@pyric/ui 0.1.0-alpha.10

package/dist/auth/controller.js

@@ -0,0 +1,139 @@
+/**
+ * Sign-in helper controller — the host side of `pyric/auth`'s
+ * `AuthFlowResolver` seam.
+ *
+ * `pyric/auth` stays UI-free: `signInWithPopup` / `signInWithRedirect`
+ * delegate to a resolver. This controller IS that resolver's host
+ * implementation — it parks the SDK's promise, drives a host UI (an
+ * account picker + add-account form, e.g. `<AuthSignInHelper>`), and
+ * settles the promise when the user picks an identity, adds one, or
+ * cancels. React components stay thin presentational shells over this;
+ * all the settle/seed logic lives here so it's testable without a DOM.
+ *
+ * Faithful to the Firebase emulator: "add account" mints a sandbox
+ * identity with optional custom claims (the emulator's
+ * `customAttributes`), so a rule gated on `request.auth.token.<claim>`
+ * works against live sandbox traffic. Credential + token synthesis is
+ * backend-owned (`sandbox.createSignInCredential`) — this controller
+ * only drives the UI flow and settles the parked promise.
+ */
+import { sandbox as authSandbox, } from 'pyric/auth';
+export class AuthFlowController {
+    auth;
+    pending = null;
+    listeners = new Set();
+    /** Memoized {@link snapshot} result, invalidated by {@link emit}.
+     *  `useSyncExternalStore` compares consecutive `getSnapshot()` results
+     *  with `Object.is` — an uncached object here re-renders forever. */
+    cached = null;
+    constructor(auth) {
+        this.auth = auth;
+    }
+    /** Wire this controller's resolver into the auth handle. Paired with
+     *  {@link uninstall} for use in a React effect (install in the body,
+     *  uninstall in the cleanup) — StrictMode-safe. */
+    install() {
+        authSandbox.setAuthFlowResolver(this.auth, this.resolver());
+    }
+    uninstall() {
+        authSandbox.setAuthFlowResolver(this.auth, null);
+    }
+    /** The resolver to hand to `sandbox.setAuthFlowResolver`. Popup and
+     *  redirect share one implementation (the sandbox has no navigation). */
+    resolver() {
+        const open = (req) => new Promise((resolve, reject) => {
+            // One helper at a time: a new request supersedes any stale pending.
+            if (this.pending)
+                this.cancel();
+            this.pending = { req, resolve, reject };
+            this.emit();
+        });
+        return { openPopup: open, openRedirect: open };
+    }
+    // ─── React glue (subscribe + snapshot) ──────────────────────────────
+    subscribe(fn) {
+        this.listeners.add(fn);
+        return () => this.listeners.delete(fn);
+    }
+    snapshot() {
+        this.cached ??= {
+            request: this.pending?.req ?? null,
+            identities: authSandbox.listIdentities(this.auth),
+        };
+        return this.cached;
+    }
+    emit() {
+        this.cached = null;
+        for (const l of this.listeners)
+            l();
+    }
+    // ─── UI actions ─────────────────────────────────────────────────────
+    /** Pick an existing identity (by uid). The backend mints the credential
+     *  (and records the provider on the identity). */
+    pick(uid) {
+        const pending = this.pending;
+        if (!pending)
+            return;
+        let cred;
+        try {
+            cred = authSandbox.createSignInCredential(this.auth, {
+                providerId: pending.req.providerId,
+                uid,
+            });
+        }
+        catch (e) {
+            this.take()?.reject(e);
+            return;
+        }
+        this.take()?.resolve(cred);
+    }
+    /** Add + sign in as a new identity. The backend creates the identity
+     *  (so claims resolve in rules and it shows up in the picker next time)
+     *  and mints the credential in one step.
+     *
+     *  Credential creation happens BEFORE {@link take}'s emit: subscribers
+     *  recompute the snapshot synchronously on emit, so creating after would
+     *  publish a stale identity list (a `useSyncExternalStore` consumer
+     *  would miss the new account until the next unrelated emit). */
+    add(spec) {
+        const pending = this.pending;
+        if (!pending)
+            return;
+        let cred;
+        try {
+            cred = authSandbox.createSignInCredential(this.auth, {
+                providerId: pending.req.providerId,
+                spec: {
+                    email: spec.email,
+                    displayName: spec.displayName,
+                    customClaims: spec.customClaims,
+                },
+            });
+        }
+        catch (e) {
+            this.take()?.reject(e);
+            return;
+        }
+        this.take()?.resolve(cred);
+    }
+    /** Dismiss — rejects with the faithful `auth/popup-closed-by-user`. */
+    cancel() {
+        const p = this.take();
+        if (!p)
+            return;
+        p.reject(authError('auth/popup-closed-by-user', 'The popup has been closed by the user before finalizing the operation.'));
+    }
+    take() {
+        const p = this.pending;
+        this.pending = null;
+        this.emit();
+        return p;
+    }
+}
+function authError(code, message) {
+    const e = new Error(message);
+    e.name = 'FirebaseError';
+    e.code = code;
+    return e;
+}
+//# sourceMappingURL=controller.js.map

