@pyric/cli 0.1.0-alpha.9

package/dist/serve/worker/host/core.js

@@ -0,0 +1,296 @@
+/**
+ * SharedWorker host — shared resolution layer (host/core.ts).
+ *
+ * The helpers every firestore-touching family module leans on:
+ *   - the auth-lens → live-handle resolvers (`lensDb`/`lensRtdb`/`sessionDb`/…),
+ *     the single place a per-op `actAs` lens or a port session becomes a live
+ *     Firestore/RTDB handle;
+ *   - descriptor → live ref/query resolution (`resolveTarget`/`resolveConstraint`),
+ *     used by both the read ops and the subscription handlers;
+ *   - cross-port snapshot serialization (`serializeDocSnap`);
+ *   - `opProvenance`, the issue-time provenance both the ambient-provenance
+ *     window (dispatch) and the storage ops (explicit thread) read.
+ *
+ * Genuinely-shared STATE lives on `HostCtx` (host-context.ts) — the dependency
+ * root. This module adds the shared FUNCTIONS that resolve against that state;
+ * it imports the pyric firestore/database engine, so it is deliberately kept
+ * out of host-context.ts (which stays engine-free).
+ */
+import { getFirestore as pyricGetFirestore, getAdminFirestore as pyricGetAdminFirestore, doc as pyricDoc, collection as pyricCollection, collectionGroup as pyricCollectionGroup, query as pyricQuery, where as pyricWhere, and as pyricAnd, or as pyricOr, orderBy as pyricOrderBy, limit as pyricLimit, limitToLast as pyricLimitToLast, startAt as pyricStartAt, startAfter as pyricStartAfter, endAt as pyricEndAt, endBefore as pyricEndBefore, } from 'pyric/firestore';
+import { rehydrateDocValue } from 'pyric/firestore-values';
+import { getDatabase as pyricGetDatabase, getAdminDatabase as pyricGetAdminDatabase, } from 'pyric/database';
+import { serializeDocData } from '../protocol.js';
+import { portSession } from '../host-auth.js';
+// ─── Descriptor → live ref resolution ───────────────────────────────────
+/**
+ * Resolve a TargetDescriptor into a live pyric ref or query.
+ *
+ * WHY WE RESOLVE ON THE WORKER
+ * The client never holds live pyric refs — it holds plain `DocRef`/
+ * `CollRef`/`GroupRef`/`QueryDescriptor` objects that serialize cleanly
+ * across the MessagePort. On every op the worker rebuilds the live ref
+ * from these descriptors. This keeps the client completely stateless with
+ * respect to sandbox internals and makes retries trivially correct.
+ */
+export function resolveTarget(db, target) {
+    if (target.__ref === 'doc') {
+        return pyricDoc(db, target.path);
+    }
+    if (target.__ref === 'collection') {
+        return pyricCollection(db, target.path);
+    }
+    if (target.__ref === 'group') {
+        return pyricCollectionGroup(db, target.collectionId);
+    }
+    // query descriptor
+    const source = resolveTarget(db, target.source);
+    const constraints = target.constraints.map((c) => resolveConstraint(c));
+    return pyricQuery(source, ...constraints);
+}
+function resolveConstraint(c) {
+    switch (c.kind) {
+        case 'where':
+            // Rehydrate the comparison value (same rationale as prepareWriteData,
+            // spike gap 4, applied to READ inputs): over the JSON relay legs a
+            // Node-side Timestamp/Bytes/GeoPoint arrives as its marker shape;
+            // without rehydration the comparison would see a plain map and the
+            // filter would silently mismatch typed stored values.
+            return pyricWhere(c.field, c.op, rehydrateDocValue(c.value));
+        // Composite filters rebuild through the modular `and`/`or` factories,
+        // which validate operands: an empty composite or a nested non-filter
+        // throws the same TypeError the in-page SDK raises (surfaces as an
+        // error res / snap-error, never a crash).
+        case 'and':
+            return pyricAnd(...c.filters.map(resolveConstraint));
+        case 'or':
+            return pyricOr(...c.filters.map(resolveConstraint));
+        case 'orderBy':
+            return pyricOrderBy(c.field, c.direction);
+        case 'limit':
+            return pyricLimit(c.n);
+        case 'limitToLast':
+            return pyricLimitToLast(c.n);
+        // Cursor values rehydrate for the same reason as `where` values —
+        // `startAfter(<timestamp>)` must position against real Timestamps.
+        case 'startAt':
+            return pyricStartAt(...c.values.map(rehydrateDocValue));
+        case 'startAfter':
+            return pyricStartAfter(...c.values.map(rehydrateDocValue));
+        case 'endAt':
+            return pyricEndAt(...c.values.map(rehydrateDocValue));
+        case 'endBefore':
+            return pyricEndBefore(...c.values.map(rehydrateDocValue));
+    }
+}
+// ─── Snapshot serialization ───────────────────────────────────────────────
+/**
+ * Serialize a document snapshot to cross-port form.
