pyric-admin 0.1.0-alpha.8 → 0.1.0-alpha.9

package/dist/app/index.d.ts

@@ -1,158 +1,47 @@
 /**
- * `pyric-admin/app` — Phase 3 initializeApp surface (ADR-001 D6) plus the
- * default-app registry and AMBIENT INIT (adoption experience, layer 3).
+ * `pyric-admin/app` — sandbox-only admin app registry.
  *
- * Mirror shape: at cutover this becomes `pyric-admin/app` and is the
- * single entry point where the sandbox-vs-prod choice is made for the
- * admin surface. Every `pyric-admin/*` subpath inspects the handle's
- * brand for backend dispatch.
- *
- * Current shadow scope:
- *   - `initializeApp({ credential, ... })` — prod-backed (live;
- *     delegates to `firebase-admin/app.initializeApp`).
- *   - `initializeApp({ sandbox })` — sandbox-backed (live).
- *   - `initializeApp()` — BARE, zero pyric identifiers in app code. The
- *     environment decides the backend (see "Ambient init" below).
- *   - Per-subpath adapter dispatch via the brand: implemented in
- *     `pyric-admin/{auth,database,storage}` via structural
- *     checks on the `app` argument. Phase 4 commits use property
- *     probing today; cutover swaps to brand-symbol reads.
- *
- * ── Default-app registry ──────────────────────────────────────────────
- *
- * Mirrors `firebase-admin/app`'s lifecycle exactly (oracle:
- * `firebase-admin/lib/app/lifecycle.js`):
- *
- *   - `initializeApp(config?, name?)` registers under `'[DEFAULT]'` when
- *     unnamed; `getApp(name?)` / `getApps()` / `deleteApp(app)` read it.
- *   - Duplicate-name errors carry firebase-admin's codes and message
- *     text: `app/duplicate-app` for a config'd re-init with a different
- *     configuration, `app/invalid-app-options` for a bare-vs-config'd
- *     mismatch (firebase-admin's autoInit mismatch), `app/no-app` from
- *     `getApp` on a missing name, `app/invalid-app-name` for a
- *     non-string/empty name. Errors reuse firebase-admin's own
- *     `FirebaseAppError` class, so `instanceof`, `constructor.name`,
- *     `.code`, and message text match production byte-for-byte
- *     (oracle: `admin-app-*` observations).
- *   - Idempotency mirror: a bare `initializeApp()` repeated for the same
- *     name returns the existing auto-initialized app (firebase-admin's
- *     autoInit path); `initializeApp({ sandbox })` repeated with the
- *     SAME `Sandbox` reference returns the existing app (the reference
- *     is our deep-equal analog — sandboxes have identity, not value
- *     equality); prod re-inits delegate the equality decision to
- *     firebase-admin itself (deep-equal options → same app; credential /
- *     httpAgent present → `app/invalid-app-options`, exactly upstream).
- *
- * ── Ambient init (bare `initializeApp()`) ─────────────────────────────
- *
- * The user's server code contains ZERO pyric identifiers — bare
- * `initializeApp()` + no-arg `getDatabase()` / `getAuth()`. The
- * environment picks the backend:
- *
- *   - `PYRIC_SANDBOX` unset → exactly firebase-admin's behavior:
- *     delegate to `firebase-admin/app.initializeApp()` (FIREBASE_CONFIG
- *     env + application-default credentials), register the prod arm.
- *   - `PYRIC_SANDBOX=remote` or `remote:<url>` → obtain a remote sandbox
- *     handle from the factory installed by `pyric-tools/register` at
- *     `globalThis[REMOTE_SANDBOX_FACTORY]`
- *     (`Symbol.for('pyric.remote.sandboxFactory')`) and register the
- *     sandbox arm. One activation line is logged to stderr. If the env
- *     is set but no factory is installed, throw with remediation (run
- *     under `pyric dev`, or add `--import pyric-tools/register` to
- *     NODE_OPTIONS).
- *   - Production guard: refuses to route to a sandbox when
- *     `NODE_ENV === 'production'`, unless `PYRIC_SANDBOX_FORCE=1`.
- *
- * Ambient resolution happens ONLY on the bare call — any explicit
- * config (`{ sandbox }` or prod `AppOptions`, even `{}`) bypasses the
- * env entirely, so pyric-aware code keeps full control.
+ * Production selection happens before this module loads: activated Node
+ * processes resolve `firebase-admin/app` here, while inactive applications
+ * continue resolving their own `firebase-admin/app` package unchanged.
  */
 import { type Sandbox } from 'pyric/sandbox';
-import { type App as AdminApp, type AppOptions } from 'firebase-admin/app';
-/**
- * Brand on every PyricAdminApp. Matches the symbol used in
- * `pyric/app` so a future shared `pyric/runtime` package can
- * unify dispatch helpers across both packages.
