pyric-admin 0.1.0-alpha.7

package/dist/storage/index.js

@@ -0,0 +1,442 @@
+/**
+ * `pyric-admin/storage` — Phase 3 + Phase 4b implementation.
+ *
+ * Mirrors `firebase-admin/storage` with sandbox + prod backends, both
+ * selected at {@link initializeApp} time on `pyric-admin/app` (ADR-001
+ * D6). Dispatch reads the {@link ADMIN_APP_TARGET} brand on the
+ * `PyricAdminApp` handle — no structural duck-typing, no per-call
+ * shape probing.
+ *
+ *   - **Prod path** — delegates to `firebase-admin/storage`'s
+ *     `getStorage(adminApp)`. The returned object is the genuine
+ *     production `Storage`, so every method on `Storage` / `Bucket` /
+ *     `File` (from `@google-cloud/storage`) is present unchanged.
+ *
+ *   - **Remote sandbox path** — a handle branded by `pyric-tools`'
+ *     `connectRemoteSandbox()`/`remoteSandbox()` relays every data
+ *     operation over the bridge to the browser-hosted SharedWorker's
+ *     object store (admin lens pinned — rules bypass). Single bucket;
+ *     8 MiB per-op byte cap; `getSignedUrl` stays the local stub. See
+ *     the remote arm section below.
+ *
+ *   - **Sandbox path** — returns an in-process {@link Storage} backed
+ *     by an in-memory `Map<bucketName, Map<path, FileEntry>>`. State
+ *     lives on the {@link Sandbox} via a `WeakMap`, so `sandbox.reset()`
+ *     wipes it alongside Firestore / Auth state. Multi-bucket isolation
+ *     is real — buckets are independent maps.
+ *
+ *     Supported sandbox surface (the minimum a session-archive flow
+ *     needs):
+ *       - `storage.bucket(name?)` → {@link Bucket}-shaped handle
+ *       - `bucket.file(path)` → {@link File}-shaped handle
+ *       - `file.save(data, options?)` — `Buffer | string | Uint8Array`
+ *       - `file.download(options?)` → `[Buffer]`
+ *       - `file.delete()` — idempotent
+ *       - `file.exists()` → `[boolean]`
+ *       - `file.getSignedUrl(options)` → `['pyric-sandbox-storage://…']`
+ *
+ *     **Deferred in the sandbox backend** (throws `"not implemented in
+ *     pyric-admin/storage sandbox backend"`): streaming uploads
+ *     (`createWriteStream`), resumable uploads, signed cookies, IAM
+ *     policies, lifecycle rules, ACLs, copy/move, notifications. The
+ *     prod path keeps every one of these — only the sandbox stub omits
+ *     them.
+ */
+import { getStorage as getProdStorage } from 'firebase-admin/storage';
+import { isRemoteSandbox, } from 'pyric/sandbox';
+import { ADMIN_APP_TARGET, getApp, } from '../app/index.js';
+/**
+ * Get the {@link Storage} service for the given app.
+ *
+ * - **Prod app** → returns `firebase-admin/storage`'s `Storage` for
+ *   the underlying `adminApp`. Drop-in compatible with production
+ *   code that uses `firebase-admin/storage` directly.
+ * - **Sandbox app** → returns a sandbox-backed `Storage` whose state
+ *   lives on the `Sandbox`. `sandbox.reset()` wipes it.
+ */
+export function getStorage(app) {
+    // No-arg call resolves the default app; nothing initialized → captured
+    // `app/no-app` FirebaseAppError (see pyric-admin/app getApp).
+    const resolved = app === undefined ? getApp() : app;
+    if (resolved[ADMIN_APP_TARGET] === 'sandbox') {
+        // Remote brand checked BEFORE the local arm (same dispatch order as
+        // auth/database): the local arm's WeakMap state + `onEvent` reset hook
+        // must never touch a remote handle — local state keyed off a remote
+        // handle would be a private server-side store the browser never sees,
+        // and `onEvent` throws on remote handles by design.