+ * Uses JSON-via-serializeDocData so Timestamp/Bytes/LatLng survive.
+ */
+export function serializeDocSnap(snap) {
+    const existsBool = typeof snap.exists === 'function' ? snap.exists() : snap.exists;
+    const data = existsBool ? snap.data() : undefined;
+    return {
+        id: snap.id,
+        // Doc snapshots carry a top-level `path`; QUERY doc snapshots carry it on
+        // `.ref.path`. Read both so query rows serialize their FULL path (Studio's
+        // browse resolves the document detail from it).
+        path: snap.path ?? snap.ref?.path,
+        exists: existsBool,
+        data: data ? serializeDocData(data) : undefined,
+    };
+}
+// ─── Auth lens (Pyric Studio) ─────────────────────────────────────────────
+/**
+ * Resolve the Firestore handle an op runs against, given its `actAs` lens
+ * (Pyric Studio auth lens, T2 — implements the C2 protocol seam).
+ *
+ * Resolution by `actAs.mode` (absent ⇒ the app's session):
+ *
+ *   - `app-session` (and `actAs` absent): `ctx.db` — the shared sandbox-live
+ *     handle. Reads `sandbox.currentUser` per op, so rules evaluate under
+ *     whoever the served app is signed in as. This is the unchanged default
+ *     and the ONLY lens the app itself ever uses.
+ *
+ *   - `{ mode: 'as', uid }` (impersonation — the rules-debugging primitive):
+ *     a FROZEN-identity `getFirestore(sandbox.withAuth({ uid }))` handle.
+ *     Security rules APPLY and evaluate as that user — `request.auth.uid`
+ *     resolves to `uid`. This lets Studio "re-run this denied op as the user
+ *     who attempted it" (Wave-2 rules-debugging, F4). Handles are cached
+ *     per-uid on `ctx.lensHandles`.
+ *
+ *   - `{ mode: 'admin' }` (rule bypass): a modular `getAdminFirestore(sandbox)`
+ *     handle (pyric Gap #2) whose ops skip security-rule evaluation while still
+ *     reading/writing the same store and emitting events. This is Studio's
+ *     "edit anything as admin" surface (F2). Cached on `ctx.adminDb`.
+ *
+ *   - `{ mode: 'anon' }` (explicitly unauthenticated): a frozen
+ *     `getFirestore(sandbox.withAuth(null))` handle — rules apply with
+ *     `request.auth == null`. The remote arm's `withAuth(null)`; distinct from
+ *     an ABSENT lens, which resolves to the port's session. Cached on
+ *     `ctx.anonDb`.
+ *
+ * WRITE-IMPERSONATION GATING (open micro-decision #1, honoured): the resolver
+ * itself is symmetric — an `{ mode: 'as', uid }` lens applies to BOTH reads and
+ * writes (a write-as-user is denied/allowed exactly as that user's rules say).
+ * The POLICY decision — "read-as-user always; write-as-user only on an explicit
+ * reproduce path" — is enforced at the CALLER (the Studio client / UI chooses
+ * when to attach a write op's `actAs`), NOT here. Default behaviour stays admin/
+ * app-session unless a caller sets `actAs`; no UI is added by T2.
+ */
+export function lensDb(ctx, actAs) {
+    // Absent / app-session → the app's live session handle.
+    if (!actAs || actAs.mode === 'app-session') {
+        return ctx.db;
+    }
+    // { mode: 'admin' } → a modular rules-bypass handle (cached per ctx).
+    if (actAs.mode === 'admin') {
+        return (ctx.adminDb ??= pyricGetAdminFirestore(ctx.sandbox));
+    }
+    // { mode: 'anon' } → a genuinely UNAUTHENTICATED handle
+    // (`withAuth(null)` — `request.auth == null` in rules). NOT the same as an
+    // absent lens, which resolves to the PORT'S SESSION: a relayed op that
+    // means "no auth" must pin this lens or it silently runs as whoever the
+    // browser tab is signed in as.
+    if (actAs.mode === 'anon') {
+        return (ctx.anonDb ??= pyricGetFirestore(ctx.sandbox.withAuth(null)));
+    }
+    // { mode: 'as', uid } → a frozen-identity handle; rules evaluate as `uid`.