- */
+/** Brand carried by every sandbox admin app. */
 export declare const ADMIN_APP_TARGET: unique symbol;
-export type PyricAdminAppTarget = 'sandbox' | 'prod';
-/** firebase-admin's default app name — `'[DEFAULT]'`. */
+export type PyricAdminAppTarget = 'sandbox';
+/** firebase-admin's default app name. */
 export declare const DEFAULT_APP_NAME = "[DEFAULT]";
 export interface SandboxAdminApp {
     readonly [ADMIN_APP_TARGET]: 'sandbox';
     readonly sandbox: Sandbox;
-    /** Registry name (mirrors firebase-admin `App.name`). */
-    readonly name: string;
-}
-export interface ProdAdminApp {
-    readonly [ADMIN_APP_TARGET]: 'prod';
-    readonly adminApp: AdminApp;
-    /** Registry name (mirrors firebase-admin `App.name`). */
     readonly name: string;
 }
-export type PyricAdminApp = SandboxAdminApp | ProdAdminApp;
+export type PyricAdminApp = SandboxAdminApp;
 export type InitializeAdminAppConfig = {
     sandbox: Sandbox;
-} | AppOptions;
+};
 /**
- * App-lifecycle errors reuse `firebase-admin`'s own exported
- * `FirebaseAppError` so the thrown error's class, `constructor.name`,
- * `.code` (`app/no-app`, `app/duplicate-app`, `app/invalid-app-options`,
- * `app/invalid-app-name`, `app/invalid-argument`), and message text match
- * production byte-for-byte (oracle: `admin-app-*` observations assert
- * `errorName: "FirebaseAppError"`). The published typings declare only the
- * base `Error` constructor, but the real runtime class is
- * `new FirebaseAppError(code, message)` where `code` becomes `app/<code>` —
- * the typed cast recovers it.
+ * Firebase Functions' ESM runtime statically imports this credential factory
+ * while linking its database provider. Pyric initializes the sandbox app
+ * before that provider executes, so the factory is not used by supported
+ * Functions flows. Keep the named export link-compatible, but fail clearly if
+ * application code asks the development sandbox for production credentials.
  */
-declare const AdminAppError: new (code: string, message: string) => Error & {
-    readonly code: string;
-};
-/** @deprecated Alias kept for pre-merge call sites; errors ARE `FirebaseAppError`. */
-export declare const PyricAdminAppError: new (code: string, message: string) => Error & {
-    readonly code: string;
-};
-export type PyricAdminAppError = InstanceType<typeof AdminAppError>;
+export declare function applicationDefault(): never;
 /**
- * Initialize a Pyric admin app and register it under `name`
- * (default `'[DEFAULT]'`), mirroring `firebase-admin/app.initializeApp`.
+ * Initialize a sandbox admin app.
  *
- * @example
- * ```ts
- * // Ambient (zero pyric identifiers — environment decides)
- * import { initializeApp } from 'pyric-admin/app';
- * const app = initializeApp();
- *
- * // Prod-backed
- * import { applicationDefault } from 'firebase-admin/app';
- * const app = initializeApp({ credential: applicationDefault() });
- *
- * // Sandbox-backed
- * import { initializeSandbox } from 'pyric/sandbox';
- * const app = initializeApp({ sandbox: initializeSandbox() });
- * ```
+ * An explicit `{ sandbox }` config binds an in-process or remote sandbox.
+ * A bare call resolves the remote sandbox factory installed by
+ * `@pyric/cli/register`. Production callers must import `firebase-admin/app`
+ * without Pyric activation instead of passing production options here.
  */
 export declare function initializeApp(config?: InitializeAdminAppConfig, name?: string): PyricAdminApp;
-/**
- * Return the registered app for `name` (default `'[DEFAULT]'`).
- * Mirrors `firebase-admin/app.getApp` — including the exact `app/no-app`
- * error text on a miss.
- */
+/** Return the registered app for `name`. */
 export declare function getApp(name?: string): PyricAdminApp;
-/**
- * A copy of the list of all registered apps.
- * Mirrors `firebase-admin/app.getApps`.
- */
+/** Return a copy of the app registry. */
 export declare function getApps(): PyricAdminApp[];
-/**
- * Remove `app` from the registry, mirroring `firebase-admin/app.deleteApp`.
- * Prod-backed apps also delete the underlying firebase-admin app (freeing
- * its resources and its slot in firebase-admin's own registry, so the
- * name can be re-initialized). Sandbox-backed apps only deregister — the
- * `Sandbox` handle's lifetime belongs to its creator.
