@pyric/cli 0.1.0-alpha.9

package/dist/serve/entries/auth-helper-dom.js

@@ -0,0 +1,116 @@
+const PROVIDER_LABEL = {
+    'google.com': 'Google',
+    'facebook.com': 'Facebook',
+    'github.com': 'GitHub',
+    'apple.com': 'Apple',
+};
+const STYLE = `
+  dialog[data-pyric-auth] { border: 1px solid #2a2a35; border-radius: 12px; background: #16161d;
+    color: #e8e8ee; font: 14px/1.45 system-ui, sans-serif; padding: 20px; width: min(420px, 92vw); }
+  dialog[data-pyric-auth]::backdrop { background: rgb(0 0 0 / 0.6); }
+  dialog[data-pyric-auth] h2 { margin: 0 0 4px; font-size: 16px; }
+  dialog[data-pyric-auth] p { margin: 0 0 14px; font-size: 12px; color: #9a9aa8; }
+  dialog[data-pyric-auth] .ids { display: grid; gap: 8px; margin-bottom: 14px; }
+  dialog[data-pyric-auth] .ids button { display: flex; gap: 10px; align-items: center; text-align: left;
+    padding: 8px 10px; border: 1px solid #2a2a35; border-radius: 8px; background: none; color: inherit; cursor: pointer; }
+  dialog[data-pyric-auth] .ids button:hover { border-color: #4a4a5a; background: rgb(255 255 255 / 0.05); }
+  dialog[data-pyric-auth] form { display: grid; gap: 8px; border-top: 1px solid #2a2a35; padding-top: 14px; }
+  dialog[data-pyric-auth] input, dialog[data-pyric-auth] textarea { background: none; color: inherit;
+    border: 1px solid #2a2a35; border-radius: 8px; padding: 8px 10px; font: inherit; }
+  dialog[data-pyric-auth] textarea { font-family: ui-monospace, monospace; font-size: 12px; }
+  dialog[data-pyric-auth] .row { display: flex; justify-content: flex-end; gap: 8px; margin-top: 6px; }
+  dialog[data-pyric-auth] .row button { padding: 8px 14px; border-radius: 8px; border: none; cursor: pointer; font: inherit; }
+  dialog[data-pyric-auth] .cancel { background: none; color: #9a9aa8; }
+  dialog[data-pyric-auth] .submit { background: #5b5bd6; color: white; }
+  dialog[data-pyric-auth] .err { color: #ff6b6b; font-size: 12px; }
+`;
+export function mountAuthHelperDialog(helper) {
+    const style = document.createElement('style');
+    style.textContent = STYLE;
+    document.head.appendChild(style);
+    const dialog = document.createElement('dialog');
+    dialog.setAttribute('data-pyric-auth', '');
+    document.body.appendChild(dialog);
+    // <dialog> cancel (Escape) + backdrop click → cancel the flow.
+    dialog.addEventListener('cancel', () => helper.cancel());
+    dialog.addEventListener('click', (e) => {
+        if (e.target === dialog)
+            helper.cancel(); // backdrop only
+    });
+    const render = () => {
+        const snap = helper.snapshot();
+        if (!snap.request) {
+            if (dialog.open)
+                dialog.close();
+            return;
+        }
+        const provider = PROVIDER_LABEL[snap.request.providerId] ?? snap.request.providerId;
+        dialog.replaceChildren();
+        const h2 = document.createElement('h2');
+        h2.textContent = `Sign in with ${provider}`;
+        const p = document.createElement('p');
+        p.textContent =
+            'pyric dev sign-in helper — pick a test account or add one. Custom claims let rules using request.auth.token.* run against this identity.';
+        dialog.append(h2, p);
+        if (snap.identities.length > 0) {
+            const ids = document.createElement('div');
+            ids.className = 'ids';
+            for (const id of snap.identities) {
+                const btn = document.createElement('button');
+                btn.type = 'button';
+                const label = id.displayName || id.email || id.uid;
+                btn.textContent = id.email && id.displayName ? `${label} — ${id.email}` : label;
+                btn.addEventListener('click', () => helper.pick(id.uid));
+                ids.appendChild(btn);
+            }
+            dialog.appendChild(ids);
+        }
+        const form = document.createElement('form');
+        form.method = 'dialog';
+        const email = document.createElement('input');
+        email.type = 'email';
+        email.placeholder = 'email@example.com';
+        email.required = true;
+        const name = document.createElement('input');
+        name.type = 'text';
+        name.placeholder = 'Display name (optional)';
+        const claims = document.createElement('textarea');
+        claims.rows = 3;
+        claims.placeholder = 'Custom claims JSON (optional)\ne.g. { "admin": true }';
+        const err = document.createElement('div');
+        err.className = 'err';
+        const row = document.createElement('div');
+        row.className = 'row';
+        const cancel = document.createElement('button');
+        cancel.type = 'button';
+        cancel.className = 'cancel';
+        cancel.textContent = 'Cancel';
+        cancel.addEventListener('click', () => helper.cancel());
+        const submit = document.createElement('button');
+        submit.type = 'submit';
+        submit.className = 'submit';
+        submit.textContent = 'Sign in';
+        row.append(cancel, submit);
+        form.append(email, name, claims, err, row);
+        form.addEventListener('submit', (e) => {
+            e.preventDefault();
+            let parsed;
+            if (claims.value.trim()) {
+                try {
+                    parsed = JSON.parse(claims.value);
+                }
+                catch {
+                    err.textContent = 'Custom claims must be valid JSON.';
+                    return;
+                }
+            }
+            helper.add({ email: email.value.trim(), displayName: name.value.trim() || undefined, customClaims: parsed });
+        });
+        dialog.appendChild(form);
+        if (!dialog.open)
+            dialog.showModal();
+    };
+    helper.subscribe(render);
+    render();
+}
+//# sourceMappingURL=auth-helper-dom.js.map

