pyric-tools 0.1.0-alpha.7

package/README.md

@@ -0,0 +1,125 @@
+# pyric-tools
+
+The Pyric CLI + programmatic helpers for `firebase-tools`-shaped work
+(deploy, bridge, discover, identity-toolkit configuration).
+
+> **Alpha.** This package is an early alpha. The `firebase-tools`-mirrored
+> surfaces (deploy, discover, auth configuration) are best-effort mirror
+> contracts; non-mirrored exports (e.g. `pyric-tools/serve/worker`,
+> `pyric-tools/verify`, `pyric-tools/credentials`) are experimental
+> public-alpha surfaces that may change without notice. The MCP tool surface
+> (tool names and shapes) will consolidate during early alpha — do not treat
+> tool names as stable.
+
+## CLI subcommands
+
+| Command | What it does |
+|---|---|
+| `pyric init [dir]` | Scaffold a pyric project — never prompts, idempotent, safe to rerun. `--template web` (default): a servable app with **canonical `firebase/*` imports** (owner-based rules, `seed.json`, `dev`/`dev:agent` scripts, real `firebase` dep) — `pyric dev` runs it on the sandbox; any standard bundler runs the same code on real Firebase. The swap is environmental, never a code edit. `--template node`: script-style scaffold whose backend is picked by `PYRIC_TARGET=sandbox\|firebase`. Also `--name`, `--force` (overwrite scaffold-owned files), `--json` (machine result on stdout: `{template, dir, created, merged, skipped, conflicts, nextSteps}`) |
+| `pyric bridge` | Stand up an HTTP+WebSocket bridge an MCP client (Claude Code, Cursor) connects to |
+| `pyric dev` | Local dev server with the pyric sandbox standing in for Firebase: serves `hosting.public`, resolves unmodified `firebase/*` imports to a pyric sandbox via a served import map, deploys + hot-reloads `firestore.rules` (SSE), opens an emulator-style sign-in helper for `signInWithPopup`/`signInWithRedirect`. The sandbox runs in a **SharedWorker by default** — one backend shared by every tab of the origin (live cross-tab sync), kept in the browser's IndexedDB so **your sandbox data — Firestore docs, auth users, RTDB, storage objects, and the traffic history — survives a refresh/restart by default** (see the persistence guide's coverage matrix for the exact tiers); a per-tab in-page sandbox is the fallback when SharedWorker is unavailable. Flags + exit codes: [CLI reference](docs/reference/cli.md#pyric-dev); persistence, ephemeral runs, clearing data, and SharedWorker tips: [persistence & multi-tab](docs/how-to/serve-persistence-and-multi-tab.md) |
+| `pyric snapshot` | Promote lived sandbox state (live `dev --persist`, else `.pyric/state/state.json`) to a committable fixture; `pyric dev --seed <fixture>` re-serves it (docs + users). `--out`, `--port`, `--force`, `--json` |
+| `pyric deploy <target>` | Deploy `rules` / `indexes` / `database` / `hosting` / `functions` to a real Firebase project |
+| `pyric rules:lint <path>` | Lint a Firestore rules file |
+| `pyric rules:validate <path>` | Validate Firestore rules structure |
+| `pyric rules:simulate` | Local rules simulator |
+| `pyric database:rules:lint <path>` | Lint a Realtime Database rules JSON file |
+| `pyric database:rules:validate <path>` | Validate Realtime Database rules expressions |
+| `pyric database:rules:simulate` | Local Realtime Database rules simulator |
+| `pyric auth:configure-provider <id> <enabled>` | Identity Toolkit: enable/disable an auth provider |
+| `pyric auth:manage-domains <add\|remove\|list> [domain]` | Identity Toolkit: authorized domains |
+| `pyric firestore:discover [collection]` | Crawl a Firestore to infer schema |
+
+Every command's full flags, defaults, exit codes, and environment variables are
+in the **[CLI reference](docs/reference/cli.md)**. Task guides and the rest of
+the docs are indexed in **[docs/](docs/README.md)**.
+
+### Persistence caveats (documented limits)
+
+- **Anonymous users don't persist** (no round-trip key) — but their *documents
+  do*. An app that calls `signInAnonymously` on load mints a new uid every
+  reload under `--persist`, so docs owned by prior anonymous uids accumulate
+  unreachably. Use the sign-in helper (or seeded users) for owner-based data
+  you want durable.
+- **The state file is not a point-in-time snapshot** — firestore and auth
+  sections flush on independent debounces; a crash between them can persist
+  docs whose owner user hasn't flushed yet (or vice versa).