+    const handles = (ctx.lensHandles ??= new Map());
+    const key = lensCacheKey(actAs);
+    let handle = handles.get(key);
+    if (!handle) {
+        handle = pyricGetFirestore(ctx.sandbox.withAuth(authStateForLens(actAs)));
+        handles.set(key, handle);
+    }
+    return handle;
+}
+export function authStateForLens(actAs) {
+    return actAs.token === undefined
+        ? { uid: actAs.uid }
+        : { uid: actAs.uid, token: actAs.token };
+}
+export function lensCacheKey(actAs) {
+    return actAs.token === undefined
+        ? actAs.uid
+        : `${actAs.uid}:${JSON.stringify(actAs.token)}`;
+}
+/** Cache key for a real port session; claims are part of authorization identity. */
+export function sessionCacheKey(session) {
+    return session.state.token === undefined
+        ? session.user.uid
+        : `${session.user.uid}:${JSON.stringify(session.state.token)}`;
+}
+/**
+ * Normalise a per-op `actAs` lens to the {@link AuthLens} provenance shape that
+ * the unified sandbox event stream stamps on each event's `authLens` field.
+ *
+ * Absent ⇒ `{ mode: 'app-session' }` (the app's own session) — matching how
+ * `EventProvenance.authLens` reads when omitted. C1 added the field to events;
+ * T1 owns the EMIT path that actually writes it. T2's job is to thread the lens
+ * THROUGH the host so T1 has the value at emit time: see the call in `handleOp`
+ * where the resolved lens is passed to the sandbox via `withLens` when that
+ * emit seam exists. Today the sandbox event emitters infer `authLens` from the
+ * acting identity (the impersonation handle's frozen `auth` is `{ uid }`, so a
+ * rules eval already carries that uid); this helper exists so the host has a
+ * single canonical normaliser when the explicit emit-time stamp lands.
+ */
+export function lensProvenance(actAs) {
+    return actAs ?? { mode: 'app-session' };
+}
+/**
+ * Resolve the data handle for an op/sub carrying NO explicit lens: the
+ * PORT'S SESSION (#754). A signed-in port gets a per-session-token cached
+ * `getFirestore(sandbox.withAuth(session.state))` handle — rules evaluate
+ * under its uid + custom claims, exactly like a globally signed-in user. A
+ * signed-out port falls back to `ctx.db` (sandbox-live; `currentUser` is
+ * never set in served mode, so that is the unauthenticated view).
+ *
+ * This is NOT the impersonation lens: the session was minted by validated
+ * sign-in on this port (`sandbox.mintSession`), so both reads and writes
+ * legitimately run as that user — the write-impersonation gate on the
+ * Studio `as` lens does not apply to a port's own session.
+ *
+ * Claim changes become visible when the client forces an ID-token refresh;
+ * host-auth updates the port session, clears all session-bound service
+ * caches, and re-establishes that port's listeners under the new token.
+ */
+export function sessionDb(ctx, port) {
+    const session = portSession(ctx, port);
+    if (!session)
+        return ctx.db;
+    const cache = (ctx.sessionDbs ??= new Map());
+    const key = sessionCacheKey(session);
+    let handle = cache.get(key);
+    if (!handle) {
+        handle = pyricGetFirestore(ctx.sandbox.withAuth(session.state));
+        cache.set(key, handle);
+    }
+    return handle;
+}
+function sessionRtdb(ctx, port) {
+    const session = portSession(ctx, port);
+    if (!session)
+        return ensureRtdb(ctx);
+    const cache = (ctx.sessionRtdbs ??= new Map());
+    const key = sessionCacheKey(session);
+    let handle = cache.get(key);
+    if (!handle) {
+        handle = pyricGetDatabase(ctx.sandbox.withAuth(session.state));
+        cache.set(key, handle);
+    }
+    return handle;
+}
+export function lensRtdb(ctx, actAs, port) {
+    if (!actAs || actAs.mode === 'app-session') {
+        return sessionRtdb(ctx, port);
+    }
+    if (actAs.mode === 'admin') {
+        return (ctx.adminRtdb ??= pyricGetAdminDatabase(ctx.sandbox));
+    }
+    // Genuinely unauthenticated — see the `anon` note on lensDb.
+    if (actAs.mode === 'anon') {
+        return (ctx.anonRtdb ??= pyricGetDatabase(ctx.sandbox.withAuth(null)));
+    }
+    const handles = (ctx.lensRtdbs ??= new Map());
+    const key = lensCacheKey(actAs);
+    let handle = handles.get(key);
+    if (!handle) {
+        handle = pyricGetDatabase(ctx.sandbox.withAuth(authStateForLens(actAs)));
+        handles.set(key, handle);
+    }
+    return handle;
+}
+export function ensureRtdb(ctx) {
+    return (ctx.rtdb ??= pyricGetDatabase(ctx.sandbox));
+}
+// ─── Op provenance ─────────────────────────────────────────────────────────
+/**
+ * Op provenance from an inbound message, bound at ISSUE time. This is the
+ * source of truth for both the synchronous ambient window used by immediate
+ * emitters and the operation-scoped Storage handle used across awaits.
+ *
+ *   - `actor`: a client that DECLARED itself the issuer (`issuer: 'studio'`,
+ *     stamped by Studio's worker client — `setOpIssuer` in client.ts) gets
+ *     `actor: { kind: 'studio' }`. Bridge-relayed frames are forwarded
+ *     verbatim without the stamp (client.ts `relayWorkerOp`), so remote
+ *     admin/agent traffic is never mislabeled as Studio's.