- */
+/** Remove a sandbox app from the registry. */
 export declare function deleteApp(app: PyricAdminApp): Promise<void>;
 export declare function isSandboxAdminApp(app: PyricAdminApp): app is SandboxAdminApp;
-export declare function isProdAdminApp(app: PyricAdminApp): app is ProdAdminApp;
-export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/app/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAIL,KAAK,OAAO,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAIL,KAAK,GAAG,IAAI,QAAQ,EACpB,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,eAAuC,CAAC;AAErE,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,MAAM,CAAC;AAErD,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,YAAY,CAAC;AAE3D,MAAM,MAAM,wBAAwB,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,UAAU,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,QAAA,MAAM,aAAa,EAAkC,KACnD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,KACZ,KAAK,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,aALvB,MAAM,WACH,MAAM,KACZ,KAAK,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAGW,CAAC;AAChD,MAAM,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;AA8BpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAC3B,MAAM,CAAC,EAAE,wBAAwB,EACjC,IAAI,GAAE,MAAyB,GAC9B,aAAa,CA8Df;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,GAAE,MAAyB,GAAG,aAAa,CAcrE;AAED;;;GAGG;AACH,wBAAgB,OAAO,IAAI,aAAa,EAAE,CAEzC;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAW3D;AA0FD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,GAAG,IAAI,eAAe,CAE5E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,GAAG,IAAI,YAAY,CAEtE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAIL,KAAK,OAAO,EACb,MAAM,eAAe,CAAC;AAGvB,gDAAgD;AAChD,eAAO,MAAM,gBAAgB,eAAuC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE5C,yCAAyC;AACzC,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC;AAC5C,MAAM,MAAM,wBAAwB,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAE5D;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,KAAK,CAK1C;AA4CD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,CAAC,EAAE,wBAAwB,EACjC,IAAI,GAAE,MAAyB,GAC9B,aAAa,CAqCf;AAED,4CAA4C;AAC5C,wBAAgB,MAAM,CAAC,IAAI,GAAE,MAAyB,GAAG,aAAa,CAarE;AAED,yCAAyC;AACzC,wBAAgB,OAAO,IAAI,aAAa,EAAE,CAEzC;AAED,8CAA8C;AAC9C,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3D;AAgED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,GAAG,IAAI,eAAe,CAE5E"}

package/dist/app/index.js

@@ -1,192 +1,94 @@
 /**
- * `pyric-admin/app` — Phase 3 initializeApp surface (ADR-001 D6) plus the
- * default-app registry and AMBIENT INIT (adoption experience, layer 3).
+ * `pyric-admin/app` — sandbox-only admin app registry.
  *
- * Mirror shape: at cutover this becomes `pyric-admin/app` and is the
- * single entry point where the sandbox-vs-prod choice is made for the
- * admin surface. Every `pyric-admin/*` subpath inspects the handle's
- * brand for backend dispatch.
- *
- * Current shadow scope:
- *   - `initializeApp({ credential, ... })` — prod-backed (live;
- *     delegates to `firebase-admin/app.initializeApp`).
- *   - `initializeApp({ sandbox })` — sandbox-backed (live).
- *   - `initializeApp()` — BARE, zero pyric identifiers in app code. The
- *     environment decides the backend (see "Ambient init" below).
- *   - Per-subpath adapter dispatch via the brand: implemented in
- *     `pyric-admin/{auth,database,storage}` via structural
- *     checks on the `app` argument. Phase 4 commits use property
- *     probing today; cutover swaps to brand-symbol reads.
- *
- * ── Default-app registry ──────────────────────────────────────────────
- *
- * Mirrors `firebase-admin/app`'s lifecycle exactly (oracle:
- * `firebase-admin/lib/app/lifecycle.js`):
- *
- *   - `initializeApp(config?, name?)` registers under `'[DEFAULT]'` when
- *     unnamed; `getApp(name?)` / `getApps()` / `deleteApp(app)` read it.
- *   - Duplicate-name errors carry firebase-admin's codes and message
- *     text: `app/duplicate-app` for a config'd re-init with a different
- *     configuration, `app/invalid-app-options` for a bare-vs-config'd
- *     mismatch (firebase-admin's autoInit mismatch), `app/no-app` from
- *     `getApp` on a missing name, `app/invalid-app-name` for a
- *     non-string/empty name. Errors reuse firebase-admin's own
- *     `FirebaseAppError` class, so `instanceof`, `constructor.name`,
- *     `.code`, and message text match production byte-for-byte
- *     (oracle: `admin-app-*` observations).