+- **One writer tab at a time (in-page fallback only)** — when several per-tab
+  in-page sandboxes share one `.pyric/state` file, the first tab to flush holds
+  the writer lock; others run read-only (console warning + `persistReadOnly`
+  diagnostic) so they can't erase the writer's data. On the default SharedWorker
+  path this can't happen — the single worker is the sole writer.
+- **Loss window** — the final unsaved change can be lost if the tab CLOSES
+  within the flush debounce while the state exceeds ~60KB (keepalive cap);
+  smaller states flush on unload, and reloads are always safe. A reset (or
+  any delete-all) that empties a non-empty state first preserves the prior
+  file at `.pyric/state/state.json.bak`.
+
+### Agent onboarding (init → dev → MCP)
+
+Three parseable steps, no flags to discover:
+
+```bash
+pyric init myapp --json        # → {..., "nextSteps": [...]}
+cd myapp && bun install
+bun run dev:agent              # pyric dev --bridge --seed seed.json
+```
+
+Readiness probe: `GET <url>/__pyric/init.json` → 200 once serving (body
+carries the live rules hash). MCP endpoint: `<url>/__pyric/mcp`. With
+`pyric dev --json`, stdout's single line carries `{url, port, mcpUrl,
+rulesHash}`.
+
+## Programmatic subpaths
+
+| Subpath | Surface |
+|---|---|
+| `pyric-tools/deploy` | `fromServiceAccount`, `getDeploy`, `createFirestoreDeployTools`, `createRtdbDeployTools`, `createHostingDeployTools`, `createFunctionsDeployTools` |
+| `pyric-tools/bridge` | `createBridge`, `startServer` (Node) / `connectBridge` (browser via conditional export). Vite integration is `pyricSandbox({ bridge })` in `pyric-tools/vite`. |
+| `pyric-tools/vite` | `pyricSandbox(opts)`, the dev-only firebase→sandbox swap plugin. Opts: `rules`, `persist`/`fresh`, `seed`, `capture`, `bridge` (MCP), `ui` (Pyric Studio at `/__pyric/ui/`, parity with `dev --ui`). |
+| `pyric-tools/discover` | `crawl`, `findCollectionGroup`, `createRestCrawlerFirestore`, `createFirestoreDiscoverTools` |
+| `pyric-tools/auth` | `getAuthTools` (Identity Toolkit-driven provider + domain configuration) |
+
+## MCP tool surface (`pyric bridge`)
+
+The bridge registers two toolsets, sourced directly from `pyric`'s own tool
+registries (`pyric/firestore` + `pyric/rules`) so the surface can't drift from
+the library — the canonical, always-current list is the
+[agent tool inventory](../../docs/agent-tools.md).
+
+**Sandbox-routed** — dispatched against the connected browser sandbox
+(`createFirestoreDataTools` + `createFirestoreSimulatorTools` +
+`createFirestoreInspectTools`):
+
+- data: `firestore_get_document` / `_list_documents` / `_create_document` / `_update_document` / `_delete_document` / `_query_where` / `firestore_create_with_auto_id`
+- stateful simulator session: `firestore_simulator_create` / `_execute` / `_read` / `_batch` / `_undo` / `_redo` / `_events` / `_transaction`
+- diagnostics: `sandbox_inspect` — single-call sandbox state/rules snapshot
+
+**In-process** — run on the bridge process itself (`createFirestoreRulesTools`):
+
+- `firestore_simulate_rules`
+- `firestore_rules_stdlib_list` / `_get`
+- `firestore_lint_rules`
+- `firestore_resolve_modules`
+
+### Gaps from the playground tool surface
+
+The `packages/playground/` app ships richer diagnostic tools that
+the `pyric bridge` does NOT register out of the box today. They're
+playground-specific orchestrators built on top of `useRuntimeStore`
+and other browser-only state:
+
+- `inspect_firestore_traffic` — structured dump of the sandbox traffic log
+- `seed_firestore_data_as_admin` — admin-bypass bulk writes for fixture setup
+- `generate_fixture_from_session` — snapshot `sandbox.history()` as a replay fixture
+- `try_rules_edit` — replay events under a proposed rules edit
+- `debug_firestore_rules` — orchestrator over simulate + lint + history + state
+
+These are powerful and worth lifting into the library so any
+`pyric bridge` user gets them. The blockers are: `inspect_traffic`
+needs a generic traffic-log API on `Sandbox` (today the playground
+maintains its own ring buffer); `try_rules_edit` + `debug_firestore_rules`
+are orchestrators that depend on the replay engine being wired to a
+generic "session" abstraction. Tracked as a follow-up — the underlying
+primitives (`sandbox.history()`, `pyric/sandbox/replay`, the rules
+simulator) all exist.