package/dist/serve/entries/auth-helper-dom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-dom.js","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-dom.ts"],"names":[],"mappings":"AAaA,MAAM,cAAc,GAA2B;IAC7C,YAAY,EAAE,QAAQ;IACtB,cAAc,EAAE,UAAU;IAC1B,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,OAAO;CACrB,CAAC;AAEF,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;CAmBb,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAElC,+DAA+D;IAC/D,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,gBAAgB;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpF,MAAM,CAAC,eAAe,EAAE,CAAC;QAEzB,MAAM,EAAE,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACxC,EAAE,CAAC,WAAW,GAAG,gBAAgB,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,WAAW;YACX,0IAA0I,CAAC;QAC7I,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAErB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC1C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC7C,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;gBACpB,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;gBACnD,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAChF,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzD,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QACrB,KAAK,CAAC,WAAW,GAAG,mBAAmB,CAAC;QACxC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,yBAAyB,CAAC;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAChB,MAAM,CAAC,WAAW,GAAG,uDAAuD,CAAC;QAC7E,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC5B,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC;QAC9B,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC5B,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACpC,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,IAAI,MAA2C,CAAC;YAChD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAA4B,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,WAAW,GAAG,mCAAmC,CAAC;oBACtD,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzB,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IACvC,CAAC,CAAC;IAEF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC;AACX,CAAC"}

package/dist/serve/entries/auth-helper-runtime.d.ts

@@ -0,0 +1,5 @@
+/** Shared resolver slot connecting the injected init entry to firebase/auth. */
+import type { AuthFlowRequest, AuthFlowResolver, UserCredential } from 'pyric/auth';
+export declare function installServeAuthResolver(next: AuthFlowResolver): void;
+export declare function resolveServeAuthFlow(request: AuthFlowRequest, kind: 'popup' | 'redirect'): Promise<UserCredential>;
+//# sourceMappingURL=auth-helper-runtime.d.ts.map

package/dist/serve/entries/auth-helper-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-runtime.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-runtime.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIpF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAErE;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,OAAO,GAAG,UAAU,GACzB,OAAO,CAAC,cAAc,CAAC,CAOzB"}

package/dist/serve/entries/auth-helper-runtime.js

@@ -0,0 +1,11 @@
+let resolver = null;
+export function installServeAuthResolver(next) {
+    resolver = next;
+}
+export function resolveServeAuthFlow(request, kind) {
+    if (!resolver) {
+        return Promise.reject(new Error('pyric dev provider helper is not initialized; load /__pyric/sdk/init.js first'));
+    }
+    return kind === 'popup' ? resolver.openPopup(request) : resolver.openRedirect(request);
+}
+//# sourceMappingURL=auth-helper-runtime.js.map

package/dist/serve/entries/auth-helper-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-runtime.js","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-runtime.ts"],"names":[],"mappings":"AAGA,IAAI,QAAQ,GAA4B,IAAI,CAAC;AAE7C,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAC7D,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAwB,EACxB,IAA0B;IAE1B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AACzF,CAAC"}

