"))return e[St]}function vt(e){return e.kind==="where"?(Rt(e.op),{kind:"where",field:e.field,op:e.op,value:v(e.value)}):{kind:e.kind,filters:e.filters.map(vt)}}const Tn=new Set(["<","<=","==","!=",">=",">","in","not-in","array-contains","array-contains-any"]);function Rt(e){if(!Tn.has(e))throw k(`invalid where operator: ${String(e)}`)}function Y(e){const t=[...e.filters];for(const n of e.orders)t.push({kind:"orderBy",field:n.field,direction:n.direction});return e.start&&t.push({kind:e.start.inclusive?"startAt":"startAfter",values:e.start.values.map(v)}),e.end&&t.push({kind:e.end.inclusive?"endAt":"endBefore",values:e.end.values.map(v)}),e.limitCount!==void 0&&t.push(e.limitFromEnd?{kind:"limitToLast",n:e.limitCount}:{kind:"limit",n:e.limitCount}),t.length===0?e.source:{__ref:"query",source:e.source,constraints:t}}function Ge(e,t,n){if(t.length===0)throw k(`${n}(snapshot) on a remote sandbox requires at least one explicit orderBy() clause — the relay protocol has no document-key cursor.`);if(t.some(r=>r.field==="__name__"))throw k(`${n}(snapshot) on a remote sandbox does not support orderBy('__name__') — the relay protocol has no document-key cursor, and __name__ is not a data field a value cursor can carry. Order by a real document field instead.`);const s=e.data();if(s===void 0)throw new w("not-found",`Snapshot-based cursors require an existing document — got an empty snapshot for ${e.id??"<unknown>"}.`);return t.map(r=>s[r.field])}function Te(e,t){const n=r=>Te(e,{...t,...r});return{[St]:t,where(r,i,o){return Rt(i),n({filters:[...t.filters,{kind:"where",field:r,op:i,value:v(o)}]})},applyFilter(r){return n({filters:[...t.filters,vt(r)]})},orderBy(r,i="asc"){return n({orders:[...t.orders,{field:r,direction:i}]})},limit(r){return n({limitCount:r,limitFromEnd:!1})},limitToLast(r){return n({limitCount:r,limitFromEnd:!0})},startCursor(r,i){return n({start:{values:[...r],inclusive:i}})},endCursor(r,i){return n({end:{values:[...r],inclusive:i}})},startCursorFromSnapshot(r,i){return n({start:{values:Ge(r,t.orders,i?"startAt":"startAfter"),inclusive:i}})},endCursorFromSnapshot(r,i){return n({end:{values:Ge(r,t.orders,i?"endAt":"endBefore"),inclusive:i}})},async get(r){J(t);const i=await x(e,{method:"getDocs",source:Y(t)});return bt(e,i)},async aggregate(r){J(t);const i=await x(e,{method:"aggregate",source:Y(t),spec:r});return{data:()=>i.data}},[_e]:(r,i,o)=>(J(t),wt(e,Y(t),r,i,o)),onSnapshot:gt}}function J(e){if(e.limitFromEnd&&e.orders.length===0)throw k("limitToLast() queries require at least one orderBy clause.")}function we(e,t){const n=Te(e,{source:{__ref:"collection",path:t},filters:[],orders:[],limitFromEnd:!1});return Object.assign(Object.create(Object.getPrototypeOf(n)),n,{id:re(t),path:t,doc(r){const i=r??tt();return te(e,`${t}/${i}`)},async add(r,i){const o=await x(e,{method:"addDoc",collectionPath:t,data:_(r)});return te(e,o.path)}})}function te(e,t){const n={id:re(t),path:t,get parent(){return we(e,it(t))},collection(s){const r=`${t}/${s}`;if(!Ae(r))throw k(`collection path must have an odd number of segments: ${r}`);return we(e,r)},async get(s){const r=await x(e,{method:"getDoc",path:t});return yt(n,r)},async create(s,r){await x(e,{method:"batchCommit",writes:[{method:"create",path:t,data:_(s)}]})},async set(s,r){await x(e,{method:"setDoc",path:t,data:_(s),...He(r)?{options:He(r)}:{}})},update(s,...r){const{fields:i}=P(s,r),o=je(i);return x(e,{method:"updateDoc",path:t,fields:o}).then(()=>{})},async delete(s){await x(e,{method:"deleteDoc",path:t})},[_e]:(s,r,i)=>wt(e,{__ref:"doc",path:t},s,r,i),onSnapshot:gt};return n}function He(e){if(!e)return;const t={};return e.merge!==void 0&&(t.merge=e.merge),e.mergeFields!==void 0&&(t.mergeFields=[...e.mergeFields]),t.merge!==void 0||t.mergeFields!==void 0?t:void 0}function Ot(e){if(e===void 0)return;const t={};return"merge"in e&&e.merge!==void 0&&(t.merge=e.merge),"mergeFields"in e&&e.mergeFields!==void 0&&(t.mergeFields=e.mergeFields.map(n=>String(n))),t}function Pn(e){const t=[];let n=!1;const s={create(i,o){return r(),t.push({method:"create",path:i.path,data:_(o)}),s},set(i,o,a){r();const c={method:"set",path:i.path,data:_(o)},u=Ot(a);return u!