package/dist/auth/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/auth/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,OAAO,IAAI,WAAW,GAKvB,MAAM,YAAY,CAAC;AA2BpB,MAAM,OAAO,kBAAkB;IAQA;IAPrB,OAAO,GAAmB,IAAI,CAAC;IACtB,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IACnD;;yEAEqE;IAC7D,MAAM,GAAuB,IAAI,CAAC;IAE1C,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C;;uDAEmD;IACnD,OAAO;QACL,WAAW,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS;QACP,WAAW,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IAED;6EACyE;IACzE,QAAQ;QACN,MAAM,IAAI,GAAG,CAAC,GAAoB,EAA2B,EAAE,CAC7D,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,oEAAoE;YACpE,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;QACL,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,uEAAuE;IACvE,SAAS,CAAC,EAAc;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,MAAM,KAAK;YACd,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI;YAClC,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;SAClD,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS;YAAE,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,uEAAuE;IACvE;sDACkD;IAClD,IAAI,CAAC,GAAW;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,IAAoB,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,WAAW,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE;gBACnD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;gBAClC,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;qEAOiE;IACjE,GAAG,CAAC,IAAqB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,IAAoB,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,WAAW,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE;gBACnD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;gBAClC,IAAI,EAAE;oBACJ,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,uEAAuE;IACvE,MAAM;QACJ,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,2BAA2B,EAAE,wEAAwE,CAAC,CAAC,CAAC;IAC7H,CAAC;IAEO,IAAI;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;CACF;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAA6B,CAAC;IACzD,CAAC,CAAC,IAAI,GAAG,eAAe,CAAC;IACzB,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACd,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/auth/hooks/index.d.ts

@@ -0,0 +1,7 @@
+export { useAuthFlowHelper, type UseAuthFlowHelperResult, } from './useAuthFlowHelper.js';
+export { useAuthUsers, type UseAuthUsersResult, } from './useAuthUsers.js';
+export { useAuthProviderConfig, type AuthProviderConfigEntry, type UseAuthProviderConfigResult, } from './useAuthProviderConfig.js';
+export { useAuthUserEditor, type UseAuthUserEditorOptions, type UseAuthUserEditorResult, } from './useAuthUserEditor.js';
+export { authUserEditorReducer, initAuthUserEditorState, fieldsFromRecord, validateAuthUserFields, toCreateRequest, toUpdateRequest, type AuthUserEditorAction, type AuthUserEditorErrors, type AuthUserEditorFields, type AuthUserEditorState, } from '../reducers/userEditor.js';
+export { AuthFlowController, type HelperState, type NewIdentitySpec, type SandboxIdentity, } from '../controller.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/hooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,EACZ,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC"}

package/dist/auth/hooks/index.js

@@ -0,0 +1,7 @@
+export { useAuthFlowHelper, } from './useAuthFlowHelper.js';
+export { useAuthUsers, } from './useAuthUsers.js';
+export { useAuthProviderConfig, } from './useAuthProviderConfig.js';
+export { useAuthUserEditor, } from './useAuthUserEditor.js';
+export { authUserEditorReducer, initAuthUserEditorState, fieldsFromRecord, validateAuthUserFields, toCreateRequest, toUpdateRequest, } from '../reducers/userEditor.js';
+export { AuthFlowController, } from '../controller.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/hooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,GAEb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,GAGtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,GAGlB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,GAKhB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,GAInB,MAAM,kBAAkB,CAAC"}