package/dist/serve/entries/auth.d.ts

@@ -0,0 +1,77 @@
+/**
+ * The bundle the import map serves for `firebase/auth`.
+ *
+ * DUAL-PATH (Phase 3c): when a SharedWorker is available, auth routes to the
+ * ONE worker-hosted sandbox — shared user pool + data, PER-TAB sessions
+ * (#754: each tab signs in as its own user). Otherwise it runs against the
+ * in-page sandbox — the unchanged fallback. Branch picked ONCE at load
+ * (`useWorker`).
+ *
+ * PROVIDER SIGN-IN: the picker UI lives in-page, but its controller is
+ * backend-free. In worker mode it lists identities from the worker and returns
+ * a plain credential to `auth.acceptIdentity`; no page-local Auth handle signs
+ * in or seeds a user. Email/password + anonymous also go straight to the
+ * worker. The COMPLETE surface is exported on both paths (import-time parity).
+ */
+import * as ipAuth from 'pyric/auth';
+import { getAuth as pyricGetAuth, setPersistence as pyricSetPersistence } from 'pyric/auth';
+export declare const onAuthStateChanged: typeof ipAuth.onAuthStateChanged;
+export declare const onIdTokenChanged: typeof ipAuth.onIdTokenChanged;
+/**
+ * Worker mode: the gate can't run before a worker-committed transition
+ * (see `worker/client.ts`'s `beforeAuthStateChanged` doc) — registering
+ * throws immediately rather than silently accepting a no-op callback.
+ * In-page mode: full block-and-abort semantics via `pyric/auth`.
+ */
+export declare const beforeAuthStateChanged: typeof ipAuth.beforeAuthStateChanged;
+export declare const signInAnonymously: typeof ipAuth.signInAnonymously;
+export declare const signInWithEmailAndPassword: typeof ipAuth.signInWithEmailAndPassword;
+export declare const createUserWithEmailAndPassword: typeof ipAuth.createUserWithEmailAndPassword;
+export declare const signOut: typeof ipAuth.signOut;
+export declare const connectAuthEmulator: typeof ipAuth.connectAuthEmulator;
+/**
+ * `updateProfile(user, { displayName?, photoURL? })` — updates the signed-in
+ * user's profile on the picked path (worker or in-page). Both `wc` and `ipAuth`
+ * export a top-level `updateProfile`; cast to the canonical `pyric/auth` shape.
+ * (Fixes #746: the served `firebase/auth` entry didn't re-export this at all.)
+ */
+export declare const updateProfile: typeof ipAuth.updateProfile;
+export declare const GoogleAuthProvider: typeof ipAuth.GoogleAuthProvider;
+export declare const EmailAuthProvider: typeof ipAuth.EmailAuthProvider;
+export declare const FacebookAuthProvider: typeof ipAuth.FacebookAuthProvider;
+export declare const GithubAuthProvider: typeof ipAuth.GithubAuthProvider;
+export declare const OAuthProvider: typeof ipAuth.OAuthProvider;
+export declare const browserLocalPersistence: ipAuth.Persistence;
+export declare const browserSessionPersistence: ipAuth.Persistence;
+export declare const inMemoryPersistence: ipAuth.Persistence;
+export declare const getAuth: typeof pyricGetAuth;
+/** `setPersistence`: selects which web storage holds THIS TAB's session (and
+ *  migrates the current one). On the worker path the record is still client-
+ *  side (#754 — per-port sessions restore via `auth.restorePortSession`); the
+ *  RPC just keeps the worker's surface-parity mode in sync. */
+export declare const setPersistence: typeof pyricSetPersistence;
+export declare const signInWithPopup: typeof ipAuth.signInWithPopup;
+/**
+ * `signInWithRedirect` over the worker resolves like popup — the pyric
+ * emulator helper does not actually navigate, so the identity is picked + the
+ * worker signs in immediately. The result is delivered through the sign-in +
+ * `onAuthStateChanged`; `getRedirectResult` returns null on the worker path
+ * (there is no deferred post-navigation result to replay). v1 behavior.
+ */
+export declare const signInWithRedirect: typeof ipAuth.signInWithRedirect;
+export declare const getRedirectResult: typeof ipAuth.getRedirectResult;
+/** Direct credential sign-in: unsupported over the worker in v1 (the
+ *  worker-client rejects with a clear error); in-page passes through. */
+export declare const signInWithCredential: typeof ipAuth.signInWithCredential;
+/** `initializeAuth(app, deps?)` — aliases the picked `getAuth` (worker- or
+ *  in-page-backed). Path-independent: `deps` is accepted for parity, ignored. */
+export declare const initializeAuth: typeof ipAuth.initializeAuth;
+/** `useDeviceLanguage(auth)` — accepted no-op (no device locale in the served
+ *  sandbox). Path-independent. */
+export declare const useDeviceLanguage: typeof ipAuth.useDeviceLanguage;
+export declare const deleteUser: typeof ipAuth.deleteUser;
+export declare const updateEmail: typeof ipAuth.updateEmail;
+export declare const updatePassword: typeof ipAuth.updatePassword;
+export declare const reload: typeof ipAuth.reload;
+export declare const updateCurrentUser: typeof ipAuth.updateCurrentUser;
+//# sourceMappingURL=auth.d.ts.map