+ *   - `authLens`: the op's EFFECTIVE lens (`msg.actAs`) whenever present —
+ *     independent of issuer, because admin is admin regardless of who asked
+ *     (an agent tool relay's admin op must classify as a rules BYPASS in
+ *     Traffic, not a rules allow).
+ *
+ * Returns `undefined` for a plain served-app op (no issuer, no lens); its
+ * app source and app-session lens come from the service handle itself.
+ */
+export function opProvenance(msg) {
+    const issuer = msg.issuer;
+    const actAs = msg.actAs;
+    if (issuer !== 'studio' && !actAs)
+        return undefined;
+    return {
+        ...(issuer === 'studio' ? { actor: { kind: 'studio' } } : {}),
+        ...(actAs ? { authLens: actAs } : {}),
+    };
+}
+//# sourceMappingURL=core.js.map

package/dist/serve/worker/host/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../../src/serve/worker/host/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,YAAY,IAAI,iBAAiB,EACjC,iBAAiB,IAAI,sBAAsB,EAC3C,GAAG,IAAI,QAAQ,EACf,UAAU,IAAI,eAAe,EAC7B,eAAe,IAAI,oBAAoB,EACvC,KAAK,IAAI,UAAU,EACnB,KAAK,IAAI,UAAU,EACnB,GAAG,IAAI,QAAQ,EACf,EAAE,IAAI,OAAO,EACb,OAAO,IAAI,YAAY,EACvB,KAAK,IAAI,UAAU,EACnB,WAAW,IAAI,gBAAgB,EAC/B,OAAO,IAAI,YAAY,EACvB,UAAU,IAAI,eAAe,EAC7B,KAAK,IAAI,UAAU,EACnB,SAAS,IAAI,cAAc,GAK5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,WAAW,IAAI,gBAAgB,EAC/B,gBAAgB,IAAI,qBAAqB,GAE1C,MAAM,gBAAgB,CAAC;AASxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,2EAA2E;AAE3E;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,EAAa,EACb,MAAwB;IAExB,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC;IACD,mBAAmB;IACnB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAgC,CAAC;IAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,UAAU,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,iBAAiB,CAAC,CAA4B;IACrD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,OAAO;YACV,sEAAsE;YACtE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,sDAAsD;YACtD,OAAO,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAsC,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACnG,sEAAsE;QACtE,qEAAqE;QACrE,mEAAmE;QACnE,0CAA0C;QAC1C,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvD,KAAK,IAAI;YACP,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACtD,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,KAAK,OAAO;YACV,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,KAAK,aAAa;YAChB,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,kEAAkE;QAClE,mEAAmE;QACnE,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC1D,KAAK,YAAY;YACf,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7D,KAAK,OAAO;YACV,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACxD,KAAK,WAAW;YACd,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,6EAA6E;AAE7E;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAMhC;IACC,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IACnF,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,0EAA0E;QAC1E,2EAA2E;QAC3E,gDAAgD;QAChD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI;QACjC,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAChD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,UAAU,MAAM,CAAC,GAAY,EAAE,KAAgB;IACnD,wDAAwD;IACxD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3C,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAED,sEAAsE;IACtE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,wDAAwD;IACxD,2EAA2E;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,+BAA+B;IAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,2EAA2E;IAC3E,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAwC;IACvE,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS;QAC9B,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;QACpB,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAwC;IACnE,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS;QAC9B,CAAC,CAAC,KAAK,CAAC,GAAG;QACX,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,OAAsB;IACpD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS;QACtC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;QAClB,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,OAAO,KAAK,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,SAAS,CAAC,GAAY,EAAE,IAAc;IACpD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,IAAc;IAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAY,EAAE,KAA2B,EAAE,IAAc;IAChF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3C,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,6DAA6D;IAC7D,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAmB;IAC9C,MAAM,MAAM,GAAI,GAA6B,CAAC,MAAM,CAAC;IACrD,MAAM,KAAK,GAAI,GAA4B,CAAC,KAAK,CAAC;IAClD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO;QACL,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC"}

package/dist/serve/worker/host/dispatch.d.ts

@@ -0,0 +1,34 @@
+/**
+ * SharedWorker host — the message dispatcher + port cleanup.
+ *
+ * The top of the host: `handleMessage` opens the op's ambient-provenance
+ * window and hands to `dispatchMessage`, which peels off the auth / AI /
+ * messaging / event families (their sibling `host-*.ts` modules), then routes
+ * ops to `handleOp` (the firestore/rules/admin/rtdb/storage/connection/studio
+ * orchestrator) and subs to the subscription registry. `cleanupPort` tears a
+ * disconnected port's per-subsystem state down.