package/dist/auth/hooks/useAuthFlowHelper.d.ts

@@ -0,0 +1,30 @@
+import type { Auth } from 'pyric/auth';
+import { type HelperState, type NewIdentitySpec } from '../controller.js';
+export interface UseAuthFlowHelperResult {
+    /** Render snapshot: the in-flight request (or null) + pickable identities. */
+    state: HelperState;
+    /** Settle the flow with an existing identity (by uid). */
+    pick: (uid: string) => void;
+    /** Create + sign in as a new identity (seeds it for next time). */
+    add: (spec: NewIdentitySpec) => void;
+    /** Dismiss — rejects the app's sign-in promise with
+     *  `auth/popup-closed-by-user` (faithful to `firebase/auth`). */
+    cancel: () => void;
+}
+/**
+ * Emulator-style sign-in helper for a sandbox `Auth` handle.
+ *
+ * Installs an {@link AuthFlowController} as the handle's
+ * `AuthFlowResolver` for the lifetime of the calling component — the
+ * analog of browser `getAuth` wiring `browserPopupRedirectResolver`.
+ * While mounted, any `signInWithPopup` / `signInWithRedirect` call made
+ * against `auth` parks on `state.request`; render an account-picker UI
+ * (e.g. `<AuthSignInHelper>`) from `state` and settle with
+ * `pick` / `add` / `cancel`.
+ *
+ * Install/uninstall is a paired effect, so the StrictMode double-mount
+ * installs and cleanly uninstalls. Sandbox-only: the controller throws
+ * `failed-precondition` if `auth` is prod-backed.
+ */
+export declare function useAuthFlowHelper(auth: Auth): UseAuthFlowHelperResult;
+//# sourceMappingURL=useAuthFlowHelper.d.ts.map

package/dist/auth/hooks/useAuthFlowHelper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthFlowHelper.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthFlowHelper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,KAAK,EAAE,WAAW,CAAC;IACnB,0DAA0D;IAC1D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,mEAAmE;IACnE,GAAG,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAC;IACrC;qEACiE;IACjE,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,uBAAuB,CAmBrE"}

package/dist/auth/hooks/useAuthFlowHelper.js

@@ -0,0 +1,30 @@
+import { useCallback, useEffect, useMemo, useSyncExternalStore } from 'react';
+import { AuthFlowController, } from '../controller.js';
+/**
+ * Emulator-style sign-in helper for a sandbox `Auth` handle.
+ *
+ * Installs an {@link AuthFlowController} as the handle's
+ * `AuthFlowResolver` for the lifetime of the calling component — the
+ * analog of browser `getAuth` wiring `browserPopupRedirectResolver`.
+ * While mounted, any `signInWithPopup` / `signInWithRedirect` call made
+ * against `auth` parks on `state.request`; render an account-picker UI
+ * (e.g. `<AuthSignInHelper>`) from `state` and settle with
+ * `pick` / `add` / `cancel`.
+ *
+ * Install/uninstall is a paired effect, so the StrictMode double-mount
+ * installs and cleanly uninstalls. Sandbox-only: the controller throws
+ * `failed-precondition` if `auth` is prod-backed.
+ */
+export function useAuthFlowHelper(auth) {
+    const controller = useMemo(() => new AuthFlowController(auth), [auth]);
+    useEffect(() => {
+        controller.install();
+        return () => controller.uninstall();
+    }, [controller]);
+    const state = useSyncExternalStore(useCallback((cb) => controller.subscribe(cb), [controller]), () => controller.snapshot(), () => controller.snapshot());
+    const pick = useCallback((uid) => controller.pick(uid), [controller]);
+    const add = useCallback((spec) => controller.add(spec), [controller]);
+    const cancel = useCallback(() => controller.cancel(), [controller]);
+    return { state, pick, add, cancel };
+}
+//# sourceMappingURL=useAuthFlowHelper.js.map

package/dist/auth/hooks/useAuthFlowHelper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthFlowHelper.js","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthFlowHelper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAE9E,OAAO,EACL,kBAAkB,GAGnB,MAAM,kBAAkB,CAAC;AAc1B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAU;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,SAAS,CAAC,GAAG,EAAE;QACb,UAAU,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;IACtC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,KAAK,GAAG,oBAAoB,CAChC,WAAW,CAAC,CAAC,EAAc,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EACvE,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAC3B,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,CAC5B,CAAC;IAEF,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,IAAqB,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEpE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC"}