package/dist/serve/entries/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,cAAc,IAAI,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAgB5F,eAAO,MAAM,kBAAkB,kCAAuB,CAAC;AACvD,eAAO,MAAM,gBAAgB,gCAAqB,CAAC;AACnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,sCAA2B,CAAC;AAC/D,eAAO,MAAM,iBAAiB,iCAAsB,CAAC;AACrD,eAAO,MAAM,0BAA0B,0CAA+B,CAAC;AACvE,eAAO,MAAM,8BAA8B,8CAAmC,CAAC;AAC/E,eAAO,MAAM,OAAO,uBAAY,CAAC;AACjC,eAAO,MAAM,mBAAmB,mCAAwB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAA4D,OAAO,MAAM,CAAC,aAAa,CAAC;AAGlH,eAAO,MAAM,kBAAkB,kCAA4B,CAAC;AAC5D,eAAO,MAAM,iBAAiB,iCAA2B,CAAC;AAC1D,eAAO,MAAM,oBAAoB,oCAA8B,CAAC;AAChE,eAAO,MAAM,kBAAkB,kCAA4B,CAAC;AAC5D,eAAO,MAAM,aAAa,6BAAuB,CAAC;AAClD,eAAO,MAAM,uBAAuB,oBAAiC,CAAC;AACtE,eAAO,MAAM,yBAAyB,oBAAmC,CAAC;AAC1E,eAAO,MAAM,mBAAmB,oBAA6B,CAAC;AAiC9D,eAAO,MAAM,OAAO,EAgBd,OAAO,YAAY,CAAC;AAiB1B;;;+DAG+D;AAC/D,eAAO,MAAM,cAAc,EAgBtB,OAAO,mBAAmB,CAAC;AAoChC,eAAO,MAAM,eAAe,EAKvB,OAAO,MAAM,CAAC,eAAe,CAAC;AAEnC;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAK1B,OAAO,MAAM,CAAC,kBAAkB,CAAC;AAEtC,eAAO,MAAM,iBAAiB,EAIzB,OAAO,MAAM,CAAC,iBAAiB,CAAC;AAErC;yEACyE;AACzE,eAAO,MAAM,oBAAoB,EAE5B,OAAO,MAAM,CAAC,oBAAoB,CAAC;AAWxC;iFACiF;AACjF,eAAO,MAAM,cAAc,EACC,OAAO,MAAM,CAAC,cAAc,CAAC;AAEzD;kCACkC;AAClC,eAAO,MAAM,iBAAiB,EAAgC,OAAO,MAAM,CAAC,iBAAiB,CAAC;AAM9F,eAAO,MAAM,UAAU,EAElB,OAAO,MAAM,CAAC,UAAU,CAAC;AAC9B,eAAO,MAAM,WAAW,EAEnB,OAAO,MAAM,CAAC,WAAW,CAAC;AAC/B,eAAO,MAAM,cAAc,EAEtB,OAAO,MAAM,CAAC,cAAc,CAAC;AAClC,eAAO,MAAM,MAAM,EAEd,OAAO,MAAM,CAAC,MAAM,CAAC;AAC1B,eAAO,MAAM,iBAAiB,EAEzB,OAAO,MAAM,CAAC,iBAAiB,CAAC"}