+ *
+ * `handleOp` resolves the op's Firestore handle ONCE (the `db`/`lens`
+ * preamble) — the eager lens/session resolution every op sees — then dispatches
+ * to the per-family `handle*Op` handlers. This is the single unit-testable seam:
+ * tests build a real `HostCtx` over an in-memory sandbox and call
+ * `handleMessage` directly with fake ports.
+ */
+import type { InboundMessage } from '../protocol.js';
+import { type HostCtx, type PortLike } from '../host-context.js';
+/**
+ * Handle one inbound message from a port.
+ *
+ * This is the primary unit-testable seam. Tests create a real `HostCtx`
+ * backed by an in-memory pyric sandbox and call this function directly
+ * with fake port objects, exercising the full op+subscription lifecycle
+ * without a real SharedWorker.
+ */
+export declare function handleMessage(ctx: HostCtx, port: PortLike, msg: InboundMessage): Promise<void>;
+/**
+ * Tear down all subscriptions for a disconnected port.
+ * Called when a port's `close` event fires (browser best-effort) or
+ * when the entry point explicitly cleans up a port.
+ */
+export declare function cleanupPort(ctx: HostCtx, port: PortLike): void;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/serve/worker/host/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/host/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,cAAc,EAA0B,MAAM,gBAAgB,CAAC;AAe7E,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAY,MAAM,oBAAoB,CAAC;AA8G3E;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AA4DD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,CAwC9D"}

package/dist/serve/worker/host/dispatch.js

@@ -0,0 +1,267 @@
+/**
+ * SharedWorker host — the message dispatcher + port cleanup.
+ *
+ * The top of the host: `handleMessage` opens the op's ambient-provenance
+ * window and hands to `dispatchMessage`, which peels off the auth / AI /
+ * messaging / event families (their sibling `host-*.ts` modules), then routes
+ * ops to `handleOp` (the firestore/rules/admin/rtdb/storage/connection/studio
+ * orchestrator) and subs to the subscription registry. `cleanupPort` tears a
+ * disconnected port's per-subsystem state down.
+ *
+ * `handleOp` resolves the op's Firestore handle ONCE (the `db`/`lens`
+ * preamble) — the eager lens/session resolution every op sees — then dispatches
+ * to the per-family `handle*Op` handlers. This is the single unit-testable seam:
+ * tests build a real `HostCtx` over an in-memory sandbox and call
+ * `handleMessage` directly with fake ports.
+ */
+import { isAuthSub, isEventSub, isRtdbSub, isAiSub, isMessagingSub, isPresenceSub, } from '../protocol.js';
+// The canonical agent tool dispatcher — reused on the worker so a bridged agent
+// executes against THIS sandbox (one backend for app + Studio + agent), instead
+// of a separate in-page sandbox.
+import { buildSandboxDispatcher } from '../../../bridge/client/dispatch.js';
+import { firebaseOptionsEqual } from 'pyric/app/internal';
+import { ok, fail } from '../host-context.js';
+import { authSubsFor, isAuthOp, handleAuthOp, handleAuthSub, handleAuthUnsub, cleanupPortSession, } from '../host-auth.js';
+import { eventSubsFor, handleEventSub, handleEventUnsub, } from '../host-events.js';
+import { isAiOp, handleAiOp, handleAiSub } from '../host-ai.js';
+import { isMessagingOp, handleMessagingOp, handleMessagingSub, cleanupPortMessaging, } from '../host-messaging.js';
+import { lensDb, lensProvenance, sessionDb, opProvenance, } from './core.js';
+import { isFirestoreReadOp, handleFirestoreReadOp } from './firestore-reads.js';
+import { isFirestoreWriteOp, handleFirestoreWriteOp } from './firestore-writes.js';
+import { isRulesOp, handleRulesOp } from './rules.js';
+import { isAdminFirestoreOp, handleAdminFirestoreOp } from './admin-firestore.js';
+import { isRtdbOp, handleRtdbOp } from './rtdb.js';
+import { isStorageOp, handleStorageOp } from './storage.js';
+import { isConnectionOp, handleConnectionOp } from './connection.js';
+import { isStudioOp, handleStudioOp } from './studio.js';
+import { isPresenceOp, handlePresenceOp, handlePresenceSub, handlePresenceUnsub, cleanupPortPresence, } from './presence.js';
+import { handleSub, handleRtdbSub, handleUnsub, dropPortSessionSubs } from './subscriptions.js';
+function configConflictError() {
+    return Object.assign(new Error('Pyric currently supports one Firebase configuration per runtime'), { code: 'app/multiple-configs-not-supported' });
+}
+// ─── Op orchestrator ────────────────────────────────────────────────────────
+async function handleOp(ctx, port, msg) {
+    // Explicit lens (Studio admin / as / app-session) → lensDb; no lens → the
+    // PORT'S SESSION (#754), so app ops run as whoever this tab signed in as.