==void 0&&(c.options=u),t.push(c),s},update(i,o,...a){r();const{fields:c}=P(o,a);return t.push({method:"update",path:i.path,fields:je(c)}),s},delete(i){return r(),t.push({method:"delete",path:i.path}),s},async commit(i){r(),n=!0,await x(e,{method:"batchCommit",writes:t})}};function r(){if(n)throw new w("failed-precondition","WriteBatch has already been committed.")}return s}const qn=5;async function Vn(e,t,n=qn){for(let s=0;s<n;s++){const r=[],i=[],o=()=>{if(i.length>0)throw new w("failed-precondition",Wt)},a={get(d){o();const h=_n(d);return h!==void 0?u(h):c(d)},create(d,h){return i.push({method:"create",path:d.path,data:_(h)}),a},set(d,h,l){const b={method:"set",path:d.path,data:_(h)},A=Ot(l);return A!==void 0&&(b.options=A),i.push(b),a},update(d,h,...l){const{fields:b}=P(h,l);return i.push({method:"update",path:d.path,fields:je(b)}),a},delete(d){return i.push({method:"delete",path:d.path}),a}};async function c(d){const h=await x(e,{method:"getDoc",path:d.path});return r.push({path:h.path??d.path,data:h.exists&&h.data?h.data:null}),yt(d,h)}async function u(d){J(d);const h=await x(e,{method:"getDocs",source:Y(d)});for(const l of h.docs)r.push({path:l.path??l.id,data:l.data??null});return bt(e,h)}const y=await t(a);try{return await x(e,{method:"txnCommit",reads:r,writes:i}),y}catch(d){if(d instanceof w&&d.code==="aborted")continue;throw d}}throw new w("aborted",`Transaction failed after ${n} attempts due to repeated conflicts. Another writer is concurrently updating the same documents.`)}function ue(e,t){return new w("unimplemented",`SandboxFirestore.${e} is not available on a remote sandbox — its return value is synchronous and the data lives in the browser worker. ${t}`)}function kt(e,t){const n={sandbox:e,lens:t};return{collection(s){if(!Ae(s))throw k(`collection path must have an odd number of segments: ${s}`);return we(n,s)},doc(s){if(!rt(s))throw k(`document path must have an even number of segments: ${s}`);return te(n,s)},collectionGroup(s){if(s.length===0||s.includes("/"))throw k(`collection group id must be a single non-empty segment with no '/': ${s}`);return Te(n,{source:{__ref:"group",collectionId:s},filters:[],orders:[],limitFromEnd:!1})},batch(){return Pn(n)},runTransaction(s,r){return Vn(n,s,r?.maxAttempts)},setRules(){throw ue("setRules","Deploy rules asynchronously through the relay instead: `await sandbox.channel.op({ method: 'setFirestoreRules', source })`.")},seed(){throw ue("seed","The relay has no atomic seed op; write seed docs through this handle (`db.doc(path).set(data)` / `db.batch()`), or drive `sandbox.channel.op({ method: 'admin.setDocument', path, data })` per document.")},snapshot(){throw ue("snapshot","Read the worker state asynchronously instead: `await sandbox.channel.op({ method: 'admin.readState' })`.")}}}const Ye=new WeakMap;function Et(e){const t=Ye.get(e);if(t)return t;const n=Ce(e.sandbox)?kt(e.sandbox,Mn(e.auth)):ee(pt(e),e);return Ye.set(e,n),n}function Mn(e){if(e==null)return{mode:"anon"};const t={mode:"as",uid:e.uid};return e.token!==void 0&&(t.token=e.token),e.tenant!==void 0&&(t.tenant=e.tenant),t}const Je=new WeakMap;function In(e){const t=zn(e)?e:e.withAuth(null),n=Je.get(t);if(n)return n;const s=t.operationContext.authLens.mode==="admin"?t:Ee(t,{source:t.operationContext.source,authLens:{mode:"admin"},...t.operationContext.planId===void 0?{}:{planId:t.operationContext.planId}}),r=Ce(s.sandbox)?kt(s.sandbox,{mode:"admin"}):ee(pt(s,!0),s,!0);return Je.set(t,r),r}function zn(e){return e!==null&&typeof e=="object"&&"sandbox"in e&&typeof e.withAuth=="function"}function $n(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"}function Ln(e){if(e instanceof I||!$n(e))return e;const t={};e.denialContext!==void 0&&(t.denialContext=e.denialContext),e.remediation!==void 0&&(t.remediation=e.remediation);const n=new I(e.code,e.message,Object.keys(t).length===0?void 0:t);e.denialContext!==void 0&&Object.assign(n,{denialContext:e.denialContext}),e.remediation!==void 0&&Object.assign(n,{remediation:e.remediation});for(const s of["request","resource","query","rule","queryProof"])e[s]!==void 0&&Object.assign(n,{[s]:e[s]});return n}async function ie(e){try{return await e()}catch(t){throw Ln(t)}}class Qn{static[Symbol.hasInstance](t){return!!(t&&typeof t=="object"&&"id"in t&&"path"in t&&typeof t.path=="string"&&!("docs"in t)&&!("exists"in t)&&!("doc"in t)&&!