@pyric/ui 0.1.0-alpha.7

package/dist/auth/components/AuthUserList.js

@@ -0,0 +1,46 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { VirtualList } from '../../primitives/VirtualList.js';
+import { providerLabel } from '../providers.js';
+function defaultIdentifier(user) {
+    return user.email ?? user.phoneNumber ?? (user.isAnonymous ? 'anonymous' : user.uid);
+}
+function defaultProviders(user) {
+    if (user.isAnonymous && user.providerUserInfo.length === 0) {
+        return _jsx("span", { "data-pyric-provider-id": "anonymous", children: providerLabel('anonymous') });
+    }
+    return user.providerUserInfo.map((p) => (_jsx("span", { "data-pyric-provider-id": p.providerId, children: providerLabel(p.providerId) }, p.providerId)));
+}
+function defaultFormatDate(iso) {
+    if (!iso)
+        return '—';
+    const d = new Date(iso);
+    return Number.isNaN(d.getTime()) ? '—' : d.toLocaleDateString();
+}
+/**
+ * Headless users table — the emulator UI's columns (Identifier,
+ * Provider, Created, Signed In, User UID, actions) over the
+ * `data-pyric-*` styling contract, with role-based table semantics so
+ * rows can virtualize (a real `<table>` can't wrap a scroll container).
+ *
+ * The hook (`useAuthUsers`) owns data + filter state; this component
+ * just renders. Disabled accounts carry `data-pyric-user-disabled` for
+ * dimmed styling.
+ */
+export function AuthUserList({ users, isLoading, error, filter, onSelect, renderIdentifier, renderProviders, renderActions, formatDate = defaultFormatDate, emptyState, noResultsState, className, virtualizeThreshold = 100, rowHeight = 44, virtualizedHeight = '60vh', }) {
+    if (error) {
+        return (_jsx("div", { className: className, "data-pyric-ui": "auth-user-list", "data-pyric-error": "", role: "alert", children: error.message }));
+    }
+    if (isLoading && users.length === 0) {
+        return _jsx("div", { className: className, "data-pyric-ui": "auth-user-list", "data-pyric-loading": "" });
+    }
+    if (users.length === 0) {
+        const filtered = Boolean(filter?.trim());
+        return (_jsx("div", { className: className, "data-pyric-ui": "auth-user-list", "data-pyric-empty": "", "data-pyric-no-results": filtered ? '' : undefined, children: filtered
+                ? (noResultsState ?? 'No results')
+                : (emptyState ?? 'No users for this project yet') }));
+    }
+    const virtualized = users.length > virtualizeThreshold;
+    const row = (user) => (_jsxs("div", { role: "row", "data-pyric-user-entry": true, "data-pyric-user-uid": user.uid, "data-pyric-user-disabled": user.disabled ? '' : undefined, children: [_jsx("span", { role: "cell", "data-pyric-user-cell": "identifier", children: onSelect ? (_jsx("button", { type: "button", "data-pyric-user-select": true, onClick: () => onSelect(user), children: renderIdentifier ? renderIdentifier(user) : defaultIdentifier(user) })) : ((renderIdentifier ?? defaultIdentifier)(user)) }), _jsx("span", { role: "cell", "data-pyric-user-cell": "providers", children: (renderProviders ?? defaultProviders)(user) }), _jsx("span", { role: "cell", "data-pyric-user-cell": "created", children: formatDate(user.createdAt) }), _jsx("span", { role: "cell", "data-pyric-user-cell": "signed-in", children: formatDate(user.lastLoginAt) }), _jsx("span", { role: "cell", "data-pyric-user-cell": "uid", children: user.uid }), renderActions ? (_jsx("span", { role: "cell", "data-pyric-user-cell": "actions", children: renderActions(user) })) : null] }, user.uid));
+    return (_jsxs("div", { className: className, role: "table", "aria-label": "Authentication users", "data-pyric-ui": "auth-user-list", "data-pyric-virtualized": virtualized ? '' : undefined, children: [_jsxs("div", { role: "row", "data-pyric-user-header": true, children: [_jsx("span", { role: "columnheader", "data-pyric-user-cell": "identifier", children: "Identifier" }), _jsx("span", { role: "columnheader", "data-pyric-user-cell": "providers", children: "Provider" }), _jsx("span", { role: "columnheader", "data-pyric-user-cell": "created", children: "Created" }), _jsx("span", { role: "columnheader", "data-pyric-user-cell": "signed-in", children: "Signed In" }), _jsx("span", { role: "columnheader", "data-pyric-user-cell": "uid", children: "User UID" }), renderActions ? (_jsx("span", { role: "columnheader", "data-pyric-user-cell": "actions", "aria-label": "Actions" })) : null] }), virtualized ? (_jsx(VirtualList, { items: users, estimateSize: rowHeight, height: virtualizedHeight, getItemKey: (user) => user.uid, renderItem: row })) : (_jsx("div", { role: "rowgroup", "data-pyric-user-rows": true, children: users.map(row) }))] }));
+}
+//# sourceMappingURL=AuthUserList.js.map