+    const db = msg.actAs ? lensDb(ctx, msg.actAs) : sessionDb(ctx, port);
+    // Provenance the op runs under. Stamped onto the unified event stream's
+    // `authLens` by the emit path (C1 field / T1 emit). For `{ mode: 'as', uid }`
+    // the resolved `db` already carries `auth: { uid }`, so a rules eval emits
+    // under that identity; `lens` is the canonical normalised value the host
+    // hands forward when the explicit emit-time stamp seam exists (see lensProvenance).
+    const lens = lensProvenance(msg.actAs);
+    void lens;
+    // Firestore reads/writes run against the resolved `db` (lens/session)
+    // computed above; peeled off to their family modules.
+    if (isFirestoreReadOp(msg.method))
+        return handleFirestoreReadOp(ctx, port, msg, db);
+    if (isFirestoreWriteOp(msg.method))
+        return handleFirestoreWriteOp(ctx, port, msg, db);
+    if (isRulesOp(msg.method))
+        return handleRulesOp(ctx, port, msg, db);
+    if (isAdminFirestoreOp(msg.method))
+        return handleAdminFirestoreOp(ctx, port, msg);
+    if (isRtdbOp(msg.method))
+        return handleRtdbOp(ctx, port, msg);
+    if (isStorageOp(msg.method))
+        return handleStorageOp(ctx, port, msg);
+    if (isConnectionOp(msg.method))
+        return handleConnectionOp(ctx, port, msg);
+    if (isStudioOp(msg.method))
+        return handleStudioOp(ctx, port, msg);
+    if (isPresenceOp(msg.method))
+        return handlePresenceOp(ctx, port, msg);
+    // Auth (`auth.*`), AI (`ai.*`), and messaging (`messaging.*`) ops are routed
+    // to their handlers by dispatchMessage BEFORE reaching handleOp, so any
+    // method landing here is genuinely unknown.
+    fail(port, msg.id, new Error(`Unknown method: ${String(msg.method)}`));
+}
+// ─── Main dispatch ────────────────────────────────────────────────────────
+/**
+ * Agent tool-call dispatch. The bridge peer forwards `tool` messages so the
+ * agent runs the canonical sandbox tool set against THIS worker's sandbox (the
+ * same instance the app + Studio use) instead of a separate in-page backend.
+ * Replies with a `res` whose value is the `{ ok, summary, data }` result.
+ */
+async function handleTool(ctx, port, msg) {
+    try {
+        ctx.toolDispatch ??= buildSandboxDispatcher(ctx.sandbox);
+        const result = await ctx.toolDispatch(msg.name, msg.args ?? {});
+        // Pre-serialize via JSON BEFORE the structured-clone hop over the port. Read
+        // results carry real firebase wrapper instances (Timestamp/GeoPoint/Bytes/
+        // VectorValue) whose toJSON() produces the canonical agent-facing shapes.
+        // structuredClone would strip those prototypes (losing toJSON) and post
+        // mangled internals, and would throw DataCloneError on any non-cloneable
+        // field. JSON.stringify here runs toJSON() while the instances are intact and
+        // yields a plain, clone-safe object — matching the in-page path, which
+        // JSON-stringified at the bridge. A serialization error lands in the catch
+        // below, never in postMessage.
+        ok(port, msg.id, JSON.parse(JSON.stringify(result)));
+    }
+    catch (e) {
+        fail(port, msg.id, e);
+    }
+}
+/**
+ * Handle one inbound message from a port.
+ *
+ * This is the primary unit-testable seam. Tests create a real `HostCtx`
+ * backed by an in-memory pyric sandbox and call this function directly
+ * with fake port objects, exercising the full op+subscription lifecycle
+ * without a real SharedWorker.
+ */
+export async function handleMessage(ctx, port, msg) {
+    if (msg.t === 'appConfig') {
+        if (ctx.appOptions === undefined) {
+            ctx.appOptions = structuredClone(msg.options);
+        }
+        else if (!firebaseOptionsEqual(ctx.appOptions, msg.options)) {
+            (ctx.rejectedConfigPorts ??= new WeakSet()).add(port);
+        }
+        return;
+    }
+    // A rejected app port still owns host-side resources until its explicit
+    // disconnect handshake completes. Never swallow that teardown frame.