("add"in t))}}function Ft(e,t){const n=R(e);if(t===null)return n;const r=C(e),i=Ve(n,r,t);return Fe(n,i),xe(i)}function xe(e){function t(n){return Ft(e,n)}return Object.assign(e,{withConverter:t})}function X(e,t,n,s=null){function r(c){return c===null?Xe(a,null):Xe(a,c)}const i=R(e),o=Ve(i,n,s),a=Object.assign(o,{withConverter:r});return M(a,Re("reference",t)),Oe(i,t,n),Fe(i,a),a}function os(e,...t){const n=C(e),s=F in e,r=s?void 0:qe(e),i=W(n);if(s){if(t.length===0)throw new TypeError("doc(db, path) requires at least one path segment.");const l=t.join("/"),b=i.doc(l),A=Q(b,n,m=>m.doc(l));return X(A,l,n)}const o=R(e),a=t.length===0;let c;a?c=o.doc():c=o.doc(t.join("/"));const u=c.path,y=Q(c,n,h=>h.doc(u));return r!=null?X(y,u,n,r):X(y,u,n)}function as(e,...t){const n=C(e),s=F in e;if(t.length===0)throw new TypeError("collection() requires at least one path segment.");if(s){const c=t.join("/"),u=xe(W(n).collection(c));return Q(u,n,y=>y.collection(c))}const r=R(e),i=t.join("/"),o=xe(r.collection(i)),a=o.path;return Q(o,n,c=>c.collection(a))}function Xe(e,t){const n=C(e),s=R(e);return s instanceof Qn?X(s,s.path,n,t):Ft(e,t)}class Wn{started=!1;networkEnabled=!0;persistenceMode;pending=new Set;cachedPaths=new Set;cachedQueries=new WeakSet;syncObservers=new Set;syncScheduled=!1;markStarted(){this.started=!0}enablePersistence(t){if(this.started||this.persistenceMode!==void 0)throw new I("failed-precondition","Firestore has already been started and persistence can no longer be enabled.");this.persistenceMode=t,this.started=!0}disableNetwork(){this.started=!0,this.networkEnabled=!1}async enableNetwork(){this.started=!0,this.networkEnabled=!0;for(const t of this.pending)t.localDone&&t.resolve(t.value);await Promise.all([...this.pending].map(t=>t.promise))}runWrite(t,n){if(this.started=!0,n&&this.cachedPaths.add(n),this.networkEnabled)return t();let s,r;const i=new Promise((a,c)=>{s=a,r=c}),o={path:n,promise:i,localDone:!1,resolve:s,reject:r};return this.pending.add(o),t().then(a=>{o.localDone=!0,o.value=a,this.networkEnabled&&o.resolve(a)},a=>o.reject(a)),i.then(()=>this.pending.delete(o),()=>this.pending.delete(o)),i}waitForPendingWrites(){this.started=!0;const t=[...this.pending].map(n=>n.promise);return Promise.all(t).then(()=>{})}cachePath(t){this.started=!0,this.cachedPaths.add(t)}assertPathCached(t){if(this.started=!0,!this.cachedPaths.has(t))throw new I("unavailable","Failed to get document from cache. (However, this document may exist on the server.)")}cacheQuery(t){this.started=!0,this.cachedQueries.add(t)}hasCachedQuery(t){return this.started=!0,this.cachedQueries.has(t)||this.cachedPaths.size>0}snapshotMetadata(t){return Object.freeze({fromCache:!this.networkEnabled,hasPendingWrites:[...this.pending].some(n=>n.path===t)})}querySnapshotMetadata(){return Object.freeze({fromCache:!this.networkEnabled,hasPendingWrites:this.pending.size>0})}addSnapshotsInSyncObserver(t){return this.syncObservers.add(t),t(),()=>this.syncObservers.delete(t)}notifySnapshotDelivered(){this.syncScheduled||this.syncObservers.size===0||(this.syncScheduled=!0,queueMicrotask(()=>{this.syncScheduled=!1;for(const t of[...this.syncObservers])t()}))}}const Ke=new WeakMap;function L(e){let t=Ke.get(e);return t||(t=new Wn,Ke.set(e,t)),t}function oe(e,t,n,s,r){const i=R(t),o=typeof i.sdkActivitySource=="function"?i.sdkActivitySource():{service:"firestore",target:i.path,key:`doc:${i.path}`};return Ut.begin({app:e.activityApp??e,source:o,method:n,kind:s,owners:Nt(r?.owner,r?.owners)})}const F=Symbol("pyric/firestore/target");function W(e){return e.kind==="sandbox"?e.db:e.getDb()}const ae=new WeakMap;function Un(e,t){return ae.set(e,t),e}const U=new WeakMap;function Nn(e,t,n){return ae.set(e,t),U.set(e,n),e}function Pe(e,t){const n=R(t);if(e.kind==="sandbox")return n;const s=U.get(n);if(!s)throw new TypeError("pyric/firestore: live ref missing rebuild closure — was it produced by a factory in this package?");return s(W(e))}function Bn(e,t){const n=R(t);if(e.kind==="sandbox")return n;const s=U.get(n);if(!s)throw new TypeError("pyric/firestore: live collection ref missing rebuild closure.");return s(W(e))}function cs(e,t){const n=R(t);if(e.kind==="sandbox")return n;const s=U.get(n);if(!s)throw new TypeError("pyric/firestore: live query missing rebuild closure.");return s(W(e))}function Q(e,t,n){return t.kind==="sandbox-live"?Nn(e,t,n):Un(e,t)}function us(e){const t=R(e),n=U.get(t);return n||(()=>t)}function C(e){const t=Gn(e);return t.assertUsable?.