package/dist/serve/entries/auth.js

@@ -0,0 +1,201 @@
+/**
+ * The bundle the import map serves for `firebase/auth`.
+ *
+ * DUAL-PATH (Phase 3c): when a SharedWorker is available, auth routes to the
+ * ONE worker-hosted sandbox — shared user pool + data, PER-TAB sessions
+ * (#754: each tab signs in as its own user). Otherwise it runs against the
+ * in-page sandbox — the unchanged fallback. Branch picked ONCE at load
+ * (`useWorker`).
+ *
+ * PROVIDER SIGN-IN: the picker UI lives in-page, but its controller is
+ * backend-free. In worker mode it lists identities from the worker and returns
+ * a plain credential to `auth.acceptIdentity`; no page-local Auth handle signs
+ * in or seeds a user. Email/password + anonymous also go straight to the
+ * worker. The COMPLETE surface is exported on both paths (import-time parity).
+ */
+import * as ipAuth from 'pyric/auth';
+import { getAuth as pyricGetAuth, setPersistence as pyricSetPersistence } from 'pyric/auth';
+import * as wcRaw from '../worker/client.js';
+import { acceptProviderCredential, restorePortSession } from '../worker/client.js';
+import { useWorker } from './worker-runtime.js';
+import { sessionStoreForApp } from './app-session-store.js';
+import { resolveServeAuthFlow } from './auth-helper-runtime.js';
+import { getApp } from 'pyric/app';
+import { workerClientForApp } from './app-client.js';
+// Worker-client auth, cast to the canonical pyric/auth surface for the picked
+// bindings (same names + shapes). Provider-bridge specifics are explicit below.
+const wc = wcRaw;
+/** Observers + email/anon sign-in: worker-client or in-page. */
+const A = useWorker ? wc : ipAuth;
+export const onAuthStateChanged = A.onAuthStateChanged;
+export const onIdTokenChanged = A.onIdTokenChanged;
+/**
+ * Worker mode: the gate can't run before a worker-committed transition
+ * (see `worker/client.ts`'s `beforeAuthStateChanged` doc) — registering
+ * throws immediately rather than silently accepting a no-op callback.
+ * In-page mode: full block-and-abort semantics via `pyric/auth`.
+ */
+export const beforeAuthStateChanged = A.beforeAuthStateChanged;
+export const signInAnonymously = A.signInAnonymously;
+export const signInWithEmailAndPassword = A.signInWithEmailAndPassword;
+export const createUserWithEmailAndPassword = A.createUserWithEmailAndPassword;
+export const signOut = A.signOut;
+export const connectAuthEmulator = A.connectAuthEmulator;
+/**
+ * `updateProfile(user, { displayName?, photoURL? })` — updates the signed-in
+ * user's profile on the picked path (worker or in-page). Both `wc` and `ipAuth`
+ * export a top-level `updateProfile`; cast to the canonical `pyric/auth` shape.
+ * (Fixes #746: the served `firebase/auth` entry didn't re-export this at all.)
+ */
+export const updateProfile = (useWorker ? wc.updateProfile : ipAuth.updateProfile);
+// ── Provider value classes + persistence markers — path-independent ───────
+export const GoogleAuthProvider = ipAuth.GoogleAuthProvider;
+export const EmailAuthProvider = ipAuth.EmailAuthProvider;
+export const FacebookAuthProvider = ipAuth.FacebookAuthProvider;
+export const GithubAuthProvider = ipAuth.GithubAuthProvider;
+export const OAuthProvider = ipAuth.OAuthProvider;
+export const browserLocalPersistence = ipAuth.browserLocalPersistence;
+export const browserSessionPersistence = ipAuth.browserSessionPersistence;
+export const inMemoryPersistence = ipAuth.inMemoryPersistence;
+// ── getAuth — worker-backed auth (reusing the shared worker port) or in-page.
+const workerAuthByApp = new WeakMap();
+const persistenceWired = new WeakSet();
+function wireAppPersistence(app, auth) {
+    if (persistenceWired.has(app))
+        return;
+    persistenceWired.add(app);
+    const store = sessionStoreForApp(app);
+    const stored = store.load();
+    if (useWorker && stored) {
+        // Posting restore before listener registration preserves FIFO ordering on
+        // this app's MessagePort, so the initial listener value is the restore.
+        void restorePortSession(auth, stored.uid).then((user) => {
+            if (!user)
+                store.clear();
+        });
+    }
+    else if (!useWorker && stored) {
+        try {
+            ipAuth.sandbox.restoreSession(auth, stored.uid);
+        }
+        catch {
+            store.clear();
+        }
+    }
+    A.onAuthStateChanged(auth, (user) => {
+        if (user)
+            store.save(user.uid);
+        else
+            store.clear();
+    });
+}
+export const getAuth = ((app) => {
+    const resolved = app ?? getApp();
+    if (!useWorker) {
+        const handle = pyricGetAuth(resolved);
+        wireAppPersistence(resolved, handle);
+        return handle;
+    }
+    const existing = workerAuthByApp.get(resolved);
+    if (existing)
+        return existing;
+    const client = workerClientForApp(resolved);
+    const handle = Object.assign(wc.getAuth(client), {
+        app: resolved,
+    });
+    workerAuthByApp.set(resolved, handle);
+    wireAppPersistence(resolved, handle);
+    return handle;
+});
+/**
+ * Narrow a `Persistence.type` to the three web-storage slots the session store
+ * actually has.
+ *
+ * `'COOKIE'` (upstream's `browserCookiePersistence`, for SSR) is the fourth
+ * member of the union and has no slot of its own here. It maps to `'LOCAL'`:
+ * both are long-lived session storage, and the distinction is invisible to
+ * consumer code once the session is restored either way. The alternative —
+ * widening SessionMode — would add a storage backend the serve layer does not
+ * have.
+ */
+function toSessionMode(type) {
+    return type === 'COOKIE' ? 'LOCAL' : type;
+}
+/** `setPersistence`: selects which web storage holds THIS TAB's session (and
+ *  migrates the current one). On the worker path the record is still client-
+ *  side (#754 — per-port sessions restore via `auth.restorePortSession`); the
+ *  RPC just keeps the worker's surface-parity mode in sync. */
+export const setPersistence = (useWorker
+    ? (async (auth, persistence) => {
+        sessionStoreForApp(auth.app ?? getApp()).setMode(toSessionMode(persistence.type));
+        return wc.setPersistence(auth, persistence);
+    })
+    : async (auth, persistence) => {
+        sessionStoreForApp(auth.app ?? getApp()).setMode(toSessionMode(persistence.type));
+        return pyricSetPersistence(auth, persistence);
+    });
+// ── Provider sign-in (popup/redirect) — the in-page→worker bridge ─────────
+/**
+ * Resolve a provider identity through the backend-free ServeAuthHelper, then
+ * hand it to the worker. The
+ * helper seeds `{ sub, ...claims }` into the resolved credential's token, so we
+ * strip `sub` to recover the original custom claims for the worker seed.
+ *
+ * Enforcement lives at the hand-off: `auth.acceptIdentity` gates against the
+ * WORKER's provider config and rejects `auth/operation-not-allowed` for a
+ * disabled provider (matching prod, where the popup opens and the error
+ * surfaces after the interaction).
+ */
+async function bridgeProviderSignIn(auth, provider, kind) {
+    const providerId = provider.providerId ?? 'oidc';
+    const cred = await resolveServeAuthFlow({ providerId, authType: 'signIn' }, kind);
+    const tokenResult = await cred.user.getIdTokenResult();
+    const { sub: _sub, ...customClaims } = (tokenResult.claims ?? {});
+    return acceptProviderCredential(auth, {
+        uid: cred.user.uid,
+        email: cred.user.email,
+        displayName: cred.user.displayName,
+        customClaims,
+        providerId,
+    });
+}
+export const signInWithPopup = (useWorker
+    ? (auth, provider) => bridgeProviderSignIn(auth, provider, 'popup')
+    : ipAuth.signInWithPopup);
+/**
+ * `signInWithRedirect` over the worker resolves like popup — the pyric
+ * emulator helper does not actually navigate, so the identity is picked + the
+ * worker signs in immediately. The result is delivered through the sign-in +
+ * `onAuthStateChanged`; `getRedirectResult` returns null on the worker path
+ * (there is no deferred post-navigation result to replay). v1 behavior.
+ */
+export const signInWithRedirect = (useWorker
+    ? (auth, provider) => bridgeProviderSignIn(auth, provider, 'redirect')
+    : ipAuth.signInWithRedirect);
+export const getRedirectResult = (useWorker
+    ? async (_auth) => null
+    : ipAuth.getRedirectResult);
+/** Direct credential sign-in: unsupported over the worker in v1 (the
+ *  worker-client rejects with a clear error); in-page passes through. */
+export const signInWithCredential = (useWorker ? wc.signInWithCredential : ipAuth.signInWithCredential);
+// ── Low-hanging-fruit exports (issue #149) ────────────────────────────────
+function unsupportedWorkerAuthApi(name) {
+    throw new Error(`firebase/auth ${name}() is not supported over the pyric SharedWorker yet. ` +
+        'Use the in-page fallback for this operation.');
+}
+/** `initializeAuth(app, deps?)` — aliases the picked `getAuth` (worker- or
+ *  in-page-backed). Path-independent: `deps` is accepted for parity, ignored. */
+export const initializeAuth = ((app, _deps) => getAuth(app));
+/** `useDeviceLanguage(auth)` — accepted no-op (no device locale in the served
+ *  sandbox). Path-independent. */
+export const useDeviceLanguage = ((_auth) => { });
+// User-mutation ops act on a `User` object. In-page they route through the
+// sandbox User's dispatch hook; over the SharedWorker the client has no
+// client-facing binding for them yet, so worker mode throws the standard
+// "use the in-page fallback" error (mirrors the RTDB entry's unsupported ops).
+export const deleteUser = (useWorker ? (() => unsupportedWorkerAuthApi('deleteUser')) : ipAuth.deleteUser);
+export const updateEmail = (useWorker ? (() => unsupportedWorkerAuthApi('updateEmail')) : ipAuth.updateEmail);
+export const updatePassword = (useWorker ? (() => unsupportedWorkerAuthApi('updatePassword')) : ipAuth.updatePassword);
+export const reload = (useWorker ? (() => unsupportedWorkerAuthApi('reload')) : ipAuth.reload);
+export const updateCurrentUser = (useWorker ? (() => unsupportedWorkerAuthApi('updateCurrentUser')) : ipAuth.updateCurrentUser);
+//# sourceMappingURL=auth.js.map