- *   - Idempotency mirror: a bare `initializeApp()` repeated for the same
- *     name returns the existing auto-initialized app (firebase-admin's
- *     autoInit path); `initializeApp({ sandbox })` repeated with the
- *     SAME `Sandbox` reference returns the existing app (the reference
- *     is our deep-equal analog — sandboxes have identity, not value
- *     equality); prod re-inits delegate the equality decision to
- *     firebase-admin itself (deep-equal options → same app; credential /
- *     httpAgent present → `app/invalid-app-options`, exactly upstream).
- *
- * ── Ambient init (bare `initializeApp()`) ─────────────────────────────
- *
- * The user's server code contains ZERO pyric identifiers — bare
- * `initializeApp()` + no-arg `getDatabase()` / `getAuth()`. The
- * environment picks the backend:
- *
- *   - `PYRIC_SANDBOX` unset → exactly firebase-admin's behavior:
- *     delegate to `firebase-admin/app.initializeApp()` (FIREBASE_CONFIG
- *     env + application-default credentials), register the prod arm.
- *   - `PYRIC_SANDBOX=remote` or `remote:<url>` → obtain a remote sandbox
- *     handle from the factory installed by `pyric-tools/register` at
- *     `globalThis[REMOTE_SANDBOX_FACTORY]`
- *     (`Symbol.for('pyric.remote.sandboxFactory')`) and register the
- *     sandbox arm. One activation line is logged to stderr. If the env
- *     is set but no factory is installed, throw with remediation (run
- *     under `pyric dev`, or add `--import pyric-tools/register` to
- *     NODE_OPTIONS).
- *   - Production guard: refuses to route to a sandbox when
- *     `NODE_ENV === 'production'`, unless `PYRIC_SANDBOX_FORCE=1`.
- *
- * Ambient resolution happens ONLY on the bare call — any explicit
- * config (`{ sandbox }` or prod `AppOptions`, even `{}`) bypasses the
- * env entirely, so pyric-aware code keeps full control.
+ * Production selection happens before this module loads: activated Node
+ * processes resolve `firebase-admin/app` here, while inactive applications
+ * continue resolving their own `firebase-admin/app` package unchanged.
  */
 import { REMOTE_SANDBOX_FACTORY, } from 'pyric/sandbox';
-import { initializeApp as initializeFirebaseAdminApp, deleteApp as deleteFirebaseAdminApp, FirebaseAppError, } from 'firebase-admin/app';
-/**
- * Brand on every PyricAdminApp. Matches the symbol used in
- * `pyric/app` so a future shared `pyric/runtime` package can
- * unify dispatch helpers across both packages.
- */
+import { assertAdminAppActive, markAdminAppDeleted } from './lifecycle.js';
+/** Brand carried by every sandbox admin app. */
 export const ADMIN_APP_TARGET = Symbol.for('pyric.admin.app.target');
-/** firebase-admin's default app name — `'[DEFAULT]'`. */
+/** firebase-admin's default app name. */
 export const DEFAULT_APP_NAME = '[DEFAULT]';
 /**
- * App-lifecycle errors reuse `firebase-admin`'s own exported
- * `FirebaseAppError` so the thrown error's class, `constructor.name`,
- * `.code` (`app/no-app`, `app/duplicate-app`, `app/invalid-app-options`,
- * `app/invalid-app-name`, `app/invalid-argument`), and message text match
- * production byte-for-byte (oracle: `admin-app-*` observations assert
- * `errorName: "FirebaseAppError"`). The published typings declare only the
- * base `Error` constructor, but the real runtime class is
- * `new FirebaseAppError(code, message)` where `code` becomes `app/<code>` —
- * the typed cast recovers it.
+ * Firebase Functions' ESM runtime statically imports this credential factory
+ * while linking its database provider. Pyric initializes the sandbox app
+ * before that provider executes, so the factory is not used by supported
+ * Functions flows. Keep the named export link-compatible, but fail clearly if
+ * application code asks the development sandbox for production credentials.
  */
-const AdminAppError = FirebaseAppError;
-/** @deprecated Alias kept for pre-merge call sites; errors ARE `FirebaseAppError`. */
-export const PyricAdminAppError = AdminAppError;
-// ─── Registry ───────────────────────────────────────────────────────────
-//
-// Module-level, matching firebase-admin's `defaultAppStore` (one store per
-// module instance). `autoInitApps` tracks which registered apps came from a
-// BARE `initializeApp()` — firebase-admin's `autoInit` flag — so the
-// bare-vs-config'd mismatch throws exactly like upstream.