(),t}function Gn(e){let t;if(F in e?t=e[F]:t=ae.get(e),!t)throw new TypeError("pyric/firestore: unrecognized reference — was it produced by a factory in this package?");return t}const Hn=Symbol.for("pyric.firestore.modular-value"),Ct=new WeakMap,At=new WeakMap;function qe(e){return Ct.get(e)}function R(e){return At.get(e)??e}function Ve(e,t,n){const s={id:e.id??"",path:e.path??""};return Object.defineProperty(s,Hn,{value:!0}),Ct.set(s,n),At.set(s,e),ae.set(s,t),s}function Yn(e){return e instanceof Kt?Array.from(e.value):null}function Se(e,t){if(e instanceof Yt)return t?.create(e.path)??e;if(e instanceof Jt)return Bt.fromUint8Array(e.data);if(e instanceof Xt)return new Gt(e.lat,e.lng);const i=Yn(e);if(i!==null)return Ht(i);if(Array.isArray(e))return e.map(u=>Se(u,t));if(e!==null&&typeof e=="object"){const u=Object.getPrototypeOf(e);if(u===Object.prototype||u===null){const d={};for(const[h,l]of Object.entries(e))d[h]=Se(l,t);return d}}return e}function ds(e,t){if(e!==void 0)return Se(e,t)}function Jn(e){if(e===void 0)return Jn(sn());const t=st(e);if(t)return t.service("firestore/default",()=>{const{sandbox:n,session:s}=t,r=de();t.onDelete(r.terminate);const i=t.authScope;i&&(r.own(s.onCurrentUserChanged(a=>{T(n).reevaluateLiveListeners(a,i)})),r.own(on(a=>{const c=a?.mode==="anon"?null:a?.mode==="as"?{uid:a.uid,...a.tenant?{tenant:a.tenant}:{}}:s.currentUser;T(n).reevaluateLiveListeners(c,i)})));const o={kind:"sandbox-live",activityApp:e,sandbox:n,getDb:Ze(n,()=>s.currentUser),authScope:i,...r};return{[F]:o,app:e}});if(Dt(e)){const n=Et(e),s={kind:"sandbox",activityApp:e,db:n,sandbox:e.sandbox,...de()};return{[F]:s}}if(Kn(e)){const n={kind:"sandbox-live",activityApp:e,sandbox:e,getDb:Ze(e),...de()};return{[F]:n}}throw new TypeError("pyric/firestore is a sandbox-only mirror. Package resolution must leave firebase/firestore unchanged for production; activate pyric sandbox or @pyric/cli/register before importing to select the sandbox.")}function de(){let e=!1;const t=new Set;return{own(n){return e?(n(),()=>{}):(t.add(n),()=>t.delete(n))},assertUsable(){if(e)throw new I("failed-precondition","The client has already been terminated.")},terminate(){if(!e){e=!0;for(const n of t)n();t.clear()}}}}function Xn(e){const t=st(e);if(t){t.assertAlive();const o=t.sandbox;return Xn(Ee(o.withAuth(null),{source:{kind:"app"},authLens:{mode:"admin"}}))}const n=Dt(e)?e:e.withAuth(null),s=n.sandbox,i={kind:"sandbox",db:In(n),sandbox:s};return{[F]:i}}function Dt(e){return e instanceof Zt}function Kn(e){if(e===null||typeof e!="object")return!1;const t=e;return typeof t.withAuth=="function"&&typeof t.onCurrentUserChanged=="function"&&"currentUser"in t&&"admin"in t}function Ze(e,t=()=>e.currentUser){return()=>{const n=t(),s=Ee(e.withAuth(n),{source:{kind:"app"},authLens:{mode:"app-session"}});return Et(s)}}function Zn(e,t,n,s){const r=en(e,t,n,s);if(r.length===0)return[{}];const i=[];for(const o of r)i.push(new tn(...o.path),o.value);return i}async function ls(e,t,n){const s=C(e);return se(oe(s,e,"setDoc","operation"),async()=>{const r=qe(e),i=r?r.toFirestore(t):t;return L(s).runWrite(()=>ie(()=>Pe(s,e).set(i,n)),e.path)})}function hs(e,t,...n){const s=C(e),r=Zn("updateDoc",e.path,t,n);return se(oe(s,e,"updateDoc","operation"),async()=>L(s).runWrite(()=>ie(()=>Pe(s,e).update(...r)),e.path))}async function fs(e){const t=C(e);return se(oe(t,e,"deleteDoc","operation"),async()=>L(t).runWrite(()=>ie(()=>Pe(t,e).delete()),e.path))}async function ps(e,t){const n=C(e);return se(oe(n,e,"addDoc","operation"),async()=>{const s=qe(e),r=s?s.toFirestore(t):t,i=await L(n).runWrite(async()=>{const c=await ie(()=>Bn(n,e).add(r));return L(n).cachePath(c.path),c}),o=i.path,a=Q(i,n,c=>c.doc(o));if(M(a,Re("reference",o)),Oe(a,o,n,a),s){const c=Ve(a,n,s);return Fe(a,c),c}return a})}export{us as A,kn as B,On as C,Ln as D,xe as E,Q as F,Ft as G,as as H,ps as I,hs as J,fs as K,ts as L,rn as M,se as N,Xn as O,ln as Q,F as T,sn as a,fe as b,L as c,os as d,qe as e,ds as f,Jn as g,At as h,ns as i,W as j,U as k,ct as l,ut as m,oe as n,C as o,cs as p,Pe as q,st as r,ls as s,Un as t,R as u,ss as v,ie as w,is as x,rs as y,Be as z};