+        if (isRemoteSandbox(resolved.sandbox)) {
+            return getRemoteStorage(resolved.sandbox);
+        }
+        return getSandboxStorage(resolved);
+    }
+    if (resolved[ADMIN_APP_TARGET] === 'prod') {
+        return getProdStorageHandle(resolved);
+    }
+    // Defensive: the union is closed at the type level. A runtime value
+    // that lands here means a caller forged a handle without going
+    // through `initializeApp`.
+    throw new TypeError('pyric-admin/storage: getStorage expected a PyricAdminApp from `initializeApp`; ' +
+        'received a value with no recognized ADMIN_APP_TARGET brand.');
+}
+// ─── Prod path ──────────────────────────────────────────────────────────
+/**
+ * Resolve the prod path. The returned `Storage` is the unmodified
+ * `firebase-admin/storage` handle — every `Bucket` / `File` method
+ * works exactly as documented in `@google-cloud/storage`.
+ *
+ * We assert-cast the result to our local {@link Storage} interface:
+ * structurally it's a superset (same `bucket(name?)` shape) and
+ * exposing the broader surface gives callers full access without
+ * forcing them back into a `firebase-admin/storage` import.
+ */
+function getProdStorageHandle(app) {
+    const prod = getProdStorage(app.adminApp);
+    return prod;
+}
+// ─── Sandbox path ───────────────────────────────────────────────────────
+/**
+ * Default sandbox bucket name. Matches the `pyric-default` used by the
+ * `pyric/storage` modular sandbox so consumers that switch between
+ * surfaces don't see an unexpected bucket name change.
+ */
+const DEFAULT_SANDBOX_BUCKET = 'pyric-default';
+/**
+ * State + reset-handler registry keyed on `Sandbox` so a single
+ * Sandbox shares its storage across every `getStorage` call. The
+ * `WeakMap` lets a discarded `Sandbox` (and its state) be GC'd
+ * naturally.
+ */
+const SANDBOX_STATE = new WeakMap();
+/**
+ * Reset-subscription bookkeeping. We subscribe to `sandbox.onEvent`
+ * once per Sandbox and re-create the bucket map on
+ * `session_boundary` events with `phase: 'reset'`. Without this,
+ * `sandbox.reset()` would wipe Firestore but leave storage untouched —
+ * a leak the sandbox model deliberately avoids.
+ */
+const RESET_HOOKED = new WeakSet();
+function ensureBucketMap(sandbox) {
+    let map = SANDBOX_STATE.get(sandbox);
+    if (!map) {
+        map = new Map();
+        SANDBOX_STATE.set(sandbox, map);
+    }
+    if (!RESET_HOOKED.has(sandbox)) {
+        RESET_HOOKED.add(sandbox);
+        sandbox.onEvent((event) => {
+            if (event.kind === 'session_boundary' && event.phase === 'reset') {
+                // Replace the map in place so existing Storage / Bucket / File
+                // handles keep working but observe an empty state.
+                const existing = SANDBOX_STATE.get(sandbox);
+                if (existing)
+                    existing.clear();
+            }
+        });
+    }
+    return map;
+}
+function getSandboxStorage(app) {
+    const sandbox = app.sandbox;
+    const buckets = ensureBucketMap(sandbox);
+    return new SandboxStorage(buckets);
+}
+/**
+ * Sandbox `Storage` implementation. Holds a reference to the per-
+ * sandbox bucket map; each `bucket()` call returns a fresh `Bucket`
+ * handle bound to the same underlying map, mirroring how
+ * `@google-cloud/storage` returns lightweight per-call handles.