package/dist/auth/domains/handler.d.ts

@@ -0,0 +1,6 @@
+import type { ProjectScope } from 'pyric-tools/deploy';
+import type { ManageDomainsInput, ManageDomainsResult } from './spec.js';
+export declare class ManageDomainsHandler {
+    execute(scope: ProjectScope, input: ManageDomainsInput): Promise<ManageDomainsResult>;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/auth/domains/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/auth/domains/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEzE,qBAAa,oBAAoB;IACzB,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAiF5F"}

package/dist/auth/domains/handler.js

@@ -0,0 +1,75 @@
+export class ManageDomainsHandler {
+    async execute(scope, input) {
+        try {
+            const token = await scope.resolveToken();
+            const configUrl = `https://identitytoolkit.googleapis.com/admin/v2/projects/${scope.projectId}/config`;
+            // Read current config to get authorized domains
+            const getRes = await fetch(configUrl, {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            if (getRes.status === 403) {
+                return {
+                    success: false,
+                    error: { code: 'PERMISSION_DENIED', message: 'Permission denied reading auth config', recoverable: false },
+                };
+            }
+            if (!getRes.ok) {
+                return {
+                    success: false,
+                    error: { code: 'DOMAIN_CONFIG_FAILED', message: `Failed to read config: ${getRes.status}`, recoverable: false },
+                };
+            }
+            const config = await getRes.json();
+            const domains = config.authorizedDomains || [];
+            if (input.action === 'list') {
+                return { success: true, authorizedDomains: domains };
+            }
+            if (!input.domain || input.domain.trim() === '') {
+                return {
+                    success: false,
+                    error: { code: 'INVALID_DOMAIN', message: 'Domain is required for add/remove actions', recoverable: true },
+                };
+            }
+            const domain = input.domain.trim();
+            let warning;
+            if (input.action === 'add') {
+                if (domains.includes(domain)) {
+                    return { success: true, authorizedDomains: domains };
+                }
+                domains.push(domain);
+            }
+            else {
+                // remove
+                if (!domains.includes(domain)) {
+                    return { success: true, authorizedDomains: domains };
+                }
+                if (domain === 'localhost') {
+                    warning = 'Removing localhost may break local development. Re-add it with action: "add" if needed.';
+                }
+                const idx = domains.indexOf(domain);
+                domains.splice(idx, 1);
+            }
+            // Write updated domains
+            const patchRes = await fetch(`${configUrl}?updateMask=authorizedDomains`, {
+                method: 'PATCH',
+                headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+                body: JSON.stringify({ authorizedDomains: domains }),
+            });
+            if (!patchRes.ok) {
+                const body = await patchRes.text().catch(() => '');
+                return {
+                    success: false,
+                    error: { code: 'DOMAIN_CONFIG_FAILED', message: `Failed to update domains: ${patchRes.status} ${body}`, recoverable: false },
+                };
+            }
+            return { success: true, authorizedDomains: domains, warning };
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: { code: 'DOMAIN_CONFIG_FAILED', message: e instanceof Error ? e.message : String(e), recoverable: false },
+            };
+        }
+    }
+}
+//# sourceMappingURL=handler.js.map

