pyric-tools 0.1.0-alpha.7

package/dist/deploy/api-enablement.js

@@ -0,0 +1,125 @@
+const SERVICEUSAGE_API = 'https://serviceusage.googleapis.com/v1';
+/** Bounded wait for a batchEnable long-running operation to finish. */
+const ENABLE_TIMEOUT_MS = 120_000;
+const POLL_INTERVAL_MS = 2_000;
+/** Console deeplink that enables a single API on the project. */
+function consoleEnableUrl(api, projectId) {
+    return `https://console.developers.google.com/apis/api/${api}/overview?project=${encodeURIComponent(projectId)}`;
+}
+/**
+ * Current enablement of one service. `'unknown'` when the GET itself fails
+ * (e.g. `serviceusage.services.get` denied) — treated as "attempt enable" so
+ * batchEnable surfaces the real, actionable permission error.
+ */
+async function serviceState(fetchImpl, token, projectId, api) {
+    let res;
+    try {
+        res = await fetchImpl(`${SERVICEUSAGE_API}/projects/${encodeURIComponent(projectId)}/services/${encodeURIComponent(api)}`, { headers: { authorization: `Bearer ${token}` } });
+    }
+    catch {
+        return 'unknown';
+    }
+    if (!res.ok)
+        return 'unknown';
+    const body = (await res.json().catch(() => ({})));
+    return body.state === 'ENABLED' ? 'enabled' : 'disabled';
+}
+/**
+ * Ensure every API in `apis` is enabled on the project. Returns `{ ok: true }`
+ * when all are (already, or after a successful enable); `{ ok: false, exit }`
+ * when enablement is needed but the caller lacks permission (console links
+ * printed) or a transport/operation failure occurs.
+ */
+export async function ensureApisEnabled(opts) {
+    const { scope, apis, out, err } = opts;
+    if (apis.length === 0)
+        return { ok: true };
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const now = opts.now ?? (() => Date.now());
+    let token;
+    try {
+        token = await scope.resolveToken();
+    }
+    catch (e) {
+        err.write(`pyric deploy: failed to resolve access token for API check: ${e instanceof Error ? e.message : String(e)}\n`);
+        return { ok: false, exit: 2 };
+    }
+    // Detect the missing ones. De-dupe so a union of overlapping target lists
+    // doesn't probe the same API twice.
+    const unique = [...new Set(apis)];
+    const states = await Promise.all(unique.map((api) => serviceState(fetchImpl, token, scope.projectId, api).then((s) => [api, s])));
+    const missing = states.filter(([, s]) => s !== 'enabled').map(([api]) => api);
+    if (missing.length === 0)
+        return { ok: true };
+    const plural = missing.length > 1;
+    out.write(`pyric deploy: enabling required Google API${plural ? 's' : ''} on '${scope.projectId}': ${missing.join(', ')}...\n`);
+    // batchEnable returns a long-running operation; we poll it to completion.
+    let op;
+    try {
+        const res = await fetchImpl(`${SERVICEUSAGE_API}/projects/${encodeURIComponent(scope.projectId)}/services:batchEnable`, {
+            method: 'POST',
+            headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+            body: JSON.stringify({ serviceIds: missing }),
+        });
+        if (res.status === 401 || res.status === 403) {
+            // No permission to enable (lacks serviceUsageAdmin/Owner). The honest
+            // dead-end: print the console links so the user can enable and re-run.
+            err.write(`pyric deploy: can't enable the required API${plural ? 's' : ''} automatically — ` +
+                `your account lacks roles/serviceusage.serviceUsageAdmin (or Owner) on '${scope.projectId}'. ` +
+                `Enable ${plural ? 'them' : 'it'} in the console, then re-run:\n`);
+            for (const api of missing)
+                err.write(`  ${api}\n    ${consoleEnableUrl(api, scope.projectId)}\n`);
+            return { ok: false, exit: 1 };
+        }
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            err.write(`pyric deploy: failed to enable APIs (${res.status}): ${body}\n`);
+            return { ok: false, exit: 2 };
+        }
+        op = (await res.json().catch(() => ({})));
+    }
+    catch (e) {
+        err.write(`pyric deploy: API enable request failed: ${e instanceof Error ? e.message : String(e)}\n`);
+        return { ok: false, exit: 2 };
+    }
+    // Poll the operation until done (bounded). Capture the name once — the LRO
+    // GET echoes it, but we poll a fixed URL rather than trusting each response
+    // to carry it. An already-done or name-less op skips the loop.