+ */
+class SandboxStorage {
+    buckets;
+    constructor(buckets) {
+        this.buckets = buckets;
+    }
+    bucket(name) {
+        const bucketName = name ?? DEFAULT_SANDBOX_BUCKET;
+        let files = this.buckets.get(bucketName);
+        if (!files) {
+            files = new Map();
+            this.buckets.set(bucketName, files);
+        }
+        return new SandboxBucket(bucketName, files);
+    }
+}
+class SandboxBucket {
+    name;
+    files;
+    constructor(name, files) {
+        this.name = name;
+        this.files = files;
+    }
+    file(path) {
+        return new SandboxFile(path, this, this.files);
+    }
+}
+class SandboxFile {
+    name;
+    bucket;
+    files;
+    constructor(name, bucket, files) {
+        this.name = name;
+        this.bucket = bucket;
+        this.files = files;
+    }
+    async save(data, options = {}) {
+        if (options.resumable === true) {
+            throw new Error('not implemented in pyric-admin/storage sandbox backend: resumable uploads');
+        }
+        const bytes = toBytes(data);
+        const metadata = options.metadata ?? {};
+        const entry = {
+            data: bytes,
+            metadata,
+            ...(options.contentType !== undefined ? { contentType: options.contentType } : {}),
+        };
+        this.files.set(this.name, entry);
+    }
+    async download(_options = {}) {
+        const entry = this.files.get(this.name);
+        if (!entry) {
+            // Mirror the gcs/firebase-admin error message shape so consumer
+            // catch-blocks that string-match `No such object` keep working.
+            throw new Error(`No such object: ${this.bucket.name}/${this.name}`);
+        }
+        return [Buffer.from(entry.data)];
+    }
+    async delete() {
+        this.files.delete(this.name);
+    }
+    async exists() {
+        return [this.files.has(this.name)];
+    }
+    async getSignedUrl(options) {
+        return [stubSignedUrl(this.bucket.name, this.name, options)];
+    }
+    // ─── Deferred surface (declared so TS callers see a clear error) ────
+    /** @deprecated Streaming writes are deferred — see module header. */
+    createWriteStream() {
+        throw new Error('not implemented in pyric-admin/storage sandbox backend: createWriteStream');
+    }
+    /** @deprecated Streaming reads are deferred — see module header. */
+    createReadStream() {
+        throw new Error('not implemented in pyric-admin/storage sandbox backend: createReadStream');
+    }
+}
+// ─── Remote sandbox arm (remote sandbox, slice 2) ───────────────────────
+//
+// The app's `Sandbox` is a Node-side handle onto the browser-hosted
+// SharedWorker sandbox. Every data operation relays over the handle's
+// worker channel with `actAs: { mode: 'admin' }` pinned — firebase-admin's
+// rules-bypass semantics against the ONE object store the app + Studio +
+// agents share (the host resolves the lens to `pyric/storage/internal`'s
+// admin plane). There is deliberately NO local state here: a `WeakMap`
+// bucket map keyed off a remote handle would be private server-side data
+// the browser never sees, and the local arm's `onEvent` reset hook throws
+// on remote handles by design.
+//
+// Divergences from the local arm, all LOUD:
+//   - single bucket: the worker's `pyric/storage` store is single-bucket
+//     ("the data store is shared" — bucket names only round-trip in
+//     metadata), so `bucket('non-default')` throws instead of silently
+//     merging buckets. The default bucket name matches the local arm.
+//   - byte payloads are capped at 8 MiB per op (whole-object buffering
+//     over four relay hops; streaming stays unsupported on both arms).
+// `getSignedUrl` does NOT relay: it stays the byte-identical local stub.
+/** firebase-admin's rules-bypass lens, pinned on every relayed operation. */
+const STORAGE_REMOTE_ADMIN_LENS = { mode: 'admin' };
+/**
+ * Raw per-op byte cap for relayed storage payloads. MUST mirror
+ * `pyric-tools`' `MAX_STORAGE_OP_BYTES` (serve/worker/protocol.ts) — the
+ * worker host enforces the same cap on its end. Inlined (like the RTDB
+ * push-id generator) because `pyric-admin` deliberately does not depend on
+ * `pyric-tools`.