-const appRegistry = new Map();
-const autoInitApps = new WeakSet();
-/** firebase-admin's app-name validation, verbatim message. */
+export function applicationDefault() {
+    throw new Error('pyric-admin/app: applicationDefault() is unavailable in the sandbox. ' +
+        'Pyric development does not use production credentials.');
+}
+/** Local error with the observable firebase-admin app-error shape. */
+class FirebaseAppError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'FirebaseAppError';
+        this.code = `app/${code}`;
+    }
+}
+// Node may evaluate this ESM-only mirror through distinct require(esm) and
+// import module records when the register hook rewrites both CJS and ESM
+// Firebase consumers. Firebase Admin's app registry is process-wide, so keep
+// the mirror registry behind Symbol.for as well: both module records must see
+// the same default app and sandbox handle.
+const APP_REGISTRY = Symbol.for('pyric.admin.app.registry');
+const AMBIENT_APPS = Symbol.for('pyric.admin.app.ambientApps');
+const globalRegistry = globalThis;
+const appRegistry = globalRegistry[APP_REGISTRY] ??= new Map();
+const ambientApps = globalRegistry[AMBIENT_APPS] ??= new WeakSet();
 function validateAppName(name) {
     if (typeof name !== 'string' || name === '') {
-        throw new AdminAppError('invalid-app-name', `Invalid Firebase app name "${String(name)}" provided. App name must be a non-empty string.`);
+        throw new FirebaseAppError('invalid-app-name', `Invalid Firebase app name "${String(name)}" provided. App name must be a non-empty string.`);
     }
 }
-/** firebase-admin's message for every same-name/different-config case. */
 function alreadyExists(name, code) {
-    return new AdminAppError(code, `A Firebase app named "${name}" already exists with a different configuration.`);
+    return new FirebaseAppError(code, `A Firebase app named "${name}" already exists with a different configuration.`);
 }
 /**
- * Initialize a Pyric admin app and register it under `name`
- * (default `'[DEFAULT]'`), mirroring `firebase-admin/app.initializeApp`.
- *
- * @example
- * ```ts
- * // Ambient (zero pyric identifiers — environment decides)
- * import { initializeApp } from 'pyric-admin/app';
- * const app = initializeApp();
+ * Initialize a sandbox admin app.
  *
- * // Prod-backed
- * import { applicationDefault } from 'firebase-admin/app';
- * const app = initializeApp({ credential: applicationDefault() });
- *
- * // Sandbox-backed
- * import { initializeSandbox } from 'pyric/sandbox';
- * const app = initializeApp({ sandbox: initializeSandbox() });
- * ```
+ * An explicit `{ sandbox }` config binds an in-process or remote sandbox.
+ * A bare call resolves the remote sandbox factory installed by
+ * `@pyric/cli/register`. Production callers must import `firebase-admin/app`
+ * without Pyric activation instead of passing production options here.
  */
 export function initializeApp(config, name = DEFAULT_APP_NAME) {
     validateAppName(name);
     const existing = appRegistry.get(name);
-    // ── Bare call: ambient resolution ────────────────────────────────────
     if (config === undefined) {
         if (existing !== undefined) {
-            // firebase-admin: two autoInit calls return the same app; an
-            // autoInit call against a config'd app is an options mismatch.
-            if (autoInitApps.has(existing))
+            if (ambientApps.has(existing))
                 return existing;
             throw alreadyExists(name, 'invalid-app-options');
         }
         const app = initializeAmbientApp(name);
         appRegistry.set(name, app);
-        autoInitApps.add(app);
+        ambientApps.add(app);
         return app;
     }
-    // ── Explicit sandbox config ──────────────────────────────────────────
-    if (isSandboxConfig(config)) {
-        if (existing !== undefined) {
-            // Reference identity is the deep-equal analog for sandboxes.
-            if (!autoInitApps.has(existing) &&
-                existing[ADMIN_APP_TARGET] === 'sandbox' &&
-                existing.sandbox === config.sandbox) {
-                return existing;
-            }
-            throw alreadyExists(name, autoInitApps.has(existing) ? 'invalid-app-options' : 'duplicate-app');
-        }
-        const app = {
-            [ADMIN_APP_TARGET]: 'sandbox',
-            sandbox: config.sandbox,
-            name,
-        };
-        appRegistry.set(name, app);
-        return app;
+    if (!isSandboxConfig(config)) {
+        throw new TypeError('pyric-admin/app is a sandbox-only mirror. Production applications must ' +
+            'load firebase-admin/app without Pyric activation.');
     }
-    // ── Explicit prod options ────────────────────────────────────────────
     if (existing !== undefined) {
-        if (existing[ADMIN_APP_TARGET] === 'prod' && !autoInitApps.has(existing)) {
-            // Delegate the equality decision to firebase-admin itself: deep-
-            // equal options return the same AdminApp; credential / httpAgent
-            // re-inits throw app/invalid-app-options; different options throw
-            // app/duplicate-app — all with upstream's exact messages.