package/dist/auth/hooks/useAuthProviderConfig.d.ts

@@ -0,0 +1,37 @@
+import type { Auth } from 'pyric/auth';
+/** One provider's current enablement, as the hook exposes it. */
+export interface AuthProviderConfigEntry {
+    providerId: string;
+    enabled: boolean;
+}
+export interface UseAuthProviderConfigResult {
+    /** Every provider this sandbox has an explicit enablement for. Unknown
+     *  providers (never toggled) are simply absent — `isEnabled` treats an
+     *  absent entry as enabled, matching the backend default. */
+    config: AuthProviderConfigEntry[];
+    isLoading: boolean;
+    error: Error | undefined;
+    /** Convenience lookup: `true` for a provider that's never been toggled. */
+    isEnabled: (providerId: string) => boolean;
+    /** Toggle a provider on/off. Sync (in-process) failures throw to the
+     *  caller, same policy as `useAuthUsers`'s mutation callbacks; an ASYNC
+     *  (worker-RPC) failure can't reach a sync caller, so it surfaces on the
+     *  hook's `error` state instead — never an unhandled rejection. */
+    setEnabled: (providerId: string, enabled: boolean) => void;
+    /** Re-read manually. Rarely needed — every mutation (this hook's own
+     *  `setEnabled`, another handle, the agent) already triggers the
+     *  subscription re-list. */
+    refresh: () => void;
+}
+/**
+ * Live sign-in provider config view over a sandbox `Auth` handle:
+ * `sandbox.getAuthProviderConfig` + `sandbox.subscribeAuthProviderConfig` +
+ * `sandbox.setAuthProviderConfig`. Mirrors `useAuthUsers`'s shape exactly
+ * (coarse "something changed, re-list" subscription; sync in-process,
+ * tolerates a promise over the SharedWorker client).
+ *
+ * Sandbox-only: throws `failed-precondition` on a prod-backed handle (the
+ * hook surfaces that via `error`, same as `useAuthUsers`).
+ */
+export declare function useAuthProviderConfig(auth: Auth): UseAuthProviderConfigResult;
+//# sourceMappingURL=useAuthProviderConfig.d.ts.map

package/dist/auth/hooks/useAuthProviderConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthProviderConfig.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthProviderConfig.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAGvC,iEAAiE;AACjE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C;;iEAE6D;IAC7D,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC;IACzB,2EAA2E;IAC3E,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;;uEAGmE;IACnE,UAAU,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3D;;gCAE4B;IAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,2BAA2B,CAkG7E"}

package/dist/auth/hooks/useAuthProviderConfig.js

@@ -0,0 +1,98 @@
+import { useCallback, useEffect, useState } from 'react';
+import { useAuthApi } from '../authApi.js';
+/**
+ * Live sign-in provider config view over a sandbox `Auth` handle:
+ * `sandbox.getAuthProviderConfig` + `sandbox.subscribeAuthProviderConfig` +
+ * `sandbox.setAuthProviderConfig`. Mirrors `useAuthUsers`'s shape exactly
+ * (coarse "something changed, re-list" subscription; sync in-process,
+ * tolerates a promise over the SharedWorker client).
+ *
+ * Sandbox-only: throws `failed-precondition` on a prod-backed handle (the
+ * hook surfaces that via `error`, same as `useAuthUsers`).
+ */
+export function useAuthProviderConfig(auth) {
+    const { getAuthProviderConfig, setAuthProviderConfig: apiSetAuthProviderConfig, subscribeAuthProviderConfig, } = useAuthApi();
+    const [config, setConfig] = useState([]);
+    const [isLoading, setIsLoading] = useState(true);
+    const [error, setError] = useState(undefined);
+    useEffect(() => {
+        let cancelled = false;
+        setIsLoading(true);
+        setError(undefined);
+        const apply = (c) => {
+            if (cancelled)
+                return;
+            setConfig(c);
+            setIsLoading(false);
+        };
+        const applyErr = (e) => {
+            if (cancelled)
+                return;
+            setConfig([]);
+            setError(e instanceof Error ? e : new Error(String(e)));
+            setIsLoading(false);
+        };
+        // `getAuthProviderConfig` is SYNC in-process, ASYNC (RPC) over the worker
+        // — same thenable-tolerant branch `useAuthUsers` uses for `listUsers`.
+        const relist = () => {
+            try {
+                const r = getAuthProviderConfig(auth);
+                if (r && typeof r.then === 'function') {
+                    r.then(apply).catch(applyErr);
+                }
+                else {
+                    apply(r);
+                }
+            }
+            catch (e) {
+                applyErr(e);
+            }
+        };
+        let unsub;
+        try {
+            relist();
+            unsub = subscribeAuthProviderConfig(auth, relist);
+        }
+        catch (e) {
+            applyErr(e);
+        }
+        return () => {
+            cancelled = true;
+            unsub?.();
+        };
+    }, [auth, getAuthProviderConfig, subscribeAuthProviderConfig]);
+    const isEnabled = useCallback((providerId) => config.find((c) => c.providerId === providerId)?.enabled ?? true, [config]);
+    const toError = (e) => (e instanceof Error ? e : new Error(String(e)));
+    const setEnabled = useCallback((providerId, enabled) => {
+        // Over the worker this is an RPC promise — a fire-and-forget caller
+        // would otherwise leave a rejection unhandled and the toggle silently
+        // dead. Route async failures into the hook's error state; sync throws
+        // still propagate (in-process policy, matching useAuthUsers).
+        const r = apiSetAuthProviderConfig(auth, providerId, enabled);
+        if (r && typeof r.then === 'function') {
+            r.catch((e) => setError(toError(e)));
+        }
+    }, [auth, apiSetAuthProviderConfig]);
+    const refresh = useCallback(() => {
+        try {
+            const r = getAuthProviderConfig(auth);
+            if (r && typeof r.then === 'function') {
+                void r
+                    .then((c) => {
+                    setConfig(c);
+                    setError(undefined);
+                })
+                    .catch((e) => setError(toError(e)));
+            }
+            else {
+                setConfig(r);
+                setError(undefined);
+            }
+        }
+        catch (e) {
+            setError(toError(e));
+        }
+    }, [auth, getAuthProviderConfig]);
+    return { config, isLoading, error, isEnabled, setEnabled, refresh };
+}
+//# sourceMappingURL=useAuthProviderConfig.js.map