+ */
+const MAX_REMOTE_STORAGE_OP_BYTES = 8 * 1024 * 1024;
+/** One remote `Storage` per remote handle (handles only — never data). */
+const remoteStorageBySandbox = new WeakMap();
+function getRemoteStorage(sandbox) {
+    let storage = remoteStorageBySandbox.get(sandbox);
+    if (!storage) {
+        storage = new RemoteStorage(sandbox.channel);
+        remoteStorageBySandbox.set(sandbox, storage);
+    }
+    return storage;
+}
+class RemoteStorage {
+    channel;
+    constructor(channel) {
+        this.channel = channel;
+    }
+    bucket(name) {
+        // The worker's object store is single-bucket. A non-default name can't
+        // be faithfully relayed — throw loudly instead of silently merging
+        // buckets (the local arm has REAL multi-bucket isolation; this is the
+        // sharpest local/remote divergence, so it must be explicit).
+        if (name !== undefined && name !== DEFAULT_SANDBOX_BUCKET) {
+            throw new Error(`pyric-admin/storage: the remote (browser) sandbox has a single bucket — ` +
+                `bucket('${name}') cannot be isolated. Use bucket() (the default ` +
+                `'${DEFAULT_SANDBOX_BUCKET}' bucket) instead.`);
+        }
+        return new RemoteBucket(DEFAULT_SANDBOX_BUCKET, this.channel);
+    }
+}
+class RemoteBucket {
+    name;
+    channel;
+    constructor(name, channel) {
+        this.name = name;
+        this.channel = channel;
+    }
+    file(path) {
+        return new RemoteFile(path, this, this.channel);
+    }
+}
+class RemoteFile {
+    name;
+    bucket;
+    channel;
+    constructor(name, bucket, channel) {
+        this.name = name;
+        this.bucket = bucket;
+        this.channel = channel;
+    }
+    async save(data, options = {}) {
+        if (options.resumable === true) {
+            throw new Error('not implemented in pyric-admin/storage remote sandbox backend: resumable uploads');
+        }
+        const bytes = toBytes(data);
+        if (bytes.byteLength > MAX_REMOTE_STORAGE_OP_BYTES) {
+            throw payloadTooLarge(bytes.byteLength, `save() payload for '${this.name}'`);
+        }
+        await this.channel.op({
+            method: 'storage.putBytes',
+            path: this.name,
+            dataB64: Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString('base64'),
+            ...(options.contentType !== undefined ? { contentType: options.contentType } : {}),
+            ...(options.metadata !== undefined ? { metadata: options.metadata } : {}),
+            actAs: STORAGE_REMOTE_ADMIN_LENS,
+        });
+    }
+    async download(_options = {}) {
+        let wire;
+        try {
+            wire = (await this.channel.op({
+                method: 'storage.getBytes',
+                path: this.name,
+                actAs: STORAGE_REMOTE_ADMIN_LENS,
+            }));
+        }
+        catch (err) {
+            if (isObjectNotFound(err)) {
+                // Mirror the gcs/firebase-admin (and local arm) message shape so
+                // consumer catch-blocks that string-match `No such object` work
+                // identically across arms.
+                throw new Error(`No such object: ${this.bucket.name}/${this.name}`);
+            }
+            throw err;
+        }
+        return [Buffer.from(wire.dataB64, 'base64')];
+    }
+    async delete() {
+        try {
+            await this.channel.op({
+                method: 'storage.deleteObject',
+                path: this.name,
+                actAs: STORAGE_REMOTE_ADMIN_LENS,
+            });
+        }
+        catch (err) {
+            // The worker store's delete is already idempotent, but swallow a
+            // not-found defensively so the local arm's idempotent-delete contract
+            // holds even if `pyric/storage` adopts the strict prod throw later.