package/dist/serve/entries/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/serve/entries/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,cAAc,IAAI,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,MAAM,EAAoB,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,EAAE,GAAG,KAAiC,CAAC;AAE7C,gEAAgE;AAChE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAClC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,CAAC;AACnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,sBAAsB,CAAC;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,0BAA0B,CAAC;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,8BAA8B,CAAC;AAC/E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAgC,CAAC;AAElH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;AAClD,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,CAAC;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;AAE9D,+EAA+E;AAC/E,MAAM,eAAe,GAAG,IAAI,OAAO,EAAgD,CAAC;AACpF,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAe,CAAC;AAEpD,SAAS,kBAAkB,CACzB,GAAgB,EAChB,IAAqC;IAErC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IACtC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,0EAA0E;QAC1E,wEAAwE;QACxE,KAAK,kBAAkB,CAAC,IAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/D,IAAI,CAAC,IAAI;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IACD,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QAClC,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAC1B,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAiB,EAAE,EAAE;IAC5C,MAAM,QAAQ,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC;IACjC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAe,CAAC,EAAE;QACxD,GAAG,EAAE,QAAQ;KACd,CAA+C,CAAC;IACjD,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAwB,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,IAA6C;IAClE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;+DAG+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAS;IACP,CAAC,CAAC,CAAC,KAAK,EACJ,IAA+C,EAC/C,WAAsD,EACtD,EAAE;QACF,kBAAkB,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,OAAQ,EAAE,CAAC,cAA6C,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC;IACJ,CAAC,CAAC,KAAK,EACH,IAA+C,EAC/C,WAAsD,EACtD,EAAE;QACF,kBAAkB,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,OAAO,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC,CACwB,CAAC;AAEhC,6EAA6E;AAE7E;;;;;;;;;;GAUG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkD,EAClD,QAAsD,EACtD,IAA0B;IAE1B,MAAM,UAAU,GAAI,QAAoC,CAAC,UAAU,IAAI,MAAM,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACrC,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAClC,IAAI,CACL,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACvD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IAC7F,OAAO,wBAAwB,CAAC,IAAa,EAAE;QAC7C,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;QAClB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;QACtB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;QAClC,YAAY;QACZ,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,SAAS;IACP,CAAC,CAAC,CAAC,IAAkD,EAAE,QAAsD,EAAE,EAAE,CAC7G,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;IACjD,CAAC,CAAC,MAAM,CAAC,eAAe,CACM,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAAS;IACP,CAAC,CAAC,CAAC,IAAqD,EAAE,QAAyD,EAAE,EAAE,CACnH,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;IACpD,CAAC,CAAC,MAAM,CAAC,kBAAkB,CACM,CAAC;AAEtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,SAAS;IACP,CAAC,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE,CAAC,IAAI;IACjC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACM,CAAC;AAErC;yEACyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAC5B,CAAC;AAExC,6EAA6E;AAE7E,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,uDAAuD;QAC1E,8CAA8C,CACjD,CAAC;AACJ,CAAC;AAED;iFACiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,GAAa,EAAE,KAAe,EAAE,EAAE,CAChE,OAAO,CAAC,GAAY,CAAC,CAAiC,CAAC;AAEzD;kCACkC;AAClC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAe,EAAE,EAAE,GAAE,CAAC,CAAoC,CAAC;AAE9F,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CACnD,CAAC;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CACpD,CAAC;AAC/B,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CACvD,CAAC;AAClC,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAC/C,CAAC;AAC1B,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAC1D,CAAC"}