-            const adminApp = initializeFirebaseAdminApp(config, name);
-            if (adminApp === existing.adminApp)
-                return existing;
-        }
-        throw alreadyExists(name, autoInitApps.has(existing) ? 'invalid-app-options' : 'duplicate-app');
+        if (!ambientApps.has(existing) && existing.sandbox === config.sandbox)
+            return existing;
+        throw alreadyExists(name, ambientApps.has(existing) ? 'invalid-app-options' : 'duplicate-app');
     }
-    const adminApp = initializeFirebaseAdminApp(config, name);
-    const app = { [ADMIN_APP_TARGET]: 'prod', adminApp, name };
+    const app = {
+        [ADMIN_APP_TARGET]: 'sandbox',
+        sandbox: config.sandbox,
+        name,
+    };
     appRegistry.set(name, app);
     return app;
 }
-/**
- * Return the registered app for `name` (default `'[DEFAULT]'`).
- * Mirrors `firebase-admin/app.getApp` — including the exact `app/no-app`
- * error text on a miss.
- */
+/** Return the registered app for `name`. */
 export function getApp(name = DEFAULT_APP_NAME) {
     validateAppName(name);
     const app = appRegistry.get(name);
@@ -194,52 +96,34 @@ export function getApp(name = DEFAULT_APP_NAME) {
         const lead = name === DEFAULT_APP_NAME
             ? 'The default Firebase app does not exist. '
             : `Firebase app named "${name}" does not exist. `;
-        throw new AdminAppError('no-app', lead + 'Make sure you call initializeApp() before using any of the Firebase services.');
+        throw new FirebaseAppError('no-app', lead + 'Make sure you call initializeApp() before using any of the Firebase services.');
     }
     return app;
 }
-/**
- * A copy of the list of all registered apps.
- * Mirrors `firebase-admin/app.getApps`.
- */
+/** Return a copy of the app registry. */
 export function getApps() {
     return Array.from(appRegistry.values());
 }
-/**
- * Remove `app` from the registry, mirroring `firebase-admin/app.deleteApp`.
- * Prod-backed apps also delete the underlying firebase-admin app (freeing
- * its resources and its slot in firebase-admin's own registry, so the
- * name can be re-initialized). Sandbox-backed apps only deregister — the
- * `Sandbox` handle's lifetime belongs to its creator.
- */
+/** Remove a sandbox app from the registry. */
 export function deleteApp(app) {
     if (typeof app !== 'object' || app === null || !(ADMIN_APP_TARGET in app)) {
-        throw new AdminAppError('invalid-argument', 'Invalid app argument.');
+        throw new FirebaseAppError('invalid-argument', 'Invalid app argument.');
     }
-    // Make sure the given app is actually registered (throws app/no-app).
+    assertAdminAppActive(app);
     const existing = getApp(app.name);
     appRegistry.delete(existing.name);
-    if (existing[ADMIN_APP_TARGET] === 'prod') {
-        return deleteFirebaseAdminApp(existing.adminApp);
-    }
+    markAdminAppDeleted(existing);
     return Promise.resolve();
 }
-// ─── Ambient init ───────────────────────────────────────────────────────
-/**
- * Resolve a bare `initializeApp()` from the environment. See the
- * module-level "Ambient init" docs for the full contract.
- */
 function initializeAmbientApp(name) {
     const env = process.env.PYRIC_SANDBOX;
     if (env === undefined || env.trim() === '') {
-        // Unset → exactly today's prod behavior: firebase-admin's autoInit
-        // (FIREBASE_CONFIG env options + application-default credentials).
-        const adminApp = initializeFirebaseAdminApp(undefined, name);
-        return { [ADMIN_APP_TARGET]: 'prod', adminApp, name };
+        throw new Error('pyric-admin/app is a sandbox-only mirror and no sandbox is active. ' +
+            'Run under `pyric dev`, set PYRIC_SANDBOX with @pyric/cli/register, ' +
+            'or load firebase-admin/app without Pyric activation for production.');
     }
     const opts = parsePyricSandboxEnv(env);
-    if (process.env.NODE_ENV === 'production' &&
-        process.env.PYRIC_SANDBOX_FORCE !== '1') {
+    if (process.env.NODE_ENV === 'production' && process.env.PYRIC_SANDBOX_FORCE !== '1') {
         throw new Error('pyric-admin: PYRIC_SANDBOX is set but NODE_ENV is "production" — ' +
             'refusing to route firebase-admin to a development sandbox. ' +
             'Unset PYRIC_SANDBOX in production, or set PYRIC_SANDBOX_FORCE=1 ' +
@@ -248,25 +132,13 @@ function initializeAmbientApp(name) {
     const factory = globalThis[REMOTE_SANDBOX_FACTORY];
     if (typeof factory !== 'function') {
         throw new Error(`pyric-admin: PYRIC_SANDBOX=${env} is set but no remote sandbox ` +
-            'factory is installed (globalThis[Symbol.for(' +
-            "'pyric.remote.sandboxFactory')] is absent). Run your server " +
-            'under `pyric dev`, or add `--import pyric-tools/register` to ' +
-            'NODE_OPTIONS.');
+            "factory is installed (globalThis[Symbol.for('pyric.remote.sandboxFactory')] is absent). " +
+            'Run your server under `pyric dev`, or add `--import @pyric/cli/register` to NODE_OPTIONS.');
     }
     const sandbox = factory(opts);
     process.stderr.write(`pyric: firebase-admin routed to sandbox${opts.url !== undefined ? ` at ${opts.url}` : ''}\n`);
     return { [ADMIN_APP_TARGET]: 'sandbox', sandbox, name };
 }
-/**
- * Parse the `PYRIC_SANDBOX` activator value.