+            if (isObjectNotFound(err))
+                return;
+            throw err;
+        }
+    }
+    async exists() {
+        try {
+            await this.channel.op({
+                method: 'storage.getMetadata',
+                path: this.name,
+                actAs: STORAGE_REMOTE_ADMIN_LENS,
+            });
+            return [true];
+        }
+        catch (err) {
+            if (isObjectNotFound(err))
+                return [false];
+            throw err;
+        }
+    }
+    /** Local stub — byte-identical to the local arm's (no data needed, so it
+     *  never relays). The sandbox does NOT serve the URL. */
+    async getSignedUrl(options) {
+        return [stubSignedUrl(this.bucket.name, this.name, options)];
+    }
+    // ─── Deferred surface (remediating throws, remote-flavored) ─────────
+    createWriteStream() {
+        throw new Error('not implemented in pyric-admin/storage remote sandbox backend: createWriteStream — ' +
+            'streams cannot span the bridge relay; use file.save(buffer) (≤ 8 MiB) instead.');
+    }
+    createReadStream() {
+        throw new Error('not implemented in pyric-admin/storage remote sandbox backend: createReadStream — ' +
+            'streams cannot span the bridge relay; use file.download() (≤ 8 MiB) instead.');
+    }
+}
+/** Is this relayed error the worker's `storage/object-not-found`? */
+function isObjectNotFound(err) {
+    return err?.code === 'storage/object-not-found';
+}
+/** Over-cap rejection (code `payload-too-large`) — mirrors the worker host's
+ *  message shape and names the streaming gap. */
+function payloadTooLarge(sizeBytes, what) {
+    const err = new Error(`pyric-admin/storage: ${what} is ${sizeBytes} bytes — over the ` +
+        `${MAX_REMOTE_STORAGE_OP_BYTES / (1024 * 1024)} MiB remote storage op cap. ` +
+        'Streaming/resumable transfers are not supported on the sandbox backend; ' +
+        'split the object or keep it under the cap.');
+    err.code = 'payload-too-large';
+    return err;
+}
+// ─── Helpers ────────────────────────────────────────────────────────────
+/**
+ * The deterministic sandbox signed-URL stub, shared by the local and remote
+ * arms so their output is byte-identical (the URL is never served — it's a
+ * stable placeholder for logs/fixtures/replay).
+ */
+function stubSignedUrl(bucketName, path, options) {
+    const expiresMs = normalizeExpires(options.expires);
+    return `pyric-sandbox-storage://${bucketName}/${path}?expires=${expiresMs}&action=${options.action}`;
+}
+/**
+ * Normalize `Buffer | string | Uint8Array` into a fresh `Uint8Array`.
+ * We copy on ingest so callers can mutate their input buffer without
+ * corrupting stored state — mirrors how `firebase-admin/storage` /
+ * `@google-cloud/storage` treat `save` inputs.
+ */
+function toBytes(data) {
+    if (typeof data === 'string') {
+        return new TextEncoder().encode(data);
+    }
+    // Both Buffer (Node) and Uint8Array land here — copy into a new
+    // Uint8Array so the stored bytes are independent of the caller's
+    // reference. `slice()` produces a copy in both cases.
+    return new Uint8Array(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength));
+}
+/**
+ * Normalize the `expires` field into ms-since-epoch. Mirrors the
+ * accepted shapes from `@google-cloud/storage`'s `GetSignedUrlOptions`.
+ * The sandbox doesn't enforce expiration — the value is only embedded
+ * in the stub URL so consumers can round-trip it.
+ */
+function normalizeExpires(expires) {
+    if (typeof expires === 'number')
+        return expires;
+    if (expires instanceof Date)
+        return expires.getTime();
+    // String form — accept anything `Date` parses. Bogus input becomes
+    // `NaN`, which is still embeddable in the URL; we don't enforce
+    // strictness because the prod path delegates this to GCS anyway.