package/dist/auth/components/AuthUserList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthUserList.js","sourceRoot":"","sources":["../../../src/auth/components/AuthUserList.tsx"],"names":[],"mappings":";AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAwChD,SAAS,iBAAiB,CAAC,IAAoB;IAC7C,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAoB;IAC5C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,yCAA6B,WAAW,YAAE,aAAa,CAAC,WAAW,CAAC,GAAQ,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACtC,yCAAiD,CAAC,CAAC,UAAU,YAC1D,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IADnB,CAAC,CAAC,UAAU,CAEhB,CACR,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,KAAK,EACL,SAAS,EACT,KAAK,EACL,MAAM,EACN,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,UAAU,GAAG,iBAAiB,EAC9B,UAAU,EACV,cAAc,EACd,SAAS,EACT,mBAAmB,GAAG,GAAG,EACzB,SAAS,GAAG,EAAE,EACd,iBAAiB,GAAG,MAAM,GACR;IAClB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CACL,cAAK,SAAS,EAAE,SAAS,mBAAgB,gBAAgB,sBAAkB,EAAE,EAAC,IAAI,EAAC,OAAO,YACvF,KAAK,CAAC,OAAO,GACV,CACP,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,cAAK,SAAS,EAAE,SAAS,mBAAgB,gBAAgB,wBAAoB,EAAE,GAAG,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CACL,cACE,SAAS,EAAE,SAAS,mBACN,gBAAgB,sBACb,EAAE,2BACI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,YAE/C,QAAQ;gBACP,CAAC,CAAC,CAAC,cAAc,IAAI,YAAY,CAAC;gBAClC,CAAC,CAAC,CAAC,UAAU,IAAI,+BAA+B,CAAC,GAC/C,CACP,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,mBAAmB,CAAC;IAEvD,MAAM,GAAG,GAAG,CAAC,IAAoB,EAAE,EAAE,CAAC,CACpC,eAEE,IAAI,EAAC,KAAK,wDAEW,IAAI,CAAC,GAAG,8BACH,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,aAExD,eAAM,IAAI,EAAC,MAAM,0BAAsB,YAAY,YAChD,QAAQ,CAAC,CAAC,CAAC,CACV,iBAAQ,IAAI,EAAC,QAAQ,kCAAwB,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YACvE,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAC7D,CACV,CAAC,CAAC,CAAC,CACF,CAAC,gBAAgB,IAAI,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAC9C,GACI,EACP,eAAM,IAAI,EAAC,MAAM,0BAAsB,WAAW,YAC/C,CAAC,eAAe,IAAI,gBAAgB,CAAC,CAAC,IAAI,CAAC,GACvC,EACP,eAAM,IAAI,EAAC,MAAM,0BAAsB,SAAS,YAC7C,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GACtB,EACP,eAAM,IAAI,EAAC,MAAM,0BAAsB,WAAW,YAC/C,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GACxB,EACP,eAAM,IAAI,EAAC,MAAM,0BAAsB,KAAK,YACzC,IAAI,CAAC,GAAG,GACJ,EACN,aAAa,CAAC,CAAC,CAAC,CACf,eAAM,IAAI,EAAC,MAAM,0BAAsB,SAAS,YAC7C,aAAa,CAAC,IAAI,CAAC,GACf,CACR,CAAC,CAAC,CAAC,IAAI,KA/BH,IAAI,CAAC,GAAG,CAgCT,CACP,CAAC;IAEF,OAAO,CACL,eACE,SAAS,EAAE,SAAS,EACpB,IAAI,EAAC,OAAO,gBACD,sBAAsB,mBACnB,gBAAgB,4BACN,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,aAEpD,eAAK,IAAI,EAAC,KAAK,6CACb,eAAM,IAAI,EAAC,cAAc,0BAAsB,YAAY,2BAAkB,EAC7E,eAAM,IAAI,EAAC,cAAc,0BAAsB,WAAW,yBAAgB,EAC1E,eAAM,IAAI,EAAC,cAAc,0BAAsB,SAAS,wBAAe,EACvE,eAAM,IAAI,EAAC,cAAc,0BAAsB,WAAW,0BAAiB,EAC3E,eAAM,IAAI,EAAC,cAAc,0BAAsB,KAAK,yBAAgB,EACnE,aAAa,CAAC,CAAC,CAAC,CACf,eAAM,IAAI,EAAC,cAAc,0BAAsB,SAAS,gBAAY,SAAS,GAAG,CACjF,CAAC,CAAC,CAAC,IAAI,IACJ,EACL,WAAW,CAAC,CAAC,CAAC,CACb,KAAC,WAAW,IACV,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,SAAS,EACvB,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAC9B,UAAU,EAAE,GAAG,GACf,CACH,CAAC,CAAC,CAAC,CACF,cAAK,IAAI,EAAC,UAAU,0CACjB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GACX,CACP,IACG,CACP,CAAC;AACJ,CAAC"}