+    const opName = op.name;
+    if (op.done !== true && typeof opName === 'string') {
+        const deadline = now() + ENABLE_TIMEOUT_MS;
+        for (;;) {
+            if (now() >= deadline) {
+                err.write(`pyric deploy: timed out waiting for API enablement on '${scope.projectId}'. Re-run to retry.\n`);
+                return { ok: false, exit: 2 };
+            }
+            await sleep(POLL_INTERVAL_MS);
+            let res;
+            try {
+                res = await fetchImpl(`${SERVICEUSAGE_API}/${opName}`, {
+                    headers: { authorization: `Bearer ${token}` },
+                });
+            }
+            catch (e) {
+                err.write(`pyric deploy: polling API enablement failed: ${e instanceof Error ? e.message : String(e)}\n`);
+                return { ok: false, exit: 2 };
+            }
+            if (!res.ok) {
+                const body = await res.text().catch(() => '');
+                err.write(`pyric deploy: failed polling API enablement (${res.status}): ${body}\n`);
+                return { ok: false, exit: 2 };
+            }
+            op = (await res.json().catch(() => ({})));
+            if (op.done === true)
+                break;
+        }
+    }
+    if (op.error) {
+        err.write(`pyric deploy: API enablement failed: ${op.error.message ?? 'unknown error'}\n`);
+        return { ok: false, exit: 2 };
+    }
+    out.write(`pyric deploy: enabled ${missing.join(', ')}.\n`);
+    return { ok: true };
+}
+//# sourceMappingURL=api-enablement.js.map

package/dist/deploy/api-enablement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-enablement.js","sourceRoot":"","sources":["../../src/deploy/api-enablement.ts"],"names":[],"mappings":"AAkBA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAElE,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AA8B/B,iEAAiE;AACjE,SAAS,gBAAgB,CAAC,GAAW,EAAE,SAAiB;IACtD,OAAO,kDAAkD,GAAG,qBAAqB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;AACnH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,SAAuB,EACvB,KAAa,EACb,SAAiB,EACjB,GAAW;IAEX,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CACnB,GAAG,gBAAgB,aAAa,kBAAkB,CAAC,SAAS,CAAC,aAAa,kBAAkB,CAAC,GAAG,CAAC,EAAE,EACnG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAClD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;IACxE,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAuB;IAC7D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE3C,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CACP,+DAA+D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAC9G,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAChC,CAAC;IAED,0EAA0E;IAC1E,oCAAoC;IACpC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACjB,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAU,CAAC,CACpF,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAE9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,GAAG,CAAC,KAAK,CACP,6CAA6C,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,CAAC,SAAS,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CACrH,CAAC;IAEF,0EAA0E;IAC1E,IAAI,EAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,gBAAgB,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,uBAAuB,EAC1F;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;SAC9C,CACF,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,sEAAsE;YACtE,uEAAuE;YACvE,GAAG,CAAC,KAAK,CACP,8CAA8C,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,mBAAmB;gBAChF,0EAA0E,KAAK,CAAC,SAAS,KAAK;gBAC9F,UAAU,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,iCAAiC,CACpE,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,OAAO;gBAAE,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,MAAM,IAAI,IAAI,CAAC,CAAC;YAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAChC,CAAC;QACD,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAc,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,4CAA4C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAChC,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC;IACvB,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,iBAAiB,CAAC;QAC3C,SAAS,CAAC;YACR,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtB,GAAG,CAAC,KAAK,CACP,0DAA0D,KAAK,CAAC,SAAS,uBAAuB,CACjG,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAChC,CAAC;YACD,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC9B,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,gBAAgB,IAAI,MAAM,EAAE,EAAE;oBACrD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;iBAC9C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,KAAK,CAAC,gDAAgD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,gDAAgD,GAAG,CAAC,MAAM,MAAM,IAAI,IAAI,CAAC,CAAC;gBACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAChC,CAAC;YACD,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAc,CAAC;YACvD,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,eAAe,IAAI,CAAC,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/deploy/firestore/databases.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Firestore database provisioning. Idempotent — probes first,
+ * creates if absent. Takes `ProjectScope` per F3.