package/dist/auth/hooks/useAuthProviderConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthProviderConfig.js","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthProviderConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AA4B3C;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAU;IAC9C,MAAM,EACJ,qBAAqB,EACrB,qBAAqB,EAAE,wBAAwB,EAC/C,2BAA2B,GAC5B,GAAG,UAAU,EAAE,CAAC;IAEjB,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA4B,EAAE,CAAC,CAAC;IACpE,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAoB,SAAS,CAAC,CAAC;IAEjE,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpB,MAAM,KAAK,GAAG,CAAC,CAA4B,EAAE,EAAE;YAC7C,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,CAAC,CAAC,CAAC,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,EAAE;YAC9B,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAEE,CAAC;gBACvC,IAAI,CAAC,IAAI,OAAQ,CAAwC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC7E,CAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACxE,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,CAA8B,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QACF,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC;YACT,KAAK,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;QACD,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;YACjB,KAAK,EAAE,EAAE,CAAC;QACZ,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAE/D,MAAM,SAAS,GAAG,WAAW,CAC3B,CAAC,UAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,EAAE,OAAO,IAAI,IAAI,EACxF,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhF,MAAM,UAAU,GAAG,WAAW,CAC5B,CAAC,UAAkB,EAAE,OAAgB,EAAE,EAAE;QACvC,oEAAoE;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAyB,CAAC;QACtF,IAAI,CAAC,IAAI,OAAQ,CAAmB,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACxD,CAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,EACD,CAAC,IAAI,EAAE,wBAAwB,CAAC,CACjC,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAEE,CAAC;YACvC,IAAI,CAAC,IAAI,OAAQ,CAAwC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9E,KAAM,CAAwC;qBAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;oBACV,SAAS,CAAC,CAAC,CAAC,CAAC;oBACb,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtB,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,CAA8B,CAAC,CAAC;gBAC1C,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAElC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACtE,CAAC"}

package/dist/auth/hooks/useAuthUserEditor.d.ts

@@ -0,0 +1,30 @@
+import type { AuthUserRecord, CreateUserRequest, UpdateUserRequest } from 'pyric/auth';
+import { type AuthUserEditorAction, type AuthUserEditorErrors, type AuthUserEditorFields } from '../reducers/userEditor.js';
+export interface UseAuthUserEditorOptions {
+    /** Existing record to edit. Omit for create mode. */
+    initial?: AuthUserRecord;
+}
+export interface UseAuthUserEditorResult {
+    fields: AuthUserEditorFields;
+    /** Per-field validation messages (emulator-UI wording). Empty when valid. */
+    errors: AuthUserEditorErrors;
+    isDirty: boolean;
+    isValid: boolean;
+    setField: <K extends keyof AuthUserEditorFields>(field: K, value: AuthUserEditorFields[K]) => void;
+    /** Back to the initial snapshot. */
+    reset: () => void;
+    /** Full payload for `createUser` (every non-empty field). */
+    toCreateRequest: () => CreateUserRequest;
+    /** Delta payload for `updateUser` (only changed fields). */
+    toUpdateRequest: () => UpdateUserRequest;
+    /** Raw reducer access for advanced consumers. */
+    dispatch: (action: AuthUserEditorAction) => void;
+}
+/**
+ * Headless add/edit-user state machine (reducer-based, like
+ * `useDocumentEditor`): field edits, claims-JSON validation with
+ * emulator-grade messages, dirtiness vs the initial record, and payload
+ * builders for `useAuthUsers`' `createUser` / `updateUser`.
+ */
+export declare function useAuthUserEditor(options?: UseAuthUserEditorOptions): UseAuthUserEditorResult;
+//# sourceMappingURL=useAuthUserEditor.d.ts.map