package/dist/auth/components/ClaimsField.d.ts

@@ -0,0 +1,22 @@
+import type { ReactNode } from 'react';
+export interface ClaimsFieldProps {
+    /** Raw claims JSON text. */
+    value: string;
+    onChange: (text: string) => void;
+    /** Validation message (from `validateSerializedClaims` /
+     *  `useAuthUserEditor().errors.claims`). Renders a `role="alert"`
+     *  paragraph and marks the textarea invalid. */
+    error?: string;
+    /** Helper text under the field (rules-usage hint by default). */
+    hint?: ReactNode;
+    placeholder?: string;
+    className?: string;
+}
+/**
+ * Headless custom-claims textarea — the emulator UI's
+ * `customAttributes` control. Standalone so custom forms can reuse the
+ * exact field (the playground's sign-in helper and the user form both
+ * render one); validation itself lives in `validateSerializedClaims`.
+ */
+export declare function ClaimsField({ value, onChange, error, hint, placeholder, className, }: ClaimsFieldProps): import("react").JSX.Element;
+//# sourceMappingURL=ClaimsField.d.ts.map

package/dist/auth/components/ClaimsField.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimsField.d.ts","sourceRoot":"","sources":["../../../src/auth/components/ClaimsField.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC;;oDAEgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAC1B,KAAK,EACL,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,WAAgC,EAChC,SAAS,GACV,EAAE,gBAAgB,+BAoBlB"}

package/dist/auth/components/ClaimsField.js

@@ -0,0 +1,11 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Headless custom-claims textarea — the emulator UI's
+ * `customAttributes` control. Standalone so custom forms can reuse the
+ * exact field (the playground's sign-in helper and the user form both
+ * render one); validation itself lives in `validateSerializedClaims`.
+ */
+export function ClaimsField({ value, onChange, error, hint, placeholder = '{"role":"admin"}', className, }) {
+    return (_jsxs("div", { className: className, "data-pyric-ui": "claims-field", children: [_jsx("textarea", { "data-pyric-field": "claims", "data-pyric-claims-invalid": error != null ? '' : undefined, "aria-label": "Custom claims (optional)", "aria-invalid": error != null || undefined, placeholder: placeholder, value: value, onChange: (e) => onChange(e.target.value) }), error != null && (_jsx("p", { role: "alert", "data-pyric-claims-error": true, children: error })), hint != null && _jsx("p", { "data-pyric-claims-hint": true, children: hint })] }));
+}
+//# sourceMappingURL=ClaimsField.js.map

package/dist/auth/components/ClaimsField.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimsField.js","sourceRoot":"","sources":["../../../src/auth/components/ClaimsField.tsx"],"names":[],"mappings":";AAgBA;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,KAAK,EACL,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,WAAW,GAAG,kBAAkB,EAChC,SAAS,GACQ;IACjB,OAAO,CACL,eAAK,SAAS,EAAE,SAAS,mBAAgB,cAAc,aACrD,uCACmB,QAAQ,+BACE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,gBAC9C,0BAA0B,kBACvB,KAAK,IAAI,IAAI,IAAI,SAAS,EACxC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GACzC,EACD,KAAK,IAAI,IAAI,IAAI,CAChB,YAAG,IAAI,EAAC,OAAO,6CACZ,KAAK,GACJ,CACL,EACA,IAAI,IAAI,IAAI,IAAI,sDAA2B,IAAI,GAAK,IACjD,CACP,CAAC;AACJ,CAAC"}

package/dist/auth/components/confirmActions.d.ts

@@ -0,0 +1,40 @@
+import type { ReactNode } from 'react';
+import type { AuthUserRecord } from 'pyric/auth';
+/** Shared trigger contract for the confirm-gated destructive actions. */
+interface TriggerProps {
+    onClick: () => void;
+}
+export interface DeleteUserWithConfirmProps {
+    user: AuthUserRecord;
+    /** Runs after the user confirms. Wire to `useAuthUsers().deleteUser`. */
+    onDelete: (uid: string) => void;
+    title?: string;
+    body?: ReactNode;
+    confirmLabel?: string;
+    /** Trigger override; default is a plain destructive `<button>`. */
+    renderTrigger?: (props: TriggerProps) => ReactNode;
+    className?: string;
+}
+/**
+ * Confirm-gated single-user delete (the emulator UI's row-menu
+ * "Delete user"). Requires a `<ConfirmProvider>` ancestor.
+ */
+export declare function DeleteUserWithConfirm({ user, onDelete, title, body, confirmLabel, renderTrigger, className, }: DeleteUserWithConfirmProps): import("react").JSX.Element;
+export interface ClearUsersWithConfirmProps {
+    /** Runs after the user confirms. Wire to `useAuthUsers().clearUsers`. */
+    onClear: () => void;
+    /** Current user count, interpolated into the default body. */
+    count?: number;
+    title?: string;
+    body?: ReactNode;
+    confirmLabel?: string;
+    renderTrigger?: (props: TriggerProps) => ReactNode;
+    className?: string;
+}
+/**
+ * Confirm-gated clear-all (the emulator UI's "Clear all data").
+ * Requires a `<ConfirmProvider>` ancestor.
+ */
+export declare function ClearUsersWithConfirm({ onClear, count, title, body, confirmLabel, renderTrigger, className, }: ClearUsersWithConfirmProps): import("react").JSX.Element;
+export {};
+//# sourceMappingURL=confirmActions.d.ts.map