+ */
+import { type ProjectScope } from '../scope.js';
+export interface ProvisionDatabaseOptions {
+    /** Name of the database. Default `'(default)'`. */
+    databaseId?: string;
+    /** Multi-region or region. Default `'nam5'`. */
+    locationId?: string;
+    /** Default `'FIRESTORE_NATIVE'`. */
+    type?: 'FIRESTORE_NATIVE' | 'DATASTORE_MODE';
+}
+export type ProvisionDatabaseOutcome = {
+    ok: true;
+    status: 'created';
+    operationName: string;
+} | {
+    ok: true;
+    status: 'already-exists';
+} | {
+    ok: false;
+    code: 'permission-denied' | 'unknown';
+    message: string;
+};
+/**
+ * Create the default (or named) Firestore database in the project.
+ * Idempotent: probes first via `GET .../databases/<id>` and
+ * short-circuits with `already-exists` when present.
+ *
+ * Returns the long-running-operation name on a fresh provision;
+ * callers that want strict ordering should poll the LRO before
+ * issuing writes (Firestore's data plane comes online ~30s after
+ * the initial 200).
+ *
+ * Required IAM (subsumed by Owner/Editor):
+ *   - `datastore.databases.get`
+ *   - `datastore.databases.create`
+ */
+export declare function provision(scope: ProjectScope, options?: ProvisionDatabaseOptions): Promise<ProvisionDatabaseOutcome>;
+//# sourceMappingURL=databases.d.ts.map

package/dist/deploy/firestore/databases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"databases.d.ts","sourceRoot":"","sources":["../../../src/deploy/firestore/databases.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAI/D,MAAM,WAAW,wBAAwB;IACvC,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,IAAI,CAAC,EAAE,kBAAkB,GAAG,gBAAgB,CAAC;CAC9C;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACtC;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,wBAAwB,CAAC,CAyDnC"}

package/dist/deploy/firestore/databases.js

@@ -0,0 +1,63 @@
+/**
+ * Firestore database provisioning. Idempotent — probes first,
+ * creates if absent. Takes `ProjectScope` per F3.
+ */
+import { AdminApiError } from '../scope.js';
+const FIRESTORE_ADMIN_API = 'https://firestore.googleapis.com/v1';
+/**
+ * Create the default (or named) Firestore database in the project.
+ * Idempotent: probes first via `GET .../databases/<id>` and
+ * short-circuits with `already-exists` when present.
+ *
+ * Returns the long-running-operation name on a fresh provision;
+ * callers that want strict ordering should poll the LRO before
+ * issuing writes (Firestore's data plane comes online ~30s after
+ * the initial 200).
+ *
+ * Required IAM (subsumed by Owner/Editor):
+ *   - `datastore.databases.get`
+ *   - `datastore.databases.create`
+ */
+export async function provision(scope, options = {}) {
+    const databaseId = options.databaseId ?? '(default)';
+    const locationId = options.locationId ?? 'nam5';
+    const type = options.type ?? 'FIRESTORE_NATIVE';
+    try {
+        const token = await scope.resolveToken();
+        const probe = await fetch(`${FIRESTORE_ADMIN_API}/projects/${encodeURIComponent(scope.projectId)}/databases/${encodeURIComponent(databaseId)}`, { headers: { Authorization: `Bearer ${token}` } });
+        if (probe.ok)
+            return { ok: true, status: 'already-exists' };
+        if (probe.status !== 404) {
+            throw new AdminApiError(probe.status, await probe.text(), `Failed to probe database: ${probe.status}`);
+        }
+        const createRes = await fetch(`${FIRESTORE_ADMIN_API}/projects/${encodeURIComponent(scope.projectId)}/databases?databaseId=${encodeURIComponent(databaseId)}`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ locationId, type }),
+        });
+        if (!createRes.ok) {
+            throw new AdminApiError(createRes.status, await createRes.text(), `Failed to create database: ${createRes.status}`);
+        }
+        const lro = (await createRes.json());
+        return {
+            ok: true,
+            status: 'created',
+            operationName: lro.name ?? '',
+        };
+    }
+    catch (e) {
+        if (e instanceof AdminApiError &&
+            (e.status === 401 || e.status === 403)) {
+            return { ok: false, code: 'permission-denied', message: e.message };
+        }
+        return {
+            ok: false,
+            code: 'unknown',
+            message: e instanceof Error ? e.message : String(e),
+        };
+    }
+}
+//# sourceMappingURL=databases.js.map

package/dist/deploy/firestore/databases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"databases.js","sourceRoot":"","sources":["../../../src/deploy/firestore/databases.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAqB,MAAM,aAAa,CAAC;AAE/D,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAoBlE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAmB,EACnB,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,KAAK,CACvB,GAAG,mBAAmB,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,kBAAkB,CAAC,UAAU,CAAC,EAAE,EACpH,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAClD,CAAC;QACF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,aAAa,CACrB,KAAK,CAAC,MAAM,EACZ,MAAM,KAAK,CAAC,IAAI,EAAE,EAClB,6BAA6B,KAAK,CAAC,MAAM,EAAE,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAC3B,GAAG,mBAAmB,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,yBAAyB,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAC/H;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;SAC3C,CACF,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,aAAa,CACrB,SAAS,CAAC,MAAM,EAChB,MAAM,SAAS,CAAC,IAAI,EAAE,EACtB,8BAA8B,SAAS,CAAC,MAAM,EAAE,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAsB,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;SAC9B,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IACE,CAAC,YAAY,aAAa;YAC1B,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,EACtC,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACtE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACpD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/deploy/firestore/indexes.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Firestore composite-index deploy + status polling. Pure-fetch
+ * over the Firestore Admin v1 API. Wire types mirror
+ * `firestore.indexes.json` shape.