package/src/functions-rtdb/child.ts

@@ -1,512 +0,0 @@
-import { spawn, type ChildProcess } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { createRequire } from 'node:module';
-import { dirname, extname, join, resolve } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import type { WorkerOpPayload, WorkerSubPayload } from '../bridge/protocol.js';
-import {
-  createRemoteSandboxHandle,
-  type RemoteSandbox,
-  type RemoteSandboxChannel,
-} from '../remote/index.js';
-import {
-  startOnValueCreatedExecution,
-  type OnValueCreatedExecutionHost,
-} from './execution.js';
-import {
-  inspectOnValueCreated,
-  listFirebaseEndpoints,
-} from './discovery.js';
-import type { CreatedExecutionResult } from './event.js';
-import { RemoteRtdbTriggerDelivery } from './remote-delivery.js';
-
-export interface SerializedFunctionsRtdbError {
-  name: string;
-  message: string;
-  stack?: string;
-}
-
-export type FunctionsRtdbChildEvent =
-  | {
-      type: 'execution';
-      exportName: string;
-      ref: string;
-      params: Record<string, string>;
-      status: 'fulfilled';
-    }
-  | {
-      type: 'execution';
-      exportName: string;
-      ref: string;
-      params: Record<string, string>;
-      status: 'rejected';
-      error: SerializedFunctionsRtdbError;
-    }
-  | {
-      type: 'delivery-error';
-      exportName: string;
-      error: SerializedFunctionsRtdbError;
-    };
-
-export interface FunctionsRtdbChildReady {
-  triggerCount: number;
-  unsupportedTriggers: UnsupportedFunctionsTrigger[];
-}
-
-export interface UnsupportedFunctionsTrigger {
-  exportName: string;
-  eventType: string;
-}
-
-export interface SpawnFunctionsRtdbChildOptions {
-  cwd: string;
-  entry: string;
-  env: NodeJS.ProcessEnv;
-  instance: string;
-  location: string;
-  databaseHost?: string;
-  /** The project the child runs as, from `resolveFirebaseProject`. */
-  projectId: string;
-  childModuleUrl?: string | URL;
-  nodeExecutable?: string;
-  onEvent?(event: FunctionsRtdbChildEvent): void;
-}
-
-export interface FunctionsRtdbChildHandle {
-  child: ChildProcess;
-  ready: Promise<FunctionsRtdbChildReady>;
-  exited: Promise<number>;
-  stop(): Promise<number>;
-}
-
-type FunctionsRtdbChildMessage =
-  | ({ type: 'ready' } & FunctionsRtdbChildReady)
-  | FunctionsRtdbChildEvent
-  | { type: 'fatal'; error: SerializedFunctionsRtdbError }
-  | { type: 'stopped' };
-
-const FORCE_KILL_AFTER_MS = 2_000;
-
-function serializeError(error: unknown): SerializedFunctionsRtdbError {
-  if (error instanceof Error) {
-    return {
-      name: error.name,
-      message: error.message,
-      ...(error.stack === undefined ? {} : { stack: error.stack }),
-    };
-  }
-  return { name: 'Error', message: String(error) };
-}
-
-function isChildMessage(value: unknown): value is FunctionsRtdbChildMessage {
-  return typeof value === 'object' && value !== null && 'type' in value;
-}
-
-export interface FunctionsChildEnvOptions {
-  baseEnv: NodeJS.ProcessEnv;
-  entry: string;
-  instance: string;
-  location: string;
-  databaseHost: string;
-  projectId: string;
-}
-
-/**
- * Resolve the database host, defaulting to 'firebasedatabase.app'.
- */
-export function resolveChildDatabaseHost(databaseHost?: string): string {
-  if (typeof databaseHost === 'string' && databaseHost.length > 0) {
-    return databaseHost;
-  }
-  return 'firebasedatabase.app';
-}
-
-/**
- * Resolve the filesystem path to the child entrypoint module.
- */
-export function resolveChildModulePath(childModuleUrl?: string | URL): string {
-  if (!childModuleUrl) {
-    return fileURLToPath(new URL('./child.js', import.meta.url));
-  }
-  if (typeof childModuleUrl === 'string' && !childModuleUrl.startsWith('file:')) {
-    return resolve(childModuleUrl);
-  }
-  return fileURLToPath(childModuleUrl);
-}
-
-/**
- * Assemble the child process environment variables.
- *
- * Guaranteed child-only synthetic sandbox metadata:
- * - GCLOUD_PROJECT is set to the resolved sandbox project ID
- * - FIREBASE_CONFIG is set to synthetic JSON with projectId, databaseURL, and storageBucket
- *
- * Explicit control flow ensures that host environment cannot pollute or route
- * sandbox functions execution to a production Firebase/GCP project.