package/dist/auth/hooks/useAuthUserEditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthUserEditor.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthUserEditor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAOL,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,wBAAwB;IACvC,qDAAqD;IACrD,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,6EAA6E;IAC7E,MAAM,EAAE,oBAAoB,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,oBAAoB,EAC7C,KAAK,EAAE,CAAC,EACR,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,KAC3B,IAAI,CAAC;IACV,oCAAoC;IACpC,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,6DAA6D;IAC7D,eAAe,EAAE,MAAM,iBAAiB,CAAC;IACzC,4DAA4D;IAC5D,eAAe,EAAE,MAAM,iBAAiB,CAAC;IACzC,iDAAiD;IACjD,QAAQ,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,wBAA6B,GACrC,uBAAuB,CA4BzB"}

package/dist/auth/hooks/useAuthUserEditor.js

@@ -0,0 +1,27 @@
+import { useCallback, useMemo, useReducer } from 'react';
+import { authUserEditorReducer, initAuthUserEditorState, isDirty as computeDirty, toCreateRequest, toUpdateRequest, validateAuthUserFields, } from '../reducers/userEditor.js';
+/**
+ * Headless add/edit-user state machine (reducer-based, like
+ * `useDocumentEditor`): field edits, claims-JSON validation with
+ * emulator-grade messages, dirtiness vs the initial record, and payload
+ * builders for `useAuthUsers`' `createUser` / `updateUser`.
+ */
+export function useAuthUserEditor(options = {}) {
+    const [state, dispatch] = useReducer(authUserEditorReducer, options.initial, initAuthUserEditorState);
+    const errors = useMemo(() => validateAuthUserFields(state.fields), [state.fields]);
+    const dirty = useMemo(() => computeDirty(state), [state]);
+    const setField = useCallback((field, value) => dispatch({ type: 'setField', field, value }), []);
+    const reset = useCallback(() => dispatch({ type: 'reset' }), []);
+    return {
+        fields: state.fields,
+        errors,
+        isDirty: dirty,
+        isValid: Object.keys(errors).length === 0,
+        setField,
+        reset,
+        toCreateRequest: () => toCreateRequest(state),
+        toUpdateRequest: () => toUpdateRequest(state),
+        dispatch,
+    };
+}
+//# sourceMappingURL=useAuthUserEditor.js.map

package/dist/auth/hooks/useAuthUserEditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthUserEditor.js","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthUserEditor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,OAAO,IAAI,YAAY,EACvB,eAAe,EACf,eAAe,EACf,sBAAsB,GAIvB,MAAM,2BAA2B,CAAC;AA2BnC;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAoC,EAAE;IAEtC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,UAAU,CAClC,qBAAqB,EACrB,OAAO,CAAC,OAAO,EACf,uBAAuB,CACxB,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1D,MAAM,QAAQ,GAAG,WAAW,CAC1B,CAAuC,KAAQ,EAAE,KAA8B,EAAE,EAAE,CACjF,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9C,EAAE,CACH,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAEjE,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM;QACN,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QACzC,QAAQ;QACR,KAAK;QACL,eAAe,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;QAC7C,eAAe,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;QAC7C,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/auth/hooks/useAuthUsers.d.ts

@@ -0,0 +1,38 @@
+import type { Auth, AuthUserRecord, CreateUserRequest, UpdateUserRequest } from 'pyric/auth';
+export interface UseAuthUsersResult {
+    /** Users matching {@link filter} (everyone when the filter is empty). */
+    users: AuthUserRecord[];
+    /** Unfiltered count: lets a list distinguish "no users at all" from
+     *  "no results for this filter". */
+    totalCount: number;
+    isLoading: boolean;
+    error: Error | undefined;
+    /** Case-insensitive substring match over uid, email, display name and
+     *  phone number (the emulator UI's search semantics). */
+    filter: string;
+    setFilter: (filter: string) => void;
+    createUser: (request: CreateUserRequest) => AuthUserRecord;
+    updateUser: (uid: string, update: UpdateUserRequest) => AuthUserRecord;
+    deleteUser: (uid: string) => void;
+    clearUsers: () => void;
+    /** Re-list manually. Rarely needed, every mutation (including ones made
+     *  by the agent or the running app) already triggers `subscribeUsers`. */
+    refresh: () => void;
+}
+/**
+ * Live user-admin view over a sandbox `Auth` handle:
+ * `sandbox.listUsers` + `sandbox.subscribeUsers` + CRUD actions.
+ *
+ * The subscription is coarse ("something changed"): any user-DB
+ * mutation (from these actions, the running app's sign-ups, the
+ * agent's seeding) triggers a re-list, so the view stays live without
+ * per-row bookkeeping. Filtering is client-side (the sandbox is
+ * in-process; there is no server to push the query to).
+ *
+ * Mutation errors (e.g. `auth/uid-already-exists`) throw to the caller:
+ * handle them at the call site like the firestore hooks' `createDocument`.
+ * Sandbox-only: throws `failed-precondition` on a prod-backed handle (the
+ * hook surfaces that via `error`).
+ */
+export declare function useAuthUsers(auth: Auth): UseAuthUsersResult;
+//# sourceMappingURL=useAuthUsers.d.ts.map