+ */
+import { type ProjectScope } from '../scope.js';
+export type QueryScope = 'COLLECTION' | 'COLLECTION_GROUP';
+export type IndexFieldOrder = 'ASCENDING' | 'DESCENDING';
+export type ArrayConfig = 'CONTAINS';
+export type IndexState = 'CREATING' | 'READY' | 'NEEDS_REPAIR';
+export type ApiScope = 'ANY_API' | 'DATASTORE_MODE_API' | 'MONGODB_COMPATIBLE_API';
+export type Density = 'DENSE' | 'SPARSE_ALL' | 'SPARSE_ANY' | 'DENSITY_UNSPECIFIED';
+export interface VectorConfig {
+    dimension: number;
+    flat?: Record<string, never>;
+}
+export interface IndexField {
+    fieldPath: string;
+    order?: IndexFieldOrder;
+    arrayConfig?: ArrayConfig;
+    vectorConfig?: VectorConfig;
+}
+/** Wire shape of an index — POST body to `.../indexes`. */
+export interface Index {
+    /** Server-assigned. Present on read responses, not create requests. */
+    name?: string;
+    queryScope: QueryScope;
+    fields: IndexField[];
+    /** Server-assigned. */
+    state?: IndexState;
+    apiScope?: ApiScope;
+    density?: Density;
+    multikey?: boolean;
+    unique?: boolean;
+}
+export interface IndexesConfigEntry extends Index {
+    collectionGroup: string;
+}
+export interface IndexesConfig {
+    indexes: IndexesConfigEntry[];
+    fieldOverrides?: unknown[];
+}
+export interface IndexOperation {
+    name: string;
+    done?: boolean;
+    error?: {
+        code: number;
+        message: string;
+    };
+    response?: Index;
+}
+export interface DeployIndexesOptions {
+    databaseId?: string;
+}
+/**
+ * Create a single composite index. Primitive — throws
+ * `AdminApiError` on non-2xx. Returns the long-running-operation
+ * handle on success.
+ */
+export declare function create(scope: ProjectScope, entry: IndexesConfigEntry, options?: DeployIndexesOptions): Promise<IndexOperation>;
+export interface PerIndexOutcome {
+    collectionGroup: string;
+    fieldsSummary: string[];
+    status: 'started' | 'already-exists' | 'failed';
+    operationName?: string;
+    error?: {
+        httpStatus: number;
+        message: string;
+    };
+}
+export type DeployIndexesOutcome = {
+    ok: true;
+    operationsStarted: IndexOperation[];
+    alreadyExists: number;
+    perIndex: PerIndexOutcome[];
+} | {
+    ok: false;
+    code: 'permission-denied' | 'invalid-config' | 'create-failed' | 'unknown';
+    message: string;
+    partial?: {
+        operationsStarted: IndexOperation[];
+        alreadyExists: number;
+        perIndex: PerIndexOutcome[];
+    };
+};
+/**
+ * Batch-deploy a `firestore.indexes.json`-shaped config. Per-entry
+ * status (`started` / `already-exists` / `failed`); aborts the
+ * batch on `403`; on `ok: false` carries `partial` data so callers
+ * don't lose info about what did succeed.