- */
-export function buildFunctionsChildEnv(options: FunctionsChildEnvOptions): NodeJS.ProcessEnv {
-  const { baseEnv, entry, instance, location, databaseHost, projectId } = options;
-
-  const resolvedEntry = resolve(entry);
-  const databaseURL = `https://${instance}.${databaseHost}`;
-  const storageBucket = `${projectId}.appspot.com`;
-
-  const syntheticFirebaseConfig = JSON.stringify({
-    projectId,
-    databaseURL,
-    storageBucket,
-  });
-
-  const childEnv: NodeJS.ProcessEnv = {
-    ...baseEnv,
-    PYRIC_FUNCTIONS_RTDB_CHILD: '1',
-    PYRIC_FUNCTIONS_ENTRY: resolvedEntry,
-    PYRIC_FUNCTIONS_INSTANCE: instance,
-    PYRIC_FUNCTIONS_LOCATION: location,
-    PYRIC_FUNCTIONS_DATABASE_HOST: databaseHost,
-    GCLOUD_PROJECT: projectId,
-    FIREBASE_CONFIG: syntheticFirebaseConfig,
-  };
-
-  return childEnv;
-}
-
-/** Spawn the real Firebase Functions SDK in an isolated Node process. */
-export function spawnFunctionsRtdbChild(
-  options: SpawnFunctionsRtdbChildOptions,
-): FunctionsRtdbChildHandle {
-  const childModulePath = resolveChildModulePath(options.childModuleUrl);
-  const { projectId } = options;
-  const databaseHost = resolveChildDatabaseHost(options.databaseHost);
-  const childEnv = buildFunctionsChildEnv({
-    baseEnv: options.env,
-    entry: options.entry,
-    instance: options.instance,
-    location: options.location,
-    databaseHost,
-    projectId,
-  });
-
-  const nodeExecutable = options.nodeExecutable ?? 'node';
-  const child = spawn(nodeExecutable, [childModulePath], {
-    cwd: options.cwd,
-    env: childEnv,
-    stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
-  });
-
-  let readySettled = false;
-  let stopping = false;
-  let stderr = '';
-  child.stderr?.setEncoding('utf8');
-  child.stderr?.on('data', (chunk: string) => {
-    stderr = `${stderr}${chunk}`.slice(-8_192);
-  });
-
-  let resolveReady!: (ready: FunctionsRtdbChildReady) => void;
-  let rejectReady!: (error: Error) => void;
-  const ready = new Promise<FunctionsRtdbChildReady>((resolvePromise, rejectPromise) => {
-    resolveReady = resolvePromise;
-    rejectReady = rejectPromise;
-  });
-
-  child.on('message', (raw: unknown) => {
-    if (!isChildMessage(raw)) return;
-    if (raw.type === 'ready') {
-      readySettled = true;
-      resolveReady({
-        triggerCount: raw.triggerCount,
-        unsupportedTriggers: raw.unsupportedTriggers,
-      });
-    } else if (raw.type === 'fatal') {
-      if (!readySettled) {
-        readySettled = true;
-        rejectReady(new Error(
-          `Functions RTDB child failed: ${raw.error.stack ?? raw.error.message}`,
-        ));
-      }
-    } else if (raw.type === 'execution' || raw.type === 'delivery-error') {
-      options.onEvent?.(raw);
-    }
-  });
-
-  let forceTimer: ReturnType<typeof setTimeout> | undefined;
-  const exited = new Promise<number>((resolveExited) => {
-    child.once('error', (error) => {
-      if (!readySettled) {
-        readySettled = true;
-        rejectReady(error);
-      }
-    });
-    child.once('close', (code, signal) => {
-      if (forceTimer !== undefined) clearTimeout(forceTimer);
-      const exitCode = typeof code === 'number' ? code : signal ? 1 : 0;
-      if (!readySettled) {
-        readySettled = true;
-        const diagnostic = stderr.trim();
-        rejectReady(new Error(
-          `Functions RTDB child exited before ready (code ${exitCode})` +
-            (diagnostic ? `\n${diagnostic}` : ''),
-        ));
-      }
-      resolveExited(exitCode);
-    });
-  });
-
-  return {
-    child,
-    ready,
-    exited,
-    async stop(): Promise<number> {
-      if (child.exitCode !== null || child.signalCode !== null) return exited;
-      if (!stopping) {
-        stopping = true;
-        if (child.connected) child.send({ type: 'stop' });
-        else child.kill('SIGTERM');
-        forceTimer = setTimeout(() => {
-          if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL');
-        }, FORCE_KILL_AFTER_MS);
-        forceTimer.unref();
-      }
-      return exited;
-    },
-  };
-}
-
-interface AdminAppModule {
-  initializeApp(): { sandbox: RemoteSandbox };
-  deleteApp(app: unknown): Promise<void>;
-}
-
-function send(message: FunctionsRtdbChildMessage): void {
-  process.send?.(message);
-}
-
-/** The current instant of the sandbox this child is attached to. */
-async function sandboxNow(sandbox: RemoteSandbox): Promise<number> {
-  const read = (await sandbox.channel.op({ method: 'sandbox.clock' })) as { now: number };
-  return read.now;
-}
-
-function usesCommonJs(entry: string): boolean {
-  const extension = extname(entry);
-  if (extension === '.cjs') return true;
-  if (extension === '.mjs') return false;
-
-  let directory = dirname(entry);
-  while (true) {
-    const packageJsonPath = join(directory, 'package.json');
-    if (existsSync(packageJsonPath)) {
-      const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8')) as {
-        type?: unknown;
-      };
-      return packageJson.type !== 'module';
-    }
-    const parent = dirname(directory);
-    if (parent === directory) return true;
-    directory = parent;
-  }
-}
-
-/** Load the entry with the semantics selected by its extension and package scope. */
-async function loadFunctionsExports(entry: string): Promise<Record<string, unknown>> {
-  if (usesCommonJs(entry)) {
-    return createRequire(entry)(entry) as Record<string, unknown>;
-  }
-  return await import(pathToFileURL(entry).href) as Record<string, unknown>;
-}
-
-/**
- * The configured instance name is the name of the default instance: the
- * `functions.instance` option renames `<projectId>-default-rtdb`, and the host
- * serves that instance without a name. Wrap the remote sandbox factory that
- * `@pyric/cli/register` installs so every RTDB op and value subscription this
- * child sends for `name`, from firebase-admin or from trigger delivery,
- * reaches the default instance.