+    return new Date(expires).getTime();
+}
+//# sourceMappingURL=index.js.map

package/dist/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEtE,OAAO,EACL,eAAe,GAIhB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,gBAAgB,EAChB,MAAM,GAIP,MAAM,iBAAiB,CAAC;AAqIzB;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB;IACzC,uEAAuE;IACvE,8DAA8D;IAC9D,MAAM,QAAQ,GAAkB,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAE,GAAqB,CAAC;IACtF,IAAI,QAAQ,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7C,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,oDAAoD;QACpD,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,CAAC,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,oEAAoE;IACpE,+DAA+D;IAC/D,2BAA2B;IAC3B,MAAM,IAAI,SAAS,CACjB,iFAAiF;QAC/E,6DAA6D,CAChE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAE3E;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,GAAiB;IAC7C,MAAM,IAAI,GAAgB,cAAc,CAAC,GAAG,CAAC,QAAoB,CAAC,CAAC;IACnE,OAAO,IAA0B,CAAC;AACpC,CAAC;AAED,2EAA2E;AAE3E;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAY/C;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,OAAO,EAAsB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,IAAI,OAAO,EAAW,CAAC;AAE5C,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;QAChB,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACxB,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;gBACjE,+DAA+D;gBAC/D,mDAAmD;gBACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,IAAI,QAAQ;oBAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,cAAc;IACW;IAA7B,YAA6B,OAAkB;QAAlB,YAAO,GAAP,OAAO,CAAW;IAAG,CAAC;IAEnD,MAAM,CAAC,IAAa;QAClB,MAAM,UAAU,GAAG,IAAI,IAAI,sBAAsB,CAAC;QAClD,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,aAAa;IAEN;IACQ;IAFnB,YACW,IAAY,EACJ,KAA6B;QADrC,SAAI,GAAJ,IAAI,CAAQ;QACJ,UAAK,GAAL,KAAK,CAAwB;IAC7C,CAAC;IAEJ,IAAI,CAAC,IAAY;QACf,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;CACF;AAED,MAAM,WAAW;IAEJ;IACA;IACQ;IAHnB,YACW,IAAY,EACZ,MAAc,EACN,KAA6B;QAFrC,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;QACN,UAAK,GAAL,KAAK,CAAwB;IAC7C,CAAC;IAEJ,KAAK,CAAC,IAAI,CACR,IAAkC,EAClC,UAAuB,EAAE;QAEzB,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAc;YACvB,IAAI,EAAE,KAAK;YACX,QAAQ;YACR,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAA4B,EAAE;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,gEAAgE;YAChE,gEAAgE;YAChE,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,uEAAuE;IAEvE,qEAAqE;IACrE,iBAAiB;QACf,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,gBAAgB;QACd,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;CACF;AAED,2EAA2E;AAC3E,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,+BAA+B;AAC/B,EAAE;AACF,4CAA4C;AAC5C,yEAAyE;AACzE,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AAEzE,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,EAAE,IAAI,EAAE,OAAO,EAAW,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAAoB,CAAC;AAE/D,SAAS,gBAAgB,CAAC,OAAsB;IAC9C,IAAI,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,MAAM,aAAa;IACY;IAA7B,YAA6B,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;IAAG,CAAC;IAE9D,MAAM,CAAC,IAAa;QAClB,uEAAuE;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,6DAA6D;QAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,WAAW,IAAI,mDAAmD;gBAClE,IAAI,sBAAsB,oBAAoB,CACjD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AAED,MAAM,YAAY;IAEL;IACQ;IAFnB,YACW,IAAY,EACJ,OAA6B;QADrC,SAAI,GAAJ,IAAI,CAAQ;QACJ,YAAO,GAAP,OAAO,CAAsB;IAC7C,CAAC;IAEJ,IAAI,CAAC,IAAY;QACf,OAAO,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;CACF;AAED,MAAM,UAAU;IAEH;IACA;IACQ;IAHnB,YACW,IAAY,EACZ,MAAc,EACN,OAA6B;QAFrC,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;QACN,YAAO,GAAP,OAAO,CAAsB;IAC7C,CAAC;IAEJ,KAAK,CAAC,IAAI,CACR,