+ */
+export declare function deployAll(scope: ProjectScope, config: IndexesConfig, options?: DeployIndexesOptions): Promise<DeployIndexesOutcome>;
+export type GetIndexStatusOutcome = {
+    ok: true;
+    state: 'CREATING' | 'NOT_FOUND';
+    operationName: string;
+} | {
+    ok: true;
+    state: IndexState;
+    operationName: string;
+    index?: {
+        name: string;
+        fields: {
+            fieldPath: string;
+            order?: string;
+            arrayConfig?: string;
+        }[];
+    };
+} | {
+    ok: false;
+    code: 'permission-denied' | 'build-failed' | 'unknown';
+    message: string;
+};
+/**
+ * Poll a long-running index build operation. `operationName` is
+ * the opaque resource path returned by `create` /
+ * `deployAll(..).operationsStarted[].name`.
+ */
+export declare function getStatus(scope: ProjectScope, operationName: string): Promise<GetIndexStatusOutcome>;
+//# sourceMappingURL=indexes.d.ts.map

package/dist/deploy/firestore/indexes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexes.d.ts","sourceRoot":"","sources":["../../../src/deploy/firestore/indexes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAI/D,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,kBAAkB,CAAC;AAC3D,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,YAAY,CAAC;AACzD,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC;AACrC,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC;AAE/D,MAAM,MAAM,QAAQ,GAChB,SAAS,GACT,oBAAoB,GACpB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,OAAO,GACf,OAAO,GACP,YAAY,GACZ,YAAY,GACZ,qBAAqB,CAAC;AAE1B,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,2DAA2D;AAC3D,MAAM,WAAW,KAAK;IACpB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,uBAAuB;IACvB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAmB,SAAQ,KAAK;IAC/C,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,cAAc,CAAC,CAqBzB;AAsBD,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,SAAS,GAAG,gBAAgB,GAAG,QAAQ,CAAC;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjD;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,iBAAiB,EAAE,cAAc,EAAE,CAAC;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EACA,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,GACf,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE;QACR,iBAAiB,EAAE,cAAc,EAAE,CAAC;QACpC,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,eAAe,EAAE,CAAC;KAC7B,CAAC;CACH,CAAC;AAEN;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,aAAa,EACrB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,oBAAoB,CAAC,CA2E/B;AA4CD,MAAM,MAAM,qBAAqB,GAC7B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,UAAU,GAAG,WAAW,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;CACvB,GACD;IACE,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,UAAU,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACvE,CAAC;CACH,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,mBAAmB,GAAG,cAAc,GAAG,SAAS,CAAC;IACvD,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,YAAY,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,CAAC,CAiEhC"}

package/dist/deploy/firestore/indexes.js

@@ -0,0 +1,243 @@
+/**
+ * Firestore composite-index deploy + status polling. Pure-fetch
+ * over the Firestore Admin v1 API. Wire types mirror
+ * `firestore.indexes.json` shape.
+ */
+import { AdminApiError } from '../scope.js';
+const FIRESTORE_ADMIN_API = 'https://firestore.googleapis.com/v1';
+/**
+ * Create a single composite index. Primitive — throws
+ * `AdminApiError` on non-2xx. Returns the long-running-operation
+ * handle on success.
+ */
+export async function create(scope, entry, options = {}) {
+    const token = await scope.resolveToken();
+    const databaseId = options.databaseId ?? '(default)';
+    const url = `${FIRESTORE_ADMIN_API}/projects/${encodeURIComponent(scope.projectId)}/databases/${encodeURIComponent(databaseId)}/collectionGroups/${encodeURIComponent(entry.collectionGroup)}/indexes`;
+    const body = entryToCreateBody(entry);
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        throw new AdminApiError(res.status, await res.text(), `Failed to create index: ${res.status}`);
+    }
+    return (await res.json());
+}
+function entryToCreateBody(entry) {
+    const body = {
+        queryScope: entry.queryScope,
+        fields: entry.fields,
+    };
+    if (entry.apiScope)
+        body.apiScope = entry.apiScope;
+    if (entry.density)
+        body.density = entry.density;
+    if (entry.multikey !== undefined)
+        body.multikey = entry.multikey;
+    if (entry.unique !== undefined)
+        body.unique = entry.unique;
+    return body;
+}
+function summarizeIndexFields(entry) {
+    return entry.fields.map((f) => {
+        if (f.arrayConfig)
+            return `${f.fieldPath}:${f.arrayConfig}`;
+        if (f.vectorConfig)
+            return `${f.fieldPath}:VECTOR(${f.vectorConfig.dimension})`;
+        return `${f.fieldPath}:${f.order ?? 'ASCENDING'}`;
+    });
+}
+/**
+ * Batch-deploy a `firestore.indexes.json`-shaped config. Per-entry
+ * status (`started` / `already-exists` / `failed`); aborts the
+ * batch on `403`; on `ok: false` carries `partial` data so callers
+ * don't lose info about what did succeed.