package/dist/auth/domains/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/auth/domains/handler.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,oBAAoB;IAC/B,KAAK,CAAC,OAAO,CAAC,KAAmB,EAAE,KAAyB;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,4DAA4D,KAAK,CAAC,SAAS,SAAS,CAAC;YAEvG,gDAAgD;YAChD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;gBACpC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,KAAK,EAAE;iBAC3G,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,0BAA0B,MAAM,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;iBAChH,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAsC,CAAC;YACvE,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAE/C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;YACvD,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAChD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,2CAA2C,EAAE,WAAW,EAAE,IAAI,EAAE;iBAC3G,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,OAA2B,CAAC;YAEhC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC3B,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;gBACvD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,SAAS;gBACT,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;gBACvD,CAAC;gBACD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;oBAC3B,OAAO,GAAG,yFAAyF,CAAC;gBACtG,CAAC;gBACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACpC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACzB,CAAC;YAED,wBAAwB;YACxB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,+BAA+B,EAAE;gBACxE,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;aACrD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,6BAA6B,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;iBAC7H,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE;aACjH,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/auth/domains/spec.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+export declare const ManageDomainsInputSchema: z.ZodObject<{
+    action: z.ZodEnum<["add", "remove", "list"]>;
+    domain: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    action: "remove" | "add" | "list";
+    domain?: string | undefined;
+}, {
+    action: "remove" | "add" | "list";
+    domain?: string | undefined;
+}>;
+export type ManageDomainsInput = z.infer<typeof ManageDomainsInputSchema>;
+export type ManageDomainsResult = {
+    success: true;
+    authorizedDomains: string[];
+    warning?: string;
+} | {
+    success: false;
+    error: {
+        code: string;
+        message: string;
+        recoverable: boolean;
+    };
+};
+//# sourceMappingURL=spec.d.ts.map

package/dist/auth/domains/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/auth/domains/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,wBAAwB;;;;;;;;;EAGnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC"}

package/dist/auth/domains/spec.js

@@ -0,0 +1,6 @@
+import { z } from 'zod';
+export const ManageDomainsInputSchema = z.object({
+    action: z.enum(['add', 'remove', 'list']).describe('Action to perform: add a domain, remove a domain, or list all authorized domains'),
+    domain: z.string().optional().describe('The domain to add or remove (required for add/remove, ignored for list)'),
+});
+//# sourceMappingURL=spec.js.map