- *
- *   - `remote`        → `{}` (factory discovers the running `pyric dev`)
- *   - `remote:<url>`  → `{ url }` (everything after the FIRST colon —
- *     URLs contain colons, so only the mode prefix is split off)
- *
- * Anything else throws: an unrecognized activator must never silently
- * fall through to prod (mode-by-side-effect in the failure direction).
- */
 function parsePyricSandboxEnv(env) {
     const value = env.trim();
     if (value === 'remote')
@@ -281,17 +153,12 @@ function parsePyricSandboxEnv(env) {
         return { url };
     }
     throw new Error(`pyric-admin: unrecognized PYRIC_SANDBOX value "${env}". Supported ` +
-        'values: "remote" (auto-discover the running `pyric dev`) or ' +
-        '"remote:<url>".');
+        'values: "remote" (auto-discover the running `pyric dev`) or "remote:<url>".');
 }
-// ─── Guards ─────────────────────────────────────────────────────────────
 function isSandboxConfig(config) {
     return typeof config === 'object' && config !== null && 'sandbox' in config;
 }
 export function isSandboxAdminApp(app) {
     return app[ADMIN_APP_TARGET] === 'sandbox';
 }
-export function isProdAdminApp(app) {
-    return app[ADMIN_APP_TARGET] === 'prod';
-}
 //# sourceMappingURL=index.js.map

package/dist/app/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EACL,sBAAsB,GAIvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,aAAa,IAAI,0BAA0B,EAC3C,SAAS,IAAI,sBAAsB,EACnC,gBAAgB,GAGjB,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAIrE,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAoB5C;;;;;;;;;;GAUG;AACH,MAAM,aAAa,GAAG,gBAGgB,CAAC;AAEvC,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAGhD,2EAA2E;AAC3E,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,qEAAqE;AACrE,0DAA0D;AAE1D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;AACrD,MAAM,YAAY,GAAG,IAAI,OAAO,EAAiB,CAAC;AAElD,8DAA8D;AAC9D,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAClB,8BAA8B,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,aAAa,CAAC,IAAY,EAAE,IAA6C;IAChF,OAAO,IAAI,aAAa,CACtB,IAAI,EACJ,yBAAyB,IAAI,kDAAkD,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAiC,EACjC,OAAe,gBAAgB;IAE/B,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEvC,wEAAwE;IACxE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,6DAA6D;YAC7D,+DAA+D;YAC/D,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAChD,MAAM,aAAa,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACvC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,wEAAwE;IACxE,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,6DAA6D;YAC7D,IACE,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC3B,QAAQ,CAAC,gBAAgB,CAAC,KAAK,SAAS;gBACxC,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EACnC,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,aAAa,CACjB,IAAI,EACJ,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAoB;YAC3B,CAAC,gBAAgB,CAAC,EAAE,SAAS;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI;SACL,CAAC;QACF,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,wEAAwE;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,gBAAgB,CAAC,KAAK,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,iEAAiE;YACjE,iEAAiE;YACjE,kEAAkE;YAClE,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,QAAQ,KAAK,QAAQ,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QACtD,CAAC;QACD,MAAM,aAAa,CACjB,IAAI,EACJ,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAiB,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzE,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,OAAe,gBAAgB;IACpD,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,GACR,IAAI,KAAK,gBAAgB;YACvB,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,uBAAuB,IAAI,oBAAoB,CAAC;QACtD,MAAM,IAAI,aAAa,CACrB,QAAQ,EACR,IAAI,GAAG,+EAA+E,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO;IACrB,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,GAAkB;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,gBAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IACvE,CAAC;IACD,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,gBAAgB,CAAC,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAE3E;;;GAGG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,QAAQ,GAAG,0BAA0B,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7D,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAEvC,IACE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,6DAA6D;YAC7D,kEAAkE;YAClE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,UACD,CAAC,sBAAsB,CAAC,CAAC;IAC1B,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,gCAAgC;YAC/D,8CAA8C;YAC9C,8DAA8D;YAC9D,+DAA+D;YAC/D,eAAe,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0CAA0C,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAC9F,CAAC;IACF,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,2DAA2D;gBACzD,iEAAiE;gBACjE,kDAAkD,CACrD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,kDAAkD,GAAG,eAAe;QAClE,8DAA8D;QAC9D,iBAAiB,CACpB,CAAC;AACJ,CAAC