package/dist/auth/components/confirmActions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmActions.d.ts","sourceRoot":"","sources":["../../../src/auth/components/confirmActions.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGjD,yEAAyE;AACzE,UAAU,YAAY;IACpB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,cAAc,CAAC;IACrB,yEAAyE;IACzE,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,SAAS,CAAC;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,IAAI,EACJ,QAAQ,EACR,KAAqB,EACrB,IAAI,EACJ,YAAuB,EACvB,aAAa,EACb,SAAS,GACV,EAAE,0BAA0B,+BAuB5B;AAED,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,SAAS,CAAC;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,OAAO,EACP,KAAK,EACL,KAAyB,EACzB,IAAI,EACJ,YAAsB,EACtB,aAAa,EACb,SAAS,GACV,EAAE,0BAA0B,+BA2B5B"}

package/dist/auth/components/confirmActions.js

@@ -0,0 +1,49 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { useConfirm } from '../../primitives/useConfirm.js';
+function identifierOf(user) {
+    return user.email ?? user.phoneNumber ?? user.displayName ?? user.uid;
+}
+/**
+ * Confirm-gated single-user delete (the emulator UI's row-menu
+ * "Delete user"). Requires a `<ConfirmProvider>` ancestor.
+ */
+export function DeleteUserWithConfirm({ user, onDelete, title = 'Delete user', body, confirmLabel = 'Delete', renderTrigger, className, }) {
+    const confirm = useConfirm();
+    const handleClick = async () => {
+        const ok = await confirm({
+            title,
+            body: body ?? `This will permanently delete ${identifierOf(user)}.`,
+            destructive: true,
+            confirmLabel,
+        });
+        if (ok)
+            onDelete(user.uid);
+    };
+    if (renderTrigger)
+        return _jsx(_Fragment, { children: renderTrigger({ onClick: handleClick }) });
+    return (_jsx("button", { type: "button", className: className, "data-pyric-ui": "delete-user", "data-pyric-destructive": true, onClick: handleClick, children: "Delete user" }));
+}
+/**
+ * Confirm-gated clear-all (the emulator UI's "Clear all data").
+ * Requires a `<ConfirmProvider>` ancestor.
+ */
+export function ClearUsersWithConfirm({ onClear, count, title = 'Clear all users', body, confirmLabel = 'Clear', renderTrigger, className, }) {
+    const confirm = useConfirm();
+    const handleClick = async () => {
+        const ok = await confirm({
+            title,
+            body: body ??
+                (count != null
+                    ? `This will permanently delete all ${count} users.`
+                    : 'This will permanently delete every user.'),
+            destructive: true,
+            confirmLabel,
+        });
+        if (ok)
+            onClear();
+    };
+    if (renderTrigger)
+        return _jsx(_Fragment, { children: renderTrigger({ onClick: handleClick }) });
+    return (_jsx("button", { type: "button", className: className, "data-pyric-ui": "clear-users", "data-pyric-destructive": true, onClick: handleClick, children: "Clear all users" }));
+}
+//# sourceMappingURL=confirmActions.js.map

package/dist/auth/components/confirmActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmActions.js","sourceRoot":"","sources":["../../../src/auth/components/confirmActions.tsx"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAmB5D,SAAS,YAAY,CAAC,IAAoB;IACxC,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,IAAI,EACJ,QAAQ,EACR,KAAK,GAAG,aAAa,EACrB,IAAI,EACJ,YAAY,GAAG,QAAQ,EACvB,aAAa,EACb,SAAS,GACkB;IAC3B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE;QAC7B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,KAAK;YACL,IAAI,EAAE,IAAI,IAAI,gCAAgC,YAAY,CAAC,IAAI,CAAC,GAAG;YACnE,WAAW,EAAE,IAAI;YACjB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,IAAI,aAAa;QAAE,OAAO,4BAAG,aAAa,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,GAAI,CAAC;IACzE,OAAO,CACL,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAE,SAAS,mBACN,aAAa,kCAE3B,OAAO,EAAE,WAAW,4BAGb,CACV,CAAC;AACJ,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,OAAO,EACP,KAAK,EACL,KAAK,GAAG,iBAAiB,EACzB,IAAI,EACJ,YAAY,GAAG,OAAO,EACtB,aAAa,EACb,SAAS,GACkB;IAC3B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE;QAC7B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,KAAK;YACL,IAAI,EACF,IAAI;gBACJ,CAAC,KAAK,IAAI,IAAI;oBACZ,CAAC,CAAC,oCAAoC,KAAK,SAAS;oBACpD,CAAC,CAAC,0CAA0C,CAAC;YACjD,WAAW,EAAE,IAAI;YACjB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,IAAI,aAAa;QAAE,OAAO,4BAAG,aAAa,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,GAAI,CAAC;IACzE,OAAO,CACL,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAE,SAAS,mBACN,aAAa,kCAE3B,OAAO,EAAE,WAAW,gCAGb,CACV,CAAC;AACJ,CAAC"}