+ */
+export async function deployAll(scope, config, options = {}) {
+    const validation = validateIndexesConfig(config);
+    if (!validation.ok) {
+        return { ok: false, code: 'invalid-config', message: validation.message };
+    }
+    const databaseId = options.databaseId ?? '(default)';
+    const operationsStarted = [];
+    const perIndex = [];
+    let alreadyExists = 0;
+    for (const entry of config.indexes) {
+        const fieldsSummary = summarizeIndexFields(entry);
+        try {
+            const op = await create(scope, entry, { databaseId });
+            operationsStarted.push(op);
+            perIndex.push({
+                collectionGroup: entry.collectionGroup,
+                fieldsSummary,
+                status: 'started',
+                operationName: op.name,
+            });
+        }
+        catch (e) {
+            if (e instanceof AdminApiError) {
+                if (e.status === 403) {
+                    return {
+                        ok: false,
+                        code: 'permission-denied',
+                        message: e.message,
+                        partial: { operationsStarted, alreadyExists, perIndex },
+                    };
+                }
+                if (e.status === 409) {
+                    alreadyExists++;
+                    perIndex.push({
+                        collectionGroup: entry.collectionGroup,
+                        fieldsSummary,
+                        status: 'already-exists',
+                    });
+                    continue;
+                }
+                perIndex.push({
+                    collectionGroup: entry.collectionGroup,
+                    fieldsSummary,
+                    status: 'failed',
+                    error: { httpStatus: e.status, message: e.body || e.message },
+                });
+                continue;
+            }
+            const message = e instanceof Error ? e.message : String(e);
+            perIndex.push({
+                collectionGroup: entry.collectionGroup,
+                fieldsSummary,
+                status: 'failed',
+                error: { httpStatus: 0, message },
+            });
+            return {
+                ok: false,
+                code: 'create-failed',
+                message,
+                partial: { operationsStarted, alreadyExists, perIndex },
+            };
+        }
+    }
+    const failed = perIndex.filter((p) => p.status === 'failed');
+    if (failed.length > 0) {
+        return {
+            ok: false,
+            code: 'create-failed',
+            message: `${failed.length} of ${config.indexes.length} indexes failed to create`,
+            partial: { operationsStarted, alreadyExists, perIndex },
+        };
+    }
+    return { ok: true, operationsStarted, alreadyExists, perIndex };
+}
+function validateIndexesConfig(config) {
+    if (!config || typeof config !== 'object') {
+        return { ok: false, message: 'config must be an object' };
+    }
+    if (!Array.isArray(config.indexes)) {
+        return { ok: false, message: 'config.indexes must be an array' };
+    }
+    for (let i = 0; i < config.indexes.length; i++) {
+        const entry = config.indexes[i];
+        const prefix = `indexes[${i}]`;
+        if (!entry || typeof entry !== 'object') {
+            return { ok: false, message: `${prefix} must be an object` };
+        }
+        if (!entry.collectionGroup || typeof entry.collectionGroup !== 'string') {
+            return { ok: false, message: `${prefix}.collectionGroup must be a non-empty string` };
+        }
+        if (entry.queryScope !== 'COLLECTION' && entry.queryScope !== 'COLLECTION_GROUP') {
+            return { ok: false, message: `${prefix}.queryScope must be COLLECTION or COLLECTION_GROUP` };
+        }
+        if (!Array.isArray(entry.fields) || entry.fields.length === 0) {
+            return { ok: false, message: `${prefix}.fields must be a non-empty array` };
+        }
+        for (let j = 0; j < entry.fields.length; j++) {
+            const f = entry.fields[j];
+            const fPrefix = `${prefix}.fields[${j}]`;
+            if (!f || typeof f !== 'object') {
+                return { ok: false, message: `${fPrefix} must be an object` };
+            }
+            if (!f.fieldPath || typeof f.fieldPath !== 'string') {
+                return { ok: false, message: `${fPrefix}.fieldPath must be a non-empty string` };
+            }
+            const variants = [f.order, f.arrayConfig, f.vectorConfig].filter((v) => v !== undefined).length;
+            if (variants !== 1) {
+                return { ok: false, message: `${fPrefix} must specify exactly one of order, arrayConfig, or vectorConfig` };
+            }
+        }
+    }
+    return { ok: true, message: '' };
+}
+/**
+ * Poll a long-running index build operation. `operationName` is
+ * the opaque resource path returned by `create` /
+ * `deployAll(..).operationsStarted[].name`.