package/dist/auth/domains/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/auth/domains/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,kFAAkF,CAAC;IACtI,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CAClH,CAAC,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `pyric/auth/admin` — Identity Toolkit-driven auth tooling.
+ *
+ * Sibling subpath to `pyric/auth` (the modular Web-SDK adapter).
+ * Control-plane surface lives here so the swap-in namespace doesn't
+ * pull in Identity Toolkit REST clients for browser bundles that just
+ * want `getAuth` / `signInAnonymously` / etc.
+ *
+ * Surface:
+ *   - `getAuthTools(scope)` — programmatic API returning `AuthTools`
+ *     (`generateIR`, `configureProvider`, `manageDomains`).
+ *   - `createAuthAdminTools({ scope })` — `ToolHandler[]` factory for
+ *     `@inbrowser/agent` / MCP wiring. Mirrors the
+ *     `createRtdbAdminTools` shape.
+ *   - Types: `AuthIR`, `AuthTools`, `AuthProviderId`,
+ *     `AuthIRGenerationError`, the provider/domains input/result
+ *     schemas.
+ *
+ * Per F3: every primitive takes `ProjectScope`. Per F4: callers invoke
+ * `resolveToken()` per call.
+ */
+export { getAuthTools } from './resolver.js';
+export { createAuthAdminTools } from './tools.js';
+export type { AuthAdminToolDeps } from './tools.js';
+export { AuthMapper } from './mapper.js';
+export type { AuthProviderId, AuthIR, AuthTools, } from './types.js';
+export { AuthIRGenerationError } from './types.js';
+export { ConfigureProviderHandler } from './provider/handler.js';
+export { ConfigureProviderInputSchema, ProviderIdSchema, } from './provider/spec.js';
+export type { ConfigureProviderInput, ConfigureAuthResult, ProviderId, } from './provider/spec.js';
+export { ManageDomainsHandler } from './domains/handler.js';
+export { ManageDomainsInputSchema } from './domains/spec.js';
+export type { ManageDomainsInput, ManageDomainsResult, } from './domains/spec.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,YAAY,EACV,cAAc,EACd,MAAM,EACN,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,sBAAsB,EACtB,mBAAmB,EACnB,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,30 @@
+/**
+ * `pyric/auth/admin` — Identity Toolkit-driven auth tooling.
+ *
+ * Sibling subpath to `pyric/auth` (the modular Web-SDK adapter).
+ * Control-plane surface lives here so the swap-in namespace doesn't
+ * pull in Identity Toolkit REST clients for browser bundles that just
+ * want `getAuth` / `signInAnonymously` / etc.
+ *
+ * Surface:
+ *   - `getAuthTools(scope)` — programmatic API returning `AuthTools`
+ *     (`generateIR`, `configureProvider`, `manageDomains`).
+ *   - `createAuthAdminTools({ scope })` — `ToolHandler[]` factory for
+ *     `@inbrowser/agent` / MCP wiring. Mirrors the
+ *     `createRtdbAdminTools` shape.
+ *   - Types: `AuthIR`, `AuthTools`, `AuthProviderId`,
+ *     `AuthIRGenerationError`, the provider/domains input/result
+ *     schemas.
+ *
+ * Per F3: every primitive takes `ProjectScope`. Per F4: callers invoke
+ * `resolveToken()` per call.
+ */
+export { getAuthTools } from './resolver.js';
+export { createAuthAdminTools } from './tools.js';
+export { AuthMapper } from './mapper.js';
+export { AuthIRGenerationError } from './types.js';
+export { ConfigureProviderHandler } from './provider/handler.js';
+export { ConfigureProviderInputSchema, ProviderIdSchema, } from './provider/spec.js';
+export { ManageDomainsHandler } from './domains/handler.js';
+export { ManageDomainsInputSchema } from './domains/spec.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/auth/mapper.d.ts

@@ -0,0 +1,5 @@
+import { AuthIR } from './types.js';
+export declare class AuthMapper {
+    static mapToIR(idpData: any, configData: any): AuthIR;
+}
+//# sourceMappingURL=mapper.d.ts.map

package/dist/auth/mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapper.d.ts","sourceRoot":"","sources":["../../src/auth/mapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAyC,MAAM,YAAY,CAAC;AAE3E,qBAAa,UAAU;IACrB,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,GAAG,MAAM;CAkDtD"}

package/dist/auth/mapper.js

@@ -0,0 +1,49 @@
+import { AuthIRGenerationError } from './types.js';
+export class AuthMapper {
+    static mapToIR(idpData, configData) {
+        if (!idpData || typeof idpData !== 'object') {
+            throw new AuthIRGenerationError('idpData', 'Invalid or missing IDP data payload');
+        }
+        if (!configData || typeof configData !== 'object') {
+            throw new AuthIRGenerationError('configData', 'Invalid or missing config data payload');
+        }
+        const enabledProviders = (idpData.defaultSupportedIdpConfigs || [])
+            .filter((config) => config.enabled === true) // absent enabled field means disabled
+            .map((config) => {
+            if (!config || !config.name) {
+                throw new AuthIRGenerationError('name', 'IDP config is missing name field');
+            }
+            const parts = config.name.split('/');
+            return parts[parts.length - 1];
+        });
+        const signIn = configData.signIn;
+        if (!signIn || typeof signIn !== 'object') {
+            throw new AuthIRGenerationError('signIn', 'Config data is missing signIn configuration');
+        }
+        const allowPasswordSignup = signIn.email?.enabled === true;
+        // API returns {} not undefined when disabled
+        const enableAnonymousUser = signIn.anonymous?.enabled === true;
+        const enablePhone = signIn.phoneNumber?.enabled === true;
+        // Merge config-based providers into enabledProviders
+        // (OAuth providers come from defaultSupportedIdpConfigs, but email/anonymous/phone
+        // are in the signIn config, not the IDP list)
+        if (allowPasswordSignup && !enabledProviders.includes('password')) {
+            enabledProviders.push('password');
+        }
+        if (enableAnonymousUser && !enabledProviders.includes('anonymous')) {
+            enabledProviders.push('anonymous');
+        }
+        if (enablePhone && !enabledProviders.includes('phone')) {
+            enabledProviders.push('phone');
+        }
+        return {
+            service: "authentication",
+            enabledProviders,
+            settings: {
+                allowPasswordSignup,
+                enableAnonymousUser
+            }
+        };
+    }
+}
+//# sourceMappingURL=mapper.js.map