package/dist/auth/controller.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Sign-in helper controller — the host side of `pyric/auth`'s
+ * `AuthFlowResolver` seam.
+ *
+ * `pyric/auth` stays UI-free: `signInWithPopup` / `signInWithRedirect`
+ * delegate to a resolver. This controller IS that resolver's host
+ * implementation — it parks the SDK's promise, drives a host UI (an
+ * account picker + add-account form, e.g. `<AuthSignInHelper>`), and
+ * settles the promise when the user picks an identity, adds one, or
+ * cancels. React components stay thin presentational shells over this;
+ * all the settle/seed logic lives here so it's testable without a DOM.
+ *
+ * Faithful to the Firebase emulator: "add account" mints a sandbox
+ * identity with optional custom claims (the emulator's
+ * `customAttributes`), so a rule gated on `request.auth.token.<claim>`
+ * works against live sandbox traffic. Credential + token synthesis is
+ * backend-owned (`sandbox.createSignInCredential`) — this controller
+ * only drives the UI flow and settles the parked promise.
+ */
+import { sandbox as authSandbox, type Auth, type AuthFlowRequest, type AuthFlowResolver } from 'pyric/auth';
+/** A field set for "add new account" — mirrors the emulator's add-user form. */
+export interface NewIdentitySpec {
+    email: string;
+    displayName?: string;
+    /** Parsed custom claims (the emulator's `customAttributes`). */
+    customClaims?: Record<string, unknown>;
+}
+/** One pickable identity, as reported by `sandbox.listIdentities`. */
+export type SandboxIdentity = ReturnType<typeof authSandbox.listIdentities>[number];
+/** Snapshot the helper UI renders from. */
+export interface HelperState {
+    /** The in-flight request, or null when the helper is closed. */
+    request: AuthFlowRequest | null;
+    /** Existing identities to pick from (seeded + previously created). */
+    identities: SandboxIdentity[];
+}
+export declare class AuthFlowController {
+    private readonly auth;
+    private pending;
+    private readonly listeners;
+    /** Memoized {@link snapshot} result, invalidated by {@link emit}.
+     *  `useSyncExternalStore` compares consecutive `getSnapshot()` results
+     *  with `Object.is` — an uncached object here re-renders forever. */
+    private cached;
+    constructor(auth: Auth);
+    /** Wire this controller's resolver into the auth handle. Paired with
+     *  {@link uninstall} for use in a React effect (install in the body,
+     *  uninstall in the cleanup) — StrictMode-safe. */
+    install(): void;
+    uninstall(): void;
+    /** The resolver to hand to `sandbox.setAuthFlowResolver`. Popup and
+     *  redirect share one implementation (the sandbox has no navigation). */
+    resolver(): AuthFlowResolver;
+    subscribe(fn: () => void): () => void;
+    snapshot(): HelperState;
+    private emit;
+    /** Pick an existing identity (by uid). The backend mints the credential
+     *  (and records the provider on the identity). */
+    pick(uid: string): void;
+    /** Add + sign in as a new identity. The backend creates the identity
+     *  (so claims resolve in rules and it shows up in the picker next time)
+     *  and mints the credential in one step.
+     *
+     *  Credential creation happens BEFORE {@link take}'s emit: subscribers
+     *  recompute the snapshot synchronously on emit, so creating after would
+     *  publish a stale identity list (a `useSyncExternalStore` consumer
+     *  would miss the new account until the next unrelated emit). */
+    add(spec: NewIdentitySpec): void;
+    /** Dismiss — rejects with the faithful `auth/popup-closed-by-user`. */
+    cancel(): void;
+    private take;
+}
+//# sourceMappingURL=controller.d.ts.map

package/dist/auth/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/auth/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,OAAO,IAAI,WAAW,EACtB,KAAK,IAAI,EACT,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAEtB,MAAM,YAAY,CAAC;AAEpB,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpF,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,sEAAsE;IACtE,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAQD,qBAAa,kBAAkB;IAQjB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD;;yEAEqE;IACrE,OAAO,CAAC,MAAM,CAA4B;gBAEb,IAAI,EAAE,IAAI;IAEvC;;uDAEmD;IACnD,OAAO,IAAI,IAAI;IAIf,SAAS,IAAI,IAAI;IAIjB;6EACyE;IACzE,QAAQ,IAAI,gBAAgB;IAY5B,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAKrC,QAAQ,IAAI,WAAW;IAQvB,OAAO,CAAC,IAAI;IAMZ;sDACkD;IAClD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAgBvB;;;;;;;qEAOiE;IACjE,GAAG,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;IAoBhC,uEAAuE;IACvE,MAAM,IAAI,IAAI;IAMd,OAAO,CAAC,IAAI;CAMb"}