;AAED,2EAA2E;AAE3E,SAAS,eAAe,CACtB,MAAgC;IAEhC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,MAAM,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IAClD,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,SAAS,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAkB;IAC/C,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,sBAAsB,GAIvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAGrE,yCAAyC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAW5C;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,KAAK,CACb,uEAAuE;QACrE,wDAAwD,CAC3D,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,gBAAiB,SAAQ,KAAK;IACzB,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,EAAE,CAAC;IAC5B,CAAC;CACF;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,2CAA2C;AAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;AAK/D,MAAM,cAAc,GAAG,UAA+B,CAAC;AACvD,MAAM,WAAW,GAAG,cAAc,CAAC,YAAY,CAAC,KAAK,IAAI,GAAG,EAAyB,CAAC;AACtF,MAAM,WAAW,GAAG,cAAc,CAAC,YAAY,CAAC,KAAK,IAAI,OAAO,EAAiB,CAAC;AAElF,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,gBAAgB,CACxB,kBAAkB,EAClB,8BAA8B,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAA6C;IAChF,OAAO,IAAI,gBAAgB,CACzB,IAAI,EACJ,yBAAyB,IAAI,kDAAkD,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAiC,EACjC,OAAe,gBAAgB;IAE/B,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC/C,MAAM,aAAa,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACvC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CACjB,yEAAyE;YACvE,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC;QACvF,MAAM,aAAa,CACjB,IAAI,EACJ,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAoB;QAC3B,CAAC,gBAAgB,CAAC,EAAE,SAAS;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;KACL,CAAC;IACF,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,MAAM,CAAC,OAAe,gBAAgB;IACpD,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,KAAK,gBAAgB;YACpC,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,uBAAuB,IAAI,oBAAoB,CAAC;QACpD,MAAM,IAAI,gBAAgB,CACxB,QAAQ,EACR,IAAI,GAAG,+EAA+E,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,OAAO;IACrB,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,SAAS,CAAC,GAAkB;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,gBAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IACD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,qEAAqE;YACrE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,6DAA6D;YAC7D,kEAAkE;YAClE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAI,UAAkE,CACjF,sBAAsB,CACvB,CAAC;IACF,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,gCAAgC;YAC/D,0FAA0F;YAC1F,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0CAA0C,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAC9F,CAAC;IACF,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,2DAA2D;gBACzD,iEAAiE;gBACjE,kDAAkD,CACrD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,kDAAkD,GAAG,eAAe;QAClE,6EAA6E,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAgC;IACvD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,MAAM,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IAClD,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,SAAS,CAAC;AAC7C,CAAC"}

package/dist/app/lifecycle.d.ts

@@ -0,0 +1,7 @@
+/** Internal lifecycle guard shared by every pyric-admin service factory. */
+export declare function assertAdminAppActive(app: object & {
+    readonly name: string;
+}): void;
+/** Tombstone a wrapper while leaving the caller-owned Sandbox alive. */
+export declare function markAdminAppDeleted(app: object): void;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/app/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/app/lifecycle.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQlF;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAErD"}

package/dist/app/lifecycle.js

@@ -0,0 +1,15 @@
+const deletedApps = new WeakSet();
+/** Internal lifecycle guard shared by every pyric-admin service factory. */
+export function assertAdminAppActive(app) {
+    if (!deletedApps.has(app))
+        return;
+    const error = new Error(`Firebase app named "${app.name}" has already been deleted.`);
+    error.name = 'FirebaseAppError';
+    error.code = 'app/app-deleted';
+    throw error;
+}
+/** Tombstone a wrapper while leaving the caller-owned Sandbox alive. */
+export function markAdminAppDeleted(app) {
+    deletedApps.add(app);
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/app/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../src/app/lifecycle.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,IAAI,OAAO,EAAU,CAAC;AAE1C,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,GAAuC;IAC1E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAClC,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,uBAAuB,GAAG,CAAC,IAAI,6BAA6B,CACjC,CAAC;IAC9B,KAAK,CAAC,IAAI,GAAG,kBAAkB,CAAC;IAChC,KAAK,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAC/B,MAAM,KAAK,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC"}