package/dist/serve/entries/bridge-url.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Re-anchor a bridge WebSocket URL to the page's own origin.
+ *
+ * `pyric dev` / the vite plugin bake their OWN host into the bridge URL it
+ * sends the page (e.g. `ws://localhost:5173/__pyric/sandbox`). But the page may
+ * have been loaded over a different host (Tailscale, a LAN IP) or scheme
+ * (`https` via `tailscale serve`, which then requires `wss`). Connecting to the
+ * baked `localhost` from a remote tab dials the WRONG machine (the client's own
+ * localhost), so the WS fails.
+ *
+ * Keep only the PATH from the server's URL and rebuild the scheme + host from the
+ * page's `location`. The bridge is always mounted on the same server that served
+ * the page, so the page's origin is the correct target wherever it is reached,
+ * with no plugin configuration. This also sidesteps the localhost / 127.0.0.1 /
+ * ::1 family ambiguity, because the browser dials the exact host it loaded from.
+ *
+ * Pure (location is injected) so it is unit-testable. Returns `raw` unchanged if
+ * it cannot be parsed.
+ */
+export declare function toPageOriginWsUrl(raw: string, loc: {
+    href: string;
+    protocol: string;
+    host: string;
+}): string;
+//# sourceMappingURL=bridge-url.d.ts.map

package/dist/serve/entries/bridge-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-url.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/bridge-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpD,MAAM,CAQR"}

package/dist/serve/entries/bridge-url.js

@@ -0,0 +1,30 @@
+/**
+ * Re-anchor a bridge WebSocket URL to the page's own origin.
+ *
+ * `pyric dev` / the vite plugin bake their OWN host into the bridge URL it
+ * sends the page (e.g. `ws://localhost:5173/__pyric/sandbox`). But the page may
+ * have been loaded over a different host (Tailscale, a LAN IP) or scheme
+ * (`https` via `tailscale serve`, which then requires `wss`). Connecting to the
+ * baked `localhost` from a remote tab dials the WRONG machine (the client's own
+ * localhost), so the WS fails.
+ *
+ * Keep only the PATH from the server's URL and rebuild the scheme + host from the
+ * page's `location`. The bridge is always mounted on the same server that served
+ * the page, so the page's origin is the correct target wherever it is reached,
+ * with no plugin configuration. This also sidesteps the localhost / 127.0.0.1 /
+ * ::1 family ambiguity, because the browser dials the exact host it loaded from.
+ *
+ * Pure (location is injected) so it is unit-testable. Returns `raw` unchanged if
+ * it cannot be parsed.
+ */
+export function toPageOriginWsUrl(raw, loc) {
+    try {
+        const path = new URL(raw, loc.href).pathname;
+        const scheme = loc.protocol === 'https:' ? 'wss:' : 'ws:';
+        return `${scheme}//${loc.host}${path}`;
+    }
+    catch {
+        return raw;
+    }
+}
+//# sourceMappingURL=bridge-url.js.map

package/dist/serve/entries/bridge-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-url.js","sourceRoot":"","sources":["../../../src/serve/entries/bridge-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,GAAqD;IAErD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,OAAO,GAAG,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/serve/entries/database.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The bundle the import map serves for `firebase/database`.
+ *
+ * The SharedWorker client already carries the RTDB data-plane used by Studio
+ * and the Playground. This entry gives served apps the same common modular SDK
+ * surface while the in-page fallback delegates to `pyric/database`.
+ */
+import * as ip from 'pyric/database';
+import { getDatabase as pyricGetDatabase } from 'pyric/database';
+export declare const getDatabase: typeof pyricGetDatabase;
+export declare const ref: typeof ip.ref;
+export declare const child: typeof ip.child;
+export declare const get: typeof ip.get;
+export declare const set: typeof ip.set;
+export declare const update: typeof ip.update;
+export declare const remove: typeof ip.remove;
+export declare const push: typeof ip.push;
+export declare const onValue: typeof ip.onValue;
+export declare const off: typeof ip.off;
+export declare const serverTimestamp: typeof ip.serverTimestamp;
+export declare const connectDatabaseEmulator: typeof ip.connectDatabaseEmulator;
+export declare const goOffline: typeof ip.goOffline;
+export declare const goOnline: typeof ip.goOnline;
+export declare const forceLongPolling: typeof ip.forceLongPolling;
+export declare const forceWebSockets: typeof ip.forceWebSockets;
+export declare const enableLogging: typeof ip.enableLogging;
+/**
+ * `refFromURL(db, url)` — parse the path out of the URL and delegate to the
+ * picked `ref` (worker or in-page), so the resolved ref behaves exactly like
+ * `ref(db, path)`. The URL host/namespace is not honored (served sandbox is
+ * single-database) — matching the in-page `pyric/database` behavior.
+ */
+export declare const refFromURL: typeof ip.refFromURL;
+export declare const runTransaction: typeof ip.runTransaction;
+export declare const query: typeof ip.query;
+export declare const orderByChild: typeof ip.orderByChild;
+export declare const orderByKey: typeof ip.orderByKey;
+export declare const orderByValue: typeof ip.orderByValue;
+export declare const startAt: typeof ip.startAt;
+export declare const startAfter: typeof ip.startAfter;
+export declare const endAt: typeof ip.endAt;
+export declare const endBefore: typeof ip.endBefore;
+export declare const equalTo: typeof ip.equalTo;
+export declare const limitToFirst: typeof ip.limitToFirst;
+export declare const limitToLast: typeof ip.limitToLast;
+//# sourceMappingURL=database.d.ts.map