package/dist/auth/controller.js

@@ -0,0 +1,139 @@
+/**
+ * Sign-in helper controller — the host side of `pyric/auth`'s
+ * `AuthFlowResolver` seam.
+ *
+ * `pyric/auth` stays UI-free: `signInWithPopup` / `signInWithRedirect`
+ * delegate to a resolver. This controller IS that resolver's host
+ * implementation — it parks the SDK's promise, drives a host UI (an
+ * account picker + add-account form, e.g. `<AuthSignInHelper>`), and
+ * settles the promise when the user picks an identity, adds one, or
+ * cancels. React components stay thin presentational shells over this;
+ * all the settle/seed logic lives here so it's testable without a DOM.
+ *
+ * Faithful to the Firebase emulator: "add account" mints a sandbox
+ * identity with optional custom claims (the emulator's
+ * `customAttributes`), so a rule gated on `request.auth.token.<claim>`
+ * works against live sandbox traffic. Credential + token synthesis is
+ * backend-owned (`sandbox.createSignInCredential`) — this controller
+ * only drives the UI flow and settles the parked promise.
+ */
+import { sandbox as authSandbox, } from 'pyric/auth';
+export class AuthFlowController {
+    auth;
+    pending = null;
+    listeners = new Set();
+    /** Memoized {@link snapshot} result, invalidated by {@link emit}.
+     *  `useSyncExternalStore` compares consecutive `getSnapshot()` results
+     *  with `Object.is` — an uncached object here re-renders forever. */
+    cached = null;
+    constructor(auth) {
+        this.auth = auth;
+    }
+    /** Wire this controller's resolver into the auth handle. Paired with
+     *  {@link uninstall} for use in a React effect (install in the body,
+     *  uninstall in the cleanup) — StrictMode-safe. */
+    install() {
+        authSandbox.setAuthFlowResolver(this.auth, this.resolver());
+    }
+    uninstall() {
+        authSandbox.setAuthFlowResolver(this.auth, null);
+    }
+    /** The resolver to hand to `sandbox.setAuthFlowResolver`. Popup and
+     *  redirect share one implementation (the sandbox has no navigation). */
+    resolver() {
+        const open = (req) => new Promise((resolve, reject) => {
+            // One helper at a time: a new request supersedes any stale pending.
+            if (this.pending)
+                this.cancel();
+            this.pending = { req, resolve, reject };
+            this.emit();
+        });
+        return { openPopup: open, openRedirect: open };
+    }
+    // ─── React glue (subscribe + snapshot) ──────────────────────────────
+    subscribe(fn) {
+        this.listeners.add(fn);
+        return () => this.listeners.delete(fn);
+    }
+    snapshot() {
+        this.cached ??= {
+            request: this.pending?.req ?? null,
+            identities: authSandbox.listIdentities(this.auth),
+        };
+        return this.cached;
+    }
+    emit() {
+        this.cached = null;
+        for (const l of this.listeners)
+            l();
+    }
+    // ─── UI actions ─────────────────────────────────────────────────────
+    /** Pick an existing identity (by uid). The backend mints the credential
+     *  (and records the provider on the identity). */
+    pick(uid) {
+        const pending = this.pending;
+        if (!pending)
+            return;
+        let cred;
+        try {
+            cred = authSandbox.createSignInCredential(this.auth, {
+                providerId: pending.req.providerId,
+                uid,
+            });
+        }
+        catch (e) {
+            this.take()?.reject(e);
+            return;
+        }
+        this.take()?.resolve(cred);
+    }
+    /** Add + sign in as a new identity. The backend creates the identity
+     *  (so claims resolve in rules and it shows up in the picker next time)
+     *  and mints the credential in one step.
+     *
+     *  Credential creation happens BEFORE {@link take}'s emit: subscribers
+     *  recompute the snapshot synchronously on emit, so creating after would
+     *  publish a stale identity list (a `useSyncExternalStore` consumer
+     *  would miss the new account until the next unrelated emit). */
+    add(spec) {
+        const pending = this.pending;
+        if (!pending)
+            return;
+        let cred;
+        try {
+            cred = authSandbox.createSignInCredential(this.auth, {
+                providerId: pending.req.providerId,
+                spec: {
+                    email: spec.email,
+                    displayName: spec.displayName,
+                    customClaims: spec.customClaims,
+                },
+            });
+        }
+        catch (e) {
+            this.take()?.reject(e);
+            return;
+        }
+        this.take()?.resolve(cred);
+    }
+    /** Dismiss — rejects with the faithful `auth/popup-closed-by-user`. */
+    cancel() {
+        const p = this.take();
+        if (!p)
+            return;
+        p.reject(authError('auth/popup-closed-by-user', 'The popup has been closed by the user before finalizing the operation.'));
+    }
+    take() {
+        const p = this.pending;
+        this.pending = null;
+        this.emit();
+        return p;
+    }
+}
+function authError(code, message) {
+    const e = new Error(message);
+    e.name = 'FirebaseError';
+    e.code = code;
+    return e;
+}
+//# sourceMappingURL=controller.js.map