package/dist/auth/hooks/useAuthUsers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthUsers.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthUsers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,IAAI,EACJ,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAGpB,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB;wCACoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC;IACzB;6DACyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,UAAU,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,cAAc,CAAC;IAC3D,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,KAAK,cAAc,CAAC;IACvE,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB;8EAC0E;IAC1E,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAQD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,kBAAkB,CAsG3D"}

package/dist/auth/hooks/useAuthUsers.js

@@ -0,0 +1,111 @@
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { useAuthApi } from '../authApi.js';
+function matches(user, needle) {
+    return [user.uid, user.email, user.displayName, user.phoneNumber].some((v) => v != null && v.toLowerCase().includes(needle));
+}
+/**
+ * Live user-admin view over a sandbox `Auth` handle:
+ * `sandbox.listUsers` + `sandbox.subscribeUsers` + CRUD actions.
+ *
+ * The subscription is coarse ("something changed"): any user-DB
+ * mutation (from these actions, the running app's sign-ups, the
+ * agent's seeding) triggers a re-list, so the view stays live without
+ * per-row bookkeeping. Filtering is client-side (the sandbox is
+ * in-process; there is no server to push the query to).
+ *
+ * Mutation errors (e.g. `auth/uid-already-exists`) throw to the caller:
+ * handle them at the call site like the firestore hooks' `createDocument`.
+ * Sandbox-only: throws `failed-precondition` on a prod-backed handle (the
+ * hook surfaces that via `error`).
+ */
+export function useAuthUsers(auth) {
+    // The sandbox auth ops, injected: in-process `pyric/auth` by default, or the
+    // SharedWorker client bundle when a consumer (Pyric Studio served mode) wraps
+    // the tree in an `AuthApiProvider`.
+    const { listUsers, subscribeUsers, createUser: apiCreateUser, updateUser: apiUpdateUser, deleteUser: apiDeleteUser, clearUsers: apiClearUsers, } = useAuthApi();
+    const [all, setAll] = useState([]);
+    const [isLoading, setIsLoading] = useState(true);
+    const [error, setError] = useState(undefined);
+    const [filter, setFilter] = useState('');
+    useEffect(() => {
+        let cancelled = false;
+        setIsLoading(true);
+        setError(undefined);
+        const applyUsers = (u) => {
+            if (cancelled)
+                return;
+            setAll(u);
+            setIsLoading(false);
+        };
+        const applyErr = (e) => {
+            if (cancelled)
+                return;
+            setAll([]);
+            setError(e instanceof Error ? e : new Error(String(e)));
+            setIsLoading(false);
+        };
+        // `listUsers` is SYNC in-process (apply immediately, preserving the sync
+        // contract existing consumers + tests rely on) but ASYNC over the worker (an
+        // RPC), so branch on a thenable. The subscription is coarse: re-list on any
+        // change.
+        const relist = () => {
+            try {
+                const r = listUsers(auth);
+                if (r && typeof r.then === 'function') {
+                    r.then(applyUsers).catch(applyErr);
+                }
+                else {
+                    applyUsers(r);
+                }
+            }
+            catch (e) {
+                applyErr(e);
+            }
+        };
+        let unsub;
+        try {
+            relist();
+            unsub = subscribeUsers(auth, relist);
+        }
+        catch (e) {
+            applyErr(e);
+        }
+        return () => {
+            cancelled = true;
+            unsub?.();
+        };
+    }, [auth, listUsers, subscribeUsers]);
+    const users = useMemo(() => {
+        const needle = filter.trim().toLowerCase();
+        if (!needle)
+            return all;
+        return all.filter((u) => matches(u, needle));
+    }, [all, filter]);
+    const createUser = useCallback((request) => apiCreateUser(auth, request), [auth, apiCreateUser]);
+    const updateUser = useCallback((uid, update) => apiUpdateUser(auth, uid, update), [auth, apiUpdateUser]);
+    const deleteUser = useCallback((uid) => apiDeleteUser(auth, uid), [auth, apiDeleteUser]);
+    const clearUsers = useCallback(() => apiClearUsers(auth), [auth, apiClearUsers]);
+    const refresh = useCallback(() => {
+        const r = listUsers(auth);
+        if (r && typeof r.then === 'function') {
+            void r.then((u) => setAll(u)).catch(() => { });
+        }
+        else {
+            setAll(r);
+        }
+    }, [auth, listUsers]);
+    return {
+        users,
+        totalCount: all.length,
+        isLoading,
+        error,
+        filter,
+        setFilter,
+        createUser,
+        updateUser,
+        deleteUser,
+        clearUsers,
+        refresh,
+    };
+}
+//# sourceMappingURL=useAuthUsers.js.map