package/dist/serve/entries/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/database.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,IAAI,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAqBjE,eAAO,MAAM,WAAW,EASlB,OAAO,gBAAgB,CAAC;AAE9B,eAAO,MAAM,GAAG,EAAqC,OAAO,EAAE,CAAC,GAAG,CAAC;AACnE,eAAO,MAAM,KAAK,EAAyC,OAAO,EAAE,CAAC,KAAK,CAAC;AAC3E,eAAO,MAAM,GAAG,EAAqC,OAAO,EAAE,CAAC,GAAG,CAAC;AACnE,eAAO,MAAM,GAAG,EAAqC,OAAO,EAAE,CAAC,GAAG,CAAC;AACnE,eAAO,MAAM,MAAM,EAA2C,OAAO,EAAE,CAAC,MAAM,CAAC;AAC/E,eAAO,MAAM,MAAM,EAA2C,OAAO,EAAE,CAAC,MAAM,CAAC;AAC/E,eAAO,MAAM,IAAI,EAAuC,OAAO,EAAE,CAAC,IAAI,CAAC;AACvE,eAAO,MAAM,OAAO,EAA6C,OAAO,EAAE,CAAC,OAAO,CAAC;AACnF,eAAO,MAAM,GAAG,EAAqC,OAAO,EAAE,CAAC,GAAG,CAAC;AACnE,eAAO,MAAM,eAAe,EAEvB,OAAO,EAAE,CAAC,eAAe,CAAC;AAC/B,eAAO,MAAM,uBAAuB,EAE/B,OAAO,EAAE,CAAC,uBAAuB,CAAC;AAOvC,eAAO,MAAM,SAAS,EAA8B,OAAO,EAAE,CAAC,SAAS,CAAC;AACxE,eAAO,MAAM,QAAQ,EAA8B,OAAO,EAAE,CAAC,QAAQ,CAAC;AACtE,eAAO,MAAM,gBAAgB,EAAiB,OAAO,EAAE,CAAC,gBAAgB,CAAC;AACzE,eAAO,MAAM,eAAe,EAAiB,OAAO,EAAE,CAAC,eAAe,CAAC;AACvE,eAAO,MAAM,aAAa,EAAyD,OAAO,EAAE,CAAC,aAAa,CAAC;AAE3G;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAUjB,OAAO,EAAE,CAAC,UAAU,CAAC;AAS3B,eAAO,MAAM,cAAc,EAEtB,OAAO,EAAE,CAAC,cAAc,CAAC;AAE9B,eAAO,MAAM,KAAK,EAEb,OAAO,EAAE,CAAC,KAAK,CAAC;AACrB,eAAO,MAAM,YAAY,EAEpB,OAAO,EAAE,CAAC,YAAY,CAAC;AAC5B,eAAO,MAAM,UAAU,EAElB,OAAO,EAAE,CAAC,UAAU,CAAC;AAC1B,eAAO,MAAM,YAAY,EAEpB,OAAO,EAAE,CAAC,YAAY,CAAC;AAC5B,eAAO,MAAM,OAAO,EAEf,OAAO,EAAE,CAAC,OAAO,CAAC;AACvB,eAAO,MAAM,UAAU,EAElB,OAAO,EAAE,CAAC,UAAU,CAAC;AAC1B,eAAO,MAAM,KAAK,EAEb,OAAO,EAAE,CAAC,KAAK,CAAC;AACrB,eAAO,MAAM,SAAS,EAEjB,OAAO,EAAE,CAAC,SAAS,CAAC;AACzB,eAAO,MAAM,OAAO,EAEf,OAAO,EAAE,CAAC,OAAO,CAAC;AACvB,eAAO,MAAM,YAAY,EAEpB,OAAO,EAAE,CAAC,YAAY,CAAC;AAC5B,eAAO,MAAM,WAAW,EAEnB,OAAO,EAAE,CAAC,WAAW,CAAC"}