package/dist/auth/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/auth/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,OAAO,IAAI,WAAW,GAKvB,MAAM,YAAY,CAAC;AA2BpB,MAAM,OAAO,kBAAkB;IAQA;IAPrB,OAAO,GAAmB,IAAI,CAAC;IACtB,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IACnD;;yEAEqE;IAC7D,MAAM,GAAuB,IAAI,CAAC;IAE1C,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C;;uDAEmD;IACnD,OAAO;QACL,WAAW,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS;QACP,WAAW,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IAED;6EACyE;IACzE,QAAQ;QACN,MAAM,IAAI,GAAG,CAAC,GAAoB,EAA2B,EAAE,CAC7D,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,oEAAoE;YACpE,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;QACL,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,uEAAuE;IACvE,SAAS,CAAC,EAAc;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,MAAM,KAAK;YACd,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI;YAClC,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;SAClD,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS;YAAE,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,uEAAuE;IACvE;sDACkD;IAClD,IAAI,CAAC,GAAW;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,IAAoB,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,WAAW,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE;gBACnD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;gBAClC,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;qEAOiE;IACjE,GAAG,CAAC,IAAqB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,IAAoB,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,WAAW,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE;gBACnD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;gBAClC,IAAI,EAAE;oBACJ,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,uEAAuE;IACvE,MAAM;QACJ,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,2BAA2B,EAAE,wEAAwE,CAAC,CAAC,CAAC;IAC7H,CAAC;IAEO,IAAI;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;CACF;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAA6B,CAAC;IACzD,CAAC,CAAC,IAAI,GAAG,eAAe,CAAC;IACzB,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACd,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/auth/hooks/index.d.ts

@@ -0,0 +1,7 @@
+export { useAuthFlowHelper, type UseAuthFlowHelperResult, } from './useAuthFlowHelper.js';
+export { useAuthUsers, type UseAuthUsersResult, } from './useAuthUsers.js';
+export { useAuthProviderConfig, type AuthProviderConfigEntry, type UseAuthProviderConfigResult, } from './useAuthProviderConfig.js';
+export { useAuthUserEditor, type UseAuthUserEditorOptions, type UseAuthUserEditorResult, } from './useAuthUserEditor.js';
+export { authUserEditorReducer, initAuthUserEditorState, fieldsFromRecord, validateAuthUserFields, toCreateRequest, toUpdateRequest, type AuthUserEditorAction, type AuthUserEditorErrors, type AuthUserEditorFields, type AuthUserEditorState, } from '../reducers/userEditor.js';
+export { AuthFlowController, type HelperState, type NewIdentitySpec, type SandboxIdentity, } from '../controller.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/hooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,EACZ,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC"}

package/dist/auth/hooks/index.js

@@ -0,0 +1,7 @@
+export { useAuthFlowHelper, } from './useAuthFlowHelper.js';
+export { useAuthUsers, } from './useAuthUsers.js';
+export { useAuthProviderConfig, } from './useAuthProviderConfig.js';
+export { useAuthUserEditor, } from './useAuthUserEditor.js';
+export { authUserEditorReducer, initAuthUserEditorState, fieldsFromRecord, validateAuthUserFields, toCreateRequest, toUpdateRequest, } from '../reducers/userEditor.js';
+export { AuthFlowController, } from '../controller.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/hooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,GAEb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,GAGtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,GAGlB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,GAKhB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,GAInB,MAAM,kBAAkB,CAAC"}

package/dist/auth/hooks/useAuthFlowHelper.d.ts

@@ -0,0 +1,30 @@
+import type { Auth } from 'pyric/auth';
+import { type HelperState, type NewIdentitySpec } from '../controller.js';
+export interface UseAuthFlowHelperResult {
+    /** Render snapshot: the in-flight request (or null) + pickable identities. */
+    state: HelperState;
+    /** Settle the flow with an existing identity (by uid). */
+    pick: (uid: string) => void;
+    /** Create + sign in as a new identity (seeds it for next time). */
+    add: (spec: NewIdentitySpec) => void;
+    /** Dismiss — rejects the app's sign-in promise with
+     *  `auth/popup-closed-by-user` (faithful to `firebase/auth`). */
+    cancel: () => void;
+}
+/**
+ * Emulator-style sign-in helper for a sandbox `Auth` handle.
+ *
+ * Installs an {@link AuthFlowController} as the handle's
+ * `AuthFlowResolver` for the lifetime of the calling component — the
+ * analog of browser `getAuth` wiring `browserPopupRedirectResolver`.
+ * While mounted, any `signInWithPopup` / `signInWithRedirect` call made
+ * against `auth` parks on `state.request`; render an account-picker UI
+ * (e.g. `<AuthSignInHelper>`) from `state` and settle with
+ * `pick` / `add` / `cancel`.
+ *
+ * Install/uninstall is a paired effect, so the StrictMode double-mount
+ * installs and cleanly uninstalls. Sandbox-only: the controller throws
+ * `failed-precondition` if `auth` is prod-backed.
+ */
+export declare function useAuthFlowHelper(auth: Auth): UseAuthFlowHelperResult;
+//# sourceMappingURL=useAuthFlowHelper.d.ts.map