package/dist/auth/mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapper.js","sourceRoot":"","sources":["../../src/auth/mapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,OAAO,UAAU;IACrB,MAAM,CAAC,OAAO,CAAC,OAAY,EAAE,UAAe;QAC1C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,qBAAqB,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,qBAAqB,CAAC,YAAY,EAAE,wCAAwC,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,gBAAgB,GAAqB,CAAC,OAAO,CAAC,0BAA0B,IAAI,EAAE,CAAC;aAClF,MAAM,CAAC,CAAC,MAAW,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,sCAAsC;aACvF,GAAG,CAAC,CAAC,MAAW,EAAE,EAAE;YACnB,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,qBAAqB,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAmB,CAAC;QACnD,CAAC,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,6CAA6C,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;QAC3D,6CAA6C;QAC7C,MAAM,mBAAmB,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;QAC/D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;QAEzD,qDAAqD;QACrD,mFAAmF;QACnF,8CAA8C;QAC9C,IAAI,mBAAmB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,mBAAmB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnE,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,WAAW,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAED,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,gBAAgB;YAChB,QAAQ,EAAE;gBACR,mBAAmB;gBACnB,mBAAmB;aACpB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/provider/handler.d.ts

@@ -0,0 +1,9 @@
+import type { ProjectScope } from 'pyric-tools/deploy';
+import type { ConfigureProviderInput, ConfigureAuthResult } from './spec.js';
+export declare class ConfigureProviderHandler {
+    execute(scope: ProjectScope, input: ConfigureProviderInput): Promise<ConfigureAuthResult>;
+    private configureSimple;
+    private configurePhone;
+    private configureGoogle;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/auth/provider/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/auth/provider/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAc,MAAM,WAAW,CAAC;AAEzF,qBAAa,wBAAwB;IAC7B,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,mBAAmB,CAAC;YA8BjF,eAAe;YAgCf,cAAc;YAkCd,eAAe;CAiD9B"}