- */
-function serveInstanceAsDefault(name: string): void {
-  const key = Symbol.for('pyric.remote.sandboxFactory');
-  const global = globalThis as Record<symbol, unknown>;
-  const factory = global[key] as ((options?: { url?: string }) => RemoteSandbox) | undefined;
-  if (typeof factory !== 'function') return;
-  global[key] = (options?: { url?: string }): RemoteSandbox => {
-    const inner = factory(options);
-    return createRemoteSandboxHandle({
-      channel: aliasDefaultInstance(inner.channel, name),
-      serveUrl: inner.serveUrl,
-      close: () => inner.close(),
-    });
-  };
-}
-
-/** A channel that sends `instance: name` as the default instance. */
-function aliasDefaultInstance(channel: RemoteSandboxChannel, name: string): RemoteSandboxChannel {
-  const alias = (instance: unknown): unknown => (instance === name ? undefined : instance);
-  return {
-    op: (payload) => channel.op(
-      'instance' in payload ? { ...payload, instance: alias(payload.instance) } as WorkerOpPayload : payload,
-    ),
-    subscribe: (sub, onSnap, onError) => {
-      const target = sub.target;
-      const isRtdb = typeof target === 'object' && target !== null && 'service' in target && target.service === 'rtdb';
-      const aliased = isRtdb ? { ...sub, target: { ...target, instance: alias(target.instance) } } as WorkerSubPayload : sub;
-      return channel.subscribe(aliased, onSnap, onError);
-    },
-    byteRoute: () => channel.byteRoute?.() ?? Promise.resolve(undefined),
-  };
-}
-
-async function runFunctionsRtdbChild(): Promise<void> {
-  const entry = process.env.PYRIC_FUNCTIONS_ENTRY;
-  const instance = process.env.PYRIC_FUNCTIONS_INSTANCE;
-  const location = process.env.PYRIC_FUNCTIONS_LOCATION;
-  const databaseHost = process.env.PYRIC_FUNCTIONS_DATABASE_HOST;
-  if (!entry || !instance || !location || !databaseHost) {
-    throw new Error('Functions RTDB child is missing its required environment');
-  }
-
-  const requireFromEntry = createRequire(entry);
-  const adminApp = requireFromEntry('firebase-admin/app') as AdminAppModule;
-  serveInstanceAsDefault(instance);
-  const app = adminApp.initializeApp();
-  let host: OnValueCreatedExecutionHost | undefined;
-  let closing: Promise<void> | undefined;
-
-  const close = (): Promise<void> => {
-    if (closing) return closing;
-    closing = (async () => {
-      host?.close();
-      await host?.idle();
-      app.sandbox.close();
-      await adminApp.deleteApp(app);
-    })();
-    return closing;
-  };
-
-  const shutdown = async (): Promise<void> => {
-    await close();
-    send({ type: 'stopped' });
-    process.disconnect?.();
-  };
-
-  process.once('message', (raw: unknown) => {
-    if (isChildMessage(raw) && raw.type === 'stopped') return;
-    if (typeof raw === 'object' && raw !== null && 'type' in raw && raw.type === 'stop') {
-      void shutdown().catch((error) => {
-        send({ type: 'fatal', error: serializeError(error) });
-        process.exitCode = 1;
-        process.disconnect?.();
-      });
-    }
-  });
-  process.once('SIGINT', () => void shutdown());
-  process.once('SIGTERM', () => void shutdown());
-
-  try {
-    // The real database provider asks firebase-admin/app for its default app
-    // when it wraps a raw CloudEvent. Initializing that app before loading the
-    // user's module avoids importing the broad firebase-functions/v2 barrel.
-    const exported = await loadFunctionsExports(entry);
-    const effectiveInstances = [...new Set(
-      inspectOnValueCreated(exported).triggers.map((trigger) =>
-        trigger.instance === '*' ? instance : trigger.instance,
-      ),
-    )].sort();
-    if (effectiveInstances.length > 1) {
-      throw new Error(
-        'Functions RTDB first slice supports one database instance; found ' +
-          effectiveInstances.join(', '),
-      );
-    }
-    // Deliver from the instance the triggers name.
-    const rtdb = app.sandbox.rtdb.forInstance(effectiveInstances[0] ?? instance);
-    host = startOnValueCreatedExecution({
-      exported,
-      delivery: new RemoteRtdbTriggerDelivery(rtdb),
-      eventOptions: async (_projection, sequence, trigger) => ({
-        id: `${randomUUID()}-${sequence}`,
-        // The delivery's instant is the sandbox's, not this process's: the
-        // write that triggered it was stamped by that clock, and a CloudEvent
-        // claiming a different `time` would contradict the data it carries.