+    if (ctx.rejectedConfigPorts?.has(port) && msg.t !== 'disconnect') {
+        if (msg.t === 'op' || msg.t === 'tool') {
+            fail(port, msg.id, configConflictError());
+        }
+        else if (msg.t === 'sub' && msg.target !== 'events') {
+            const error = configConflictError();
+            port.postMessage({
+                t: 'snap',
+                subId: msg.subId,
+                value: { __error: { code: error.code, message: error.message } },
+            });
+        }
+        return;
+    }
+    if (ctx.disconnectedPorts?.has(port) && msg.t !== 'disconnect') {
+        if (msg.t === 'op' || msg.t === 'tool') {
+            fail(port, msg.id, Object.assign(new Error('Firebase App was deleted'), { code: 'app/app-deleted' }));
+        }
+        return;
+    }
+    // Op provenance, bound at dispatch by `opProvenance` (see its docs). Opened
+    // as the sandbox's SYNCHRONOUS ambient window so firestore/rtdb/auth emits —
+    // which run inside `dispatchMessage` before any await — pick it up. Storage
+    // ops emit AFTER async awaits, outside this window, so they thread the same
+    // provenance EXPLICITLY instead (see `handleOp`'s storage cases). Without the
+    // lens on admin ops, `verdictFor` mislabeled a rules BYPASS as ALLOW (the
+    // RTDB/Firestore asymmetry the traffic-metrics work flagged).
+    const prov = opProvenance(msg);
+    if (prov && ctx.sandbox.runWithProvenance) {
+        return ctx.sandbox.runWithProvenance(prov, () => dispatchMessage(ctx, port, msg));
+    }
+    return dispatchMessage(ctx, port, msg);
+}
+async function dispatchMessage(ctx, port, msg) {
+    if (msg.t === 'op') {
+        if (isAuthOp(msg.method)) {
+            await handleAuthOp(ctx, port, msg);
+        }
+        else if (isAiOp(msg.method)) {
+            await handleAiOp(ctx, port, msg);
+        }
+        else if (isMessagingOp(msg.method)) {
+            await handleMessagingOp(ctx, port, msg);
+        }
+        else {
+            await handleOp(ctx, port, msg);
+        }
+    }
+    else if (msg.t === 'sub') {
+        if (isAuthSub(msg)) {
+            handleAuthSub(ctx, port, msg);
+        }
+        else if (isEventSub(msg)) {
+            handleEventSub(ctx, port, msg);
+        }
+        else if (isRtdbSub(msg)) {
+            handleRtdbSub(ctx, port, msg);
+        }
+        else if (isAiSub(msg)) {
+            // AI streams are FINITE subs registered in ctx.subs (so `unsub` cancels
+            // them); they auto-unsub on the terminal done/error snap. host-ai.ts.
+            handleAiSub(ctx, port, msg);
+        }
+        else if (isMessagingSub(msg)) {
+            handleMessagingSub(ctx, port, msg);
+        }
+        else if (isPresenceSub(msg)) {
+            handlePresenceSub(ctx, port, msg);
+        }
+        else {
+            handleSub(ctx, port, msg);
+        }
+    }
+    else if (msg.t === 'unsub') {
+        // An unsub may target an auth sub, an event-stream sub, a presence sub, or
+        // a Firestore listener — try the cheap routing registries first, then fall
+        // through to the Firestore listener teardown.
+        if (!handleAuthUnsub(ctx, port, msg.subId) &&
+            !handleEventUnsub(ctx, port, msg.subId) &&
+            !handlePresenceUnsub(ctx, port, msg.subId)) {
+            handleUnsub(ctx, port, msg);
+        }
+    }
+    else if (msg.t === 'disconnect') {
+        try {
+            cleanupPort(ctx, port);
+            ok(port, msg.id, undefined);
+        }
+        catch (error) {
+            fail(port, msg.id, error);
+        }
+    }
+    else if (msg.t === 'tool') {
+        await handleTool(ctx, port, msg);
+    }
+}
+// ─── Port cleanup ─────────────────────────────────────────────────────────
+/**
+ * Tear down all subscriptions for a disconnected port.
+ * Called when a port's `close` event fires (browser best-effort) or
+ * when the entry point explicitly cleans up a port.
+ */
+export function cleanupPort(ctx, port) {
+    (ctx.disconnectedPorts ??= new WeakSet()).add(port);
+    const failures = [];
+    const attempt = (cleanup) => {
+        try {
+            cleanup();
+        }
+        catch (error) {
+            failures.push(error);
+        }
+    };
+    // Drop the port's auth subscriptions (routing entries — no real listener
+    // to tear down), its per-port session, and its session-bound sub records
+    // (#754).
+    attempt(() => { authSubsFor(ctx).delete(port); });
+    attempt(() => { cleanupPortSession(ctx, port); });
+    attempt(() => { dropPortSessionSubs(ctx, port); });
+    // Drop the port's event-stream subscriptions too (also routing entries off
+    // the single shared `sandbox.onEvent` subscription — nothing to unsubscribe,
+    // just stop fanning out to a dead port).
+    attempt(() => { eventSubsFor(ctx).delete(port); });
+    // Drop the port's messaging broker client so a closed tab's last-reported
+    // visibility stops feeding the routing rule. Its delivery-handler unsubs
+    // live in `ctx.subs` and are torn down with the loop below.