package/dist/auth/provider/handler.js

@@ -0,0 +1,128 @@
+export class ConfigureProviderHandler {
+    async execute(scope, input) {
+        try {
+            switch (input.provider) {
+                case 'anonymous':
+                    return await this.configureSimple(scope, input.provider, input.enabled, {
+                        updateMask: 'signIn.anonymous.enabled',
+                        body: { signIn: { anonymous: { enabled: input.enabled } } },
+                    });
+                case 'email':
+                    return await this.configureSimple(scope, input.provider, input.enabled, {
+                        updateMask: 'signIn.email.enabled,signIn.email.passwordRequired',
+                        body: { signIn: { email: { enabled: input.enabled, passwordRequired: true } } },
+                    });
+                case 'phone':
+                    return await this.configurePhone(scope, input.enabled);
+                case 'google':
+                    return await this.configureGoogle(scope, input.enabled);
+            }
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: {
+                    code: 'PROVIDER_CONFIG_FAILED',
+                    message: e instanceof Error ? e.message : String(e),
+                    recoverable: false,
+                },
+            };
+        }
+    }
+    async configureSimple(scope, provider, enabled, opts) {
+        const token = await scope.resolveToken();
+        const url = `https://identitytoolkit.googleapis.com/admin/v2/projects/${scope.projectId}/config?updateMask=${opts.updateMask}`;
+        const patchRes = await fetch(url, {
+            method: 'PATCH',
+            headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify(opts.body),
+        });
+        if (patchRes.status === 403) {
+            return {
+                success: false,
+                error: { code: 'PERMISSION_DENIED', message: `Permission denied configuring ${provider}`, recoverable: false },
+            };
+        }
+        if (!patchRes.ok) {
+            const body = await patchRes.text().catch(() => '');
+            return {
+                success: false,
+                error: { code: 'PROVIDER_CONFIG_FAILED', message: `Failed to configure ${provider}: ${patchRes.status} ${body}`, recoverable: false },
+            };
+        }
+        return { success: true, provider, enabled };
+    }
+    async configurePhone(scope, enabled) {
+        const token = await scope.resolveToken();
+        const url = `https://identitytoolkit.googleapis.com/admin/v2/projects/${scope.projectId}/config?updateMask=signIn.phoneNumber.enabled`;
+        const res = await fetch(url, {
+            method: 'PATCH',
+            headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ signIn: { phoneNumber: { enabled } } }),
+        });
+        if (res.status === 403) {
+            return {
+                success: false,
+                error: { code: 'PERMISSION_DENIED', message: 'Permission denied configuring phone auth', recoverable: false },
+            };
+        }
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            return {
+                success: false,
+                error: { code: 'PROVIDER_CONFIG_FAILED', message: `Failed to configure phone: ${res.status} ${body}`, recoverable: false },
+            };
+        }
+        return {
+            success: true,
+            provider: 'phone',
+            enabled,
+            warning: enabled
+                ? 'Phone authentication requires a billing account for SMS delivery. Verify billing is enabled in the Google Cloud Console for this project.'
+                : undefined,
+        };
+    }
+    async configureGoogle(scope, enabled) {
+        const token = await scope.resolveToken();
+        const baseUrl = `https://identitytoolkit.googleapis.com/admin/v2/projects/${scope.projectId}/defaultSupportedIdpConfigs/google.com`;
+        const checkRes = await fetch(baseUrl, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        if (checkRes.status === 404) {
+            return {
+                success: false,
+                error: {
+                    code: 'GOOGLE_NOT_PROVISIONED',
+                    message: 'Google sign-in has not been configured for this project. Enable it once in the Firebase Console (Authentication → Sign-in method → Google) to auto-provision the OAuth client, then this tool can toggle it.',
+                    recoverable: false,
+                },
+            };
+        }
+        if (!checkRes.ok) {
+            return {
+                success: false,
+                error: { code: 'PROVIDER_CONFIG_FAILED', message: `Failed to check Google config: ${checkRes.status}`, recoverable: false },
+            };
+        }
+        const patchRes = await fetch(`${baseUrl}?updateMask=enabled`, {
+            method: 'PATCH',
+            headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ enabled }),
+        });
+        if (patchRes.status === 403) {
+            return {
+                success: false,
+                error: { code: 'PERMISSION_DENIED', message: 'Permission denied configuring Google sign-in', recoverable: false },
+            };
+        }
+        if (!patchRes.ok) {
+            const body = await patchRes.text().catch(() => '');
+            return {
+                success: false,
+                error: { code: 'PROVIDER_CONFIG_FAILED', message: `Failed to configure Google: ${patchRes.status} ${body}`, recoverable: false },
+            };
+        }
+        return { success: true, provider: 'google', enabled };
+    }
+}
+//# sourceMappingURL=handler.js.map

package/dist/auth/provider/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/auth/provider/handler.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,wBAAwB;IACnC,KAAK,CAAC,OAAO,CAAC,KAAmB,EAAE,KAA6B;QAC9D,IAAI,CAAC;YACH,QAAQ,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACvB,KAAK,WAAW;oBACd,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE;wBACtE,UAAU,EAAE,0BAA0B;wBACtC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE;qBAC5D,CAAC,CAAC;gBACL,KAAK,OAAO;oBACV,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE;wBACtE,UAAU,EAAE,oDAAoD;wBAChE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE;qBAChF,CAAC,CAAC;gBACL,KAAK,OAAO;oBACV,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACzD,KAAK,QAAQ;oBACX,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;oBACnD,WAAW,EAAE,KAAK;iBACnB;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,KAAmB,EACnB,QAAoB,EACpB,OAAgB,EAChB,IAA2D;QAE3D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,4DAA4D,KAAK,CAAC,SAAS,sBAAsB,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/H,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAChC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,iCAAiC,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;aAC/G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,uBAAuB,QAAQ,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;aACtI,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAmB,EAAE,OAAgB;QAChE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,4DAA4D,KAAK,CAAC,SAAS,+CAA+C,CAAC;QACvI,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;SAC/D,CAAC,CAAC;QAEH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,0CAA0C,EAAE,WAAW,EAAE,KAAK,EAAE;aAC9G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,8BAA8B,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;aAC3H,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,OAAO;YACjB,OAAO;YACP,OAAO,EAAE,OAAO;gBACd,CAAC,CAAC,2IAA2I;gBAC7I,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAAmB,EAAE,OAAgB;QACjE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,4DAA4D,KAAK,CAAC,SAAS,wCAAwC,CAAC;QAEpI,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,8MAA8M;oBACvN,WAAW,EAAE,KAAK;iBACnB;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,kCAAkC,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;aAC5H,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,qBAAqB,EAAE;YAC5D,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,KAAK,EAAE;aAClH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,+BAA+B,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;aACjI,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACxD,CAAC;CACF"}