package/dist/auth/hooks/useAuthUsers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthUsers.js","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthUsers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAOlE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAuB3C,SAAS,OAAO,CAAC,IAAoB,EAAE,MAAc;IACnD,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,6EAA6E;IAC7E,8EAA8E;IAC9E,oCAAoC;IACpC,MAAM,EACJ,SAAS,EACT,cAAc,EACd,UAAU,EAAE,aAAa,EACzB,UAAU,EAAE,aAAa,EACzB,UAAU,EAAE,aAAa,EACzB,UAAU,EAAE,aAAa,GAC1B,GAAG,UAAU,EAAE,CAAC;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAmB,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAoB,SAAS,CAAC,CAAC;IACjE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAEzC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpB,MAAM,UAAU,GAAG,CAAC,CAAmB,EAAE,EAAE;YACzC,IAAI,SAAS;gBAAE,OAAO;YACtB,MAAM,CAAC,CAAC,CAAC,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,EAAE;YAC9B,IAAI,SAAS;gBAAE,OAAO;YACtB,MAAM,CAAC,EAAE,CAAC,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC;QACF,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,UAAU;QACV,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAiD,CAAC;gBAC1E,IAAI,CAAC,IAAI,OAAQ,CAA+B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACpE,CAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpE,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,CAAqB,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QACF,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC;YACT,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;QACD,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;YACjB,KAAK,EAAE,EAAE,CAAC;QACZ,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IAEtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC;QACxB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAElB,MAAM,UAAU,GAAG,WAAW,CAC5B,CAAC,OAA0B,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,EAC5D,CAAC,IAAI,EAAE,aAAa,CAAC,CACtB,CAAC;IACF,MAAM,UAAU,GAAG,WAAW,CAC5B,CAAC,GAAW,EAAE,MAAyB,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,EAC5E,CAAC,IAAI,EAAE,aAAa,CAAC,CACtB,CAAC;IACF,MAAM,UAAU,GAAG,WAAW,CAC5B,CAAC,GAAW,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,EACzC,CAAC,IAAI,EAAE,aAAa,CAAC,CACtB,CAAC;IACF,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAiD,CAAC;QAC1E,IAAI,CAAC,IAAI,OAAQ,CAA+B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrE,KAAM,CAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,CAAqB,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAEtB,OAAO;QACL,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,MAAM;QACtB,SAAS;QACT,KAAK;QACL,MAAM;QACN,SAAS;QACT,UAAU;QACV,UAAU;QACV,UAAU;QACV,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,11 @@
+export * from './hooks/index.js';
+export { AuthApiProvider, useAuthApi, type AuthApi } from './authApi.js';
+export { AuthSignInHelper, type AuthSignInHelperProps, } from './components/AuthSignInHelper.js';
+export { AuthUserList, type AuthUserListProps, } from './components/AuthUserList.js';
+export { AuthProviderToggles, DEFAULT_KNOWN_PROVIDER_IDS, type AuthProviderTogglesProps, } from './components/AuthProviderToggles.js';
+export { AuthUserForm, type AuthUserFormField, type AuthUserFormFieldName, type AuthUserFormProps, type AuthUserFormSubmit, } from './components/AuthUserForm.js';
+export { ClaimsField, type ClaimsFieldProps, } from './components/ClaimsField.js';
+export { DeleteUserWithConfirm, type DeleteUserWithConfirmProps, ClearUsersWithConfirm, type ClearUsersWithConfirmProps, } from './components/confirmActions.js';
+export { validateSerializedClaims, FORBIDDEN_CUSTOM_CLAIMS, CUSTOM_CLAIMS_MAX_LENGTH, type ClaimsValidationResult, } from './claims.js';
+export { PROVIDER_LABELS, providerLabel } from './providers.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AAIjC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,GAC3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,wBAAwB,GAC9B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,WAAW,EACX,KAAK,gBAAgB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,0BAA0B,GAChC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}