IAAkC,EAClC,UAAuB,EAAE;QAEzB,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,UAAU,GAAG,2BAA2B,EAAE,CAAC;YACnD,MAAM,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,uBAAuB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzF,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,KAAK,EAAE,yBAAyB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAA4B,EAAE;QAC3C,IAAI,IAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,EAAE,kBAAkB;gBAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,yBAAyB;aACjC,CAAC,CAAyB,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,iEAAiE;gBACjE,gEAAgE;gBAChE,2BAA2B;gBAC3B,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpB,MAAM,EAAE,sBAAsB;gBAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,yBAAyB;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,sEAAsE;YACtE,oEAAoE;YACpE,IAAI,gBAAgB,CAAC,GAAG,CAAC;gBAAE,OAAO;YAClC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpB,MAAM,EAAE,qBAAqB;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,yBAAyB;aACjC,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,gBAAgB,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;6DACyD;IACzD,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,uEAAuE;IAEvE,iBAAiB;QACf,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,gFAAgF,CACnF,CAAC;IACJ,CAAC;IAED,gBAAgB;QACd,MAAM,IAAI,KAAK,CACb,oFAAoF;YAClF,8EAA8E,CACjF,CAAC;IACJ,CAAC;CACF;AAED,qEAAqE;AACrE,SAAS,gBAAgB,CAAC,GAAY;IACpC,OAAQ,GAA0B,EAAE,IAAI,KAAK,0BAA0B,CAAC;AAC1E,CAAC;AAED;iDACiD;AACjD,SAAS,eAAe,CAAC,SAAiB,EAAE,IAAY;IACtD,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,wBAAwB,IAAI,OAAO,SAAS,oBAAoB;QAC9D,GAAG,2BAA2B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,8BAA8B;QAC5E,0EAA0E;QAC1E,4CAA4C,CACnB,CAAC;IAC9B,GAAG,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAC/B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAE3E;;;;GAIG;AACH,SAAS,aAAa,CACpB,UAAkB,EAClB,IAAY,EACZ,OAA4B;IAE5B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,2BAA2B,UAAU,IAAI,IAAI,YAAY,SAAS,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC;AACvG,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CAAC,IAAkC;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,gEAAgE;IAChE,iEAAiE;IACjE,sDAAsD;IACtD,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,OAA+B;IACvD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,OAAO,YAAY,IAAI;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACtD,mEAAmE;IACnE,gEAAgE;IAChE,iEAAiE;IACjE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;AACrC,CAAC"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "pyric-admin",
+  "version": "0.1.0-alpha.7",
+  "description": "Pyric admin-shape adapters (firestore, auth, database, storage) with swappable sandbox/prod backends. Mirrors firebase-admin.",
+  "type": "module",
+  "exports": {
+    "./app": {
+      "types": "./dist/app/index.d.ts",
+      "import": "./dist/app/index.js"
+    },
+    "./firestore": {
+      "types": "./dist/firestore/index.d.ts",
+      "import": "./dist/firestore/index.js"
+    },
+    "./auth": {
+      "types": "./dist/auth/index.d.ts",
+      "import": "./dist/auth/index.js"
+    },
+    "./database": {
+      "types": "./dist/database/index.d.ts",
+      "import": "./dist/database/index.js"
+    },
+    "./storage": {
+      "types": "./dist/storage/index.d.ts",
+      "import": "./dist/storage/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "bun test",
+    "typecheck": "bun x tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "pyric": "^0.1.0-alpha.7",
+    "firebase-admin": "^13.0.0"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "typescript": "^5.7.0",
+    "fake-indexeddb": "^6.0.0"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}