package/dist/auth/provider/spec.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+export declare const ProviderIdSchema: z.ZodEnum<["anonymous", "email", "phone", "google"]>;
+export type ProviderId = z.infer<typeof ProviderIdSchema>;
+export declare const ConfigureProviderInputSchema: z.ZodObject<{
+    provider: z.ZodEnum<["anonymous", "email", "phone", "google"]>;
+    enabled: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    provider: "email" | "anonymous" | "phone" | "google";
+}, {
+    enabled: boolean;
+    provider: "email" | "anonymous" | "phone" | "google";
+}>;
+export type ConfigureProviderInput = z.infer<typeof ConfigureProviderInputSchema>;
+export type ConfigureAuthResult = {
+    success: true;
+    provider: string;
+    enabled: boolean;
+    warning?: string;
+} | {
+    success: false;
+    error: {
+        code: string;
+        message: string;
+        recoverable: boolean;
+    };
+};
+export declare const ConfigureAuthErrorCode: z.ZodEnum<["PROVIDER_CONFIG_FAILED", "PERMISSION_DENIED", "GOOGLE_NOT_PROVISIONED"]>;
+//# sourceMappingURL=spec.d.ts.map

package/dist/auth/provider/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/auth/provider/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB,sDAAoD,CAAC;AAClF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,4BAA4B;;;;;;;;;EAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC;AAEvF,eAAO,MAAM,sBAAsB,sFAIjC,CAAC"}

package/dist/auth/provider/spec.js

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+export const ProviderIdSchema = z.enum(['anonymous', 'email', 'phone', 'google']);
+export const ConfigureProviderInputSchema = z.object({
+    provider: ProviderIdSchema.describe('The auth provider to configure: anonymous, email, phone, or google'),
+    enabled: z.boolean().describe('Whether to enable (true) or disable (false) the provider'),
+});
+export const ConfigureAuthErrorCode = z.enum([
+    'PROVIDER_CONFIG_FAILED',
+    'PERMISSION_DENIED',
+    'GOOGLE_NOT_PROVISIONED',
+]);
+//# sourceMappingURL=spec.js.map

package/dist/auth/provider/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/auth/provider/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGlF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IACzG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;CAC1F,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,wBAAwB;IACxB,mBAAmB;IACnB,wBAAwB;CACzB,CAAC,CAAC"}

package/dist/auth/resolver.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `getAuthTools(scope)` — programmatic auth admin API. Returns the
+ * {@link AuthTools} surface backed by Identity Toolkit calls under a
+ * {@link ProjectScope}.
+ *
+ * Per F3, every primitive takes ProjectScope. Per F4, callers invoke
+ * `resolveToken()` per call — no token caching at this layer.
+ *
+ * `fetchIdentityToolkit` (the helper that used to hang off AgentApp)
+ * inlines here as a thin Bearer-token fetch wrapper — that's all the
+ * old `app.fetchIdentityToolkit` was.
+ */
+import type { ProjectScope } from 'pyric-tools/deploy';
+import type { AuthTools } from './types.js';
+export declare function getAuthTools(scope: ProjectScope): AuthTools;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/auth/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/auth/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAU,MAAM,YAAY,CAAC;AAiBpD,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,CAsB3D"}