-        time: new Date(await sandboxNow(app.sandbox)).toISOString(),
-        instance: trigger.instance === '*' ? instance : trigger.instance,
-        location: trigger.location ?? location,
-        databaseHost,
-      }),
-      onExecution(result, trigger, projection) {
-        sendExecution(result, trigger.exportName, projection.ref, projection.params);
-      },
-      onDeliveryError(error, trigger) {
-        send({
-          type: 'delivery-error',
-          exportName: trigger.exportName,
-          error: serializeError(error),
-        });
-      },
-    });
-    await host.ready;
-    send({
-      type: 'ready',
-      triggerCount: host.triggerCount,
-      unsupportedTriggers: findUnsupportedTriggers(exported),
-    });
-  } catch (error) {
-    await close();
-    throw error;
-  }
-}
-
-function findUnsupportedTriggers(exported: Record<string, unknown>): UnsupportedFunctionsTrigger[] {
-  const unsupported: UnsupportedFunctionsTrigger[] = [
-    ...inspectOnValueCreated(exported).unsupported,
-  ];
-  for (const { exportName, callable } of listFirebaseEndpoints(exported)) {
-    const endpoint = callable.__endpoint;
-    if (!endpoint) continue;
-    const eventType = endpoint.eventTrigger?.eventType;
-    if (eventType === 'google.firebase.database.ref.v1.created') continue;
-    const label = typeof eventType === 'string'
-      ? eventType
-      : endpoint.callableTrigger !== undefined
-        ? 'callable'
-        : endpoint.httpsTrigger !== undefined
-          ? 'https'
-          : endpoint.scheduleTrigger !== undefined
-            ? 'schedule'
-            : endpoint.taskQueueTrigger !== undefined
-              ? 'task-queue'
-              : 'unknown';
-    unsupported.push({ exportName, eventType: label });
-  }
-  return unsupported;
-}
-
-function sendExecution(
-  result: CreatedExecutionResult,
-  exportName: string,
-  ref: string,
-  params: Record<string, string>,
-): void {
-  if (result.status === 'fulfilled') {
-    send({ type: 'execution', exportName, ref, params, status: 'fulfilled' });
-  } else {
-    send({
-      type: 'execution',
-      exportName,
-      ref,
-      params,
-      status: 'rejected',
-      error: serializeError(result.error),
-    });
-  }
-}
-
-if (process.env.PYRIC_FUNCTIONS_RTDB_CHILD === '1') {
-  void runFunctionsRtdbChild().catch((error) => {
-    const serialized = serializeError(error);
-    send({ type: 'fatal', error: serialized });
-    process.stderr.write(`${serialized.stack ?? `${serialized.name}: ${serialized.message}`}\n`);
-    process.exitCode = 1;
-    process.disconnect?.();
-  });
-}

package/src/serve/gemini-error-redaction.ts

@@ -1,60 +0,0 @@
-/**
- * Masking an upstream Gemini error before the gemini proxy relays it to the
- * browser (#1584). An upstream or a gateway can quote the credential it was
- * sent in any form: in the URL (`?key=`, `&key=`, JSON-escaped or
- * percent-encoded), in plain text, or in an echoed header such as
- * `x-goog-api-key` or `Authorization: Bearer`. So the proxy removes the exact
- * credentials the request carried, raw and percent-encoded, then runs
- * `redactUrl` as a second pass for any other credential parameter.
- *
- * A JSON body is masked value by value and serialized again, so the
- * browser engine still reads Gemini's own status and message. Text
- * redaction over the raw JSON could eat a closing quote and leave the
- * envelope unparseable.
- */
-import { redactUrl } from 'pyric/ai/internal';
-
-const MASK = '***';
-
-/** The forms a credential can appear in, longest first. */
-function quotedForms(credential: string): string[] {
-  const forms = new Set([encodeURIComponent(credential), credential]);
-  return [...forms].sort((a, b) => b.length - a.length);
-}
-
-function redactText(text: string, credentials: readonly string[]): string {
-  let masked = text;
-  for (const credential of credentials) {
-    for (const form of quotedForms(credential)) masked = masked.split(form).join(MASK);
-  }
-  return redactUrl(masked);
-}
-
-function redactValue(value: unknown, credentials: readonly string[]): unknown {
-  if (typeof value === 'string') return redactText(value, credentials);
-  if (Array.isArray(value)) return value.map((item) => redactValue(item, credentials));
-  const isObject = value !== null && typeof value === 'object';
-  if (!isObject) return value;
-  const entries = Object.entries(value as Record<string, unknown>)
-    .map(([key, item]) => [redactText(key, credentials), redactValue(item, credentials)]);
-  return Object.fromEntries(entries);
-}
-
-/** The JSON value `text` holds, or undefined when it is not JSON. */
-function parseJson(text: string): { value: unknown } | undefined {
-  try {
-    return { value: JSON.parse(text) as unknown };
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * `text` with every credential in `credentials` removed, and every
- * credential URL parameter masked. A JSON body stays JSON.
- */
-export function redactUpstreamError(text: string, credentials: readonly string[]): string {
-  const json = parseJson(text);
-  if (json === undefined) return redactText(text, credentials);
-  return JSON.stringify(redactValue(json.value, credentials));
-}