+    attempt(() => { cleanupPortMessaging(ctx, port); });
+    // Presence: best-effort remove this port's logical client when it was the
+    // last association (lease expiry remains the correctness path).
+    attempt(() => { cleanupPortPresence(ctx, port); });
+    const portSubs = ctx.subs.get(port);
+    if (portSubs) {
+        for (const unsub of portSubs.values())
+            attempt(unsub);
+        ctx.subs.delete(port);
+    }
+    if (failures.length === 1)
+        throw failures[0];
+    if (failures.length > 1) {
+        throw new AggregateError(failures, 'Multiple SharedWorker port resources failed to tear down');
+    }
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/serve/worker/host/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../../src/serve/worker/host/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,OAAO,EACP,cAAc,EACd,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,gFAAgF;AAChF,gFAAgF;AAChF,iCAAiC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAA+B,EAAE,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,eAAe,EACf,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,MAAM,EACN,cAAc,EACd,SAAS,EACT,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEhG,SAAS,mBAAmB;IAC1B,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,KAAK,CAAC,iEAAiE,CAAC,EAC5E,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAC/C,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,QAAQ,CAAC,GAAY,EAAE,IAAc,EAAE,GAAc;IAClE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrE,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,yEAAyE;IACzE,oFAAoF;IACpF,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC;IAEV,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACpF,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,sBAAsB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACpE,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,sBAAsB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAEtE,6EAA6E;IAC7E,wEAAwE;IACxE,4CAA4C;IAC5C,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAE,GAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,6EAA6E;AAE7E;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CAAC,GAAY,EAAE,IAAc,EAAE,GAAgB;IACtE,IAAI,CAAC;QACH,GAAG,CAAC,YAAY,KAAK,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChE,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,8EAA8E;QAC9E,uEAAuE;QACvE,2EAA2E;QAC3E,+BAA+B;QAC/B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAY,EACZ,IAAc,EACd,GAAmB;IAEnB,IAAI,GAAG,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACjC,GAAG,CAAC,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,CAAC,GAAG,CAAC,mBAAmB,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QACD,OAAO;IACT,CAAC;IACD,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QACjE,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,WAAW,CAAC;gBACf,CAAC,EAAE,MAAM;gBACT,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QAC/D,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACvC,IAAI,CACF,IAAI,EACJ,GAAG,CAAC,EAAE,EACN,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAClF,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,GAAY,EACZ,IAAc,EACd,GAAmB;IAEnB,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAC3B,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,wEAAwE;YACxE,sEAAsE;YACtE,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,2EAA2E;QAC3E,8CAA8C;QAC9C,IACE,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC;YACtC,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC;YACvC,CAAC,mBAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,EAC1C,CAAC;YACD,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvB,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,6EAA6E;AAE7E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,IAAc;IACtD,CAAC,GAAG,CAAC,iBAAiB,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,CAAC,OAAmB,EAAQ,EAAE;QAC5C,IAAI,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IACF,yEAAyE;IACzE,yEAAyE;IACzE,UAAU;IACV,OAAO,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnD,2EAA2E;IAC3E,6EAA6E;IAC7E,yCAAyC;IACzC,OAAO,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnD,0EAA0E;IAC1E,yEAAyE;IACzE,4DAA4D;IAC5D,OAAO,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpD,0EAA0E;IAC1E,gEAAgE;IAChE,OAAO,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,0DAA0D,CAAC,CAAC;IACjG,CAAC;AACH,CAAC"}

package/dist/serve/worker/host/firestore-reads.d.ts

@@ -0,0 +1,17 @@
+/**
+ * SharedWorker host — Firestore read + aggregate + keyspace ops.
+ *
+ * The rule-gated read surface: `getDoc`/`getDocs`, the `count`/`aggregate`
+ * server aggregations, and the lens-independent keyspace enumeration
+ * (`listRootCollections`/`listSubcollections`, the Pyric Studio data browse).
+ *
+ * Routed here by the host dispatcher (host/dispatch.ts) with the op's resolved
+ * Firestore handle (`db` — already lens/session-resolved). This module never
+ * imports the dispatcher; it leans only on host-context + host/core.
+ */
+import { type Firestore } from 'pyric/firestore';
+import type { OpMessage } from '../protocol.js';
+import { type HostCtx, type PortLike } from '../host-context.js';
+export declare function isFirestoreReadOp(method: OpMessage['method']): boolean;
+export declare function handleFirestoreReadOp(ctx: HostCtx, port: PortLike, msg: OpMessage, db: Firestore): Promise<void>;
+//# sourceMappingURL=firestore-reads.d.ts.map

package/dist/serve/worker/host/firestore-reads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-reads.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/host/firestore-reads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAOL,KAAK,SAAS,EAEf,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAY,MAAM,oBAAoB,CAAC;AAa3E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,OAAO,CAEtE;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,SAAS,EACd,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,IAAI,CAAC,CAqEf"}