package/dist/auth/hooks/useAuthFlowHelper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthFlowHelper.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthFlowHelper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,KAAK,EAAE,WAAW,CAAC;IACnB,0DAA0D;IAC1D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,mEAAmE;IACnE,GAAG,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAC;IACrC;qEACiE;IACjE,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,uBAAuB,CAmBrE"}

package/dist/auth/hooks/useAuthFlowHelper.js

@@ -0,0 +1,30 @@
+import { useCallback, useEffect, useMemo, useSyncExternalStore } from 'react';
+import { AuthFlowController, } from '../controller.js';
+/**
+ * Emulator-style sign-in helper for a sandbox `Auth` handle.
+ *
+ * Installs an {@link AuthFlowController} as the handle's
+ * `AuthFlowResolver` for the lifetime of the calling component — the
+ * analog of browser `getAuth` wiring `browserPopupRedirectResolver`.
+ * While mounted, any `signInWithPopup` / `signInWithRedirect` call made
+ * against `auth` parks on `state.request`; render an account-picker UI
+ * (e.g. `<AuthSignInHelper>`) from `state` and settle with
+ * `pick` / `add` / `cancel`.
+ *
+ * Install/uninstall is a paired effect, so the StrictMode double-mount
+ * installs and cleanly uninstalls. Sandbox-only: the controller throws
+ * `failed-precondition` if `auth` is prod-backed.
+ */
+export function useAuthFlowHelper(auth) {
+    const controller = useMemo(() => new AuthFlowController(auth), [auth]);
+    useEffect(() => {
+        controller.install();
+        return () => controller.uninstall();
+    }, [controller]);
+    const state = useSyncExternalStore(useCallback((cb) => controller.subscribe(cb), [controller]), () => controller.snapshot(), () => controller.snapshot());
+    const pick = useCallback((uid) => controller.pick(uid), [controller]);
+    const add = useCallback((spec) => controller.add(spec), [controller]);
+    const cancel = useCallback(() => controller.cancel(), [controller]);
+    return { state, pick, add, cancel };
+}
+//# sourceMappingURL=useAuthFlowHelper.js.map

package/dist/auth/hooks/useAuthFlowHelper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthFlowHelper.js","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthFlowHelper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAE9E,OAAO,EACL,kBAAkB,GAGnB,MAAM,kBAAkB,CAAC;AAc1B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAU;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,SAAS,CAAC,GAAG,EAAE;QACb,UAAU,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;IACtC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,KAAK,GAAG,oBAAoB,CAChC,WAAW,CAAC,CAAC,EAAc,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EACvE,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAC3B,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,CAC5B,CAAC;IAEF,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,IAAqB,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEpE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC"}

package/dist/auth/hooks/useAuthProviderConfig.d.ts

@@ -0,0 +1,37 @@
+import type { Auth } from 'pyric/auth';
+/** One provider's current enablement, as the hook exposes it. */
+export interface AuthProviderConfigEntry {
+    providerId: string;
+    enabled: boolean;
+}
+export interface UseAuthProviderConfigResult {
+    /** Every provider this sandbox has an explicit enablement for. Unknown
+     *  providers (never toggled) are simply absent — `isEnabled` treats an
+     *  absent entry as disabled, matching the backend default. */
+    config: AuthProviderConfigEntry[];
+    isLoading: boolean;
+    error: Error | undefined;
+    /** Convenience lookup: `false` for a provider that's never been toggled. */
+    isEnabled: (providerId: string) => boolean;
+    /** Toggle a provider on/off. Sync (in-process) failures throw to the
+     *  caller, same policy as `useAuthUsers`'s mutation callbacks; an ASYNC
+     *  (worker-RPC) failure can't reach a sync caller, so it surfaces on the
+     *  hook's `error` state instead — never an unhandled rejection. */
+    setEnabled: (providerId: string, enabled: boolean) => void;
+    /** Re-read manually. Rarely needed — every mutation (this hook's own
+     *  `setEnabled`, another handle, the agent) already triggers the
+     *  subscription re-list. */
+    refresh: () => void;
+}
+/**
+ * Live sign-in provider config view over a sandbox `Auth` handle:
+ * `sandbox.getAuthProviderConfig` + `sandbox.subscribeAuthProviderConfig` +
+ * `sandbox.setAuthProviderConfig`. Mirrors `useAuthUsers`'s shape exactly
+ * (coarse "something changed, re-list" subscription; sync in-process,
+ * tolerates a promise over the SharedWorker client).
+ *
+ * Sandbox-only: throws `failed-precondition` on a prod-backed handle (the
+ * hook surfaces that via `error`, same as `useAuthUsers`).
+ */
+export declare function useAuthProviderConfig(auth: Auth): UseAuthProviderConfigResult;
+//# sourceMappingURL=useAuthProviderConfig.d.ts.map

package/dist/auth/hooks/useAuthProviderConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthProviderConfig.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthProviderConfig.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAGvC,iEAAiE;AACjE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C;;kEAE8D;IAC9D,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC;IACzB,4EAA4E;IAC5E,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;;uEAGmE;IACnE,UAAU,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3D;;gCAE4B;IAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,2BAA2B,CAkG7E"}