+ */
+export async function getStatus(scope, operationName) {
+    if (!operationName || typeof operationName !== 'string') {
+        return { ok: false, code: 'unknown', message: 'operationName is required' };
+    }
+    const token = await scope.resolveToken();
+    let res;
+    try {
+        res = await fetch(`${FIRESTORE_ADMIN_API}/${operationName}`, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+    }
+    catch (e) {
+        return {
+            ok: false,
+            code: 'unknown',
+            message: e instanceof Error ? e.message : String(e),
+        };
+    }
+    if (res.status === 403) {
+        return {
+            ok: false,
+            code: 'permission-denied',
+            message: 'Caller lacks permission to read Firestore index operations',
+        };
+    }
+    if (res.status === 404) {
+        return { ok: true, state: 'NOT_FOUND', operationName };
+    }
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        return {
+            ok: false,
+            code: 'unknown',
+            message: body || `HTTP ${res.status}`,
+        };
+    }
+    const op = (await res.json());
+    if (!op.done)
+        return { ok: true, state: 'CREATING', operationName };
+    if (op.error) {
+        return {
+            ok: false,
+            code: 'build-failed',
+            message: `Index build failed: ${op.error.message} (code ${op.error.code})`,
+        };
+    }
+    const index = op.response;
+    if (!index || !index.state) {
+        return { ok: true, state: 'READY', operationName };
+    }
+    return {
+        ok: true,
+        state: index.state,
+        operationName,
+        index: {
+            name: index.name ?? '',
+            fields: index.fields.map((f) => ({
+                fieldPath: f.fieldPath,
+                order: f.order,
+                arrayConfig: f.arrayConfig,
+            })),
+        },
+    };
+}
+//# sourceMappingURL=indexes.js.map

package/dist/deploy/firestore/indexes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexes.js","sourceRoot":"","sources":["../../../src/deploy/firestore/indexes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAqB,MAAM,aAAa,CAAC;AAE/D,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAgElE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,KAAmB,EACnB,KAAyB,EACzB,UAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,mBAAmB,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,kBAAkB,CAAC,UAAU,CAAC,qBAAqB,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC;IACvM,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,aAAa,CACrB,GAAG,CAAC,MAAM,EACV,MAAM,GAAG,CAAC,IAAI,EAAE,EAChB,2BAA2B,GAAG,CAAC,MAAM,EAAE,CACxC,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,MAAM,IAAI,GAAU;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACnD,IAAI,KAAK,CAAC,OAAO;QAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,IAAI,CAAC,CAAC,WAAW;YAAE,OAAO,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5D,IAAI,CAAC,CAAC,YAAY;YAAE,OAAO,GAAG,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC,YAAY,CAAC,SAAS,GAAG,CAAC;QAChF,OAAO,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AAgCD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAmB,EACnB,MAAqB,EACrB,UAAgC,EAAE;IAElC,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC;IACrD,MAAM,iBAAiB,GAAqB,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YACtD,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,aAAa;gBACb,MAAM,EAAE,SAAS;gBACjB,aAAa,EAAE,EAAE,CAAC,IAAI;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACrB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,IAAI,EAAE,mBAAmB;wBACzB,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,OAAO,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE;qBACxD,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACrB,aAAa,EAAE,CAAC;oBAChB,QAAQ,CAAC,IAAI,CAAC;wBACZ,eAAe,EAAE,KAAK,CAAC,eAAe;wBACtC,aAAa;wBACb,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,eAAe,EAAE,KAAK,CAAC,eAAe;oBACtC,aAAa;oBACb,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE;iBAC9D,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC;gBACZ,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,aAAa;gBACb,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE;aAClC,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,eAAe;gBACrB,OAAO;gBACP,OAAO,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,2BAA2B;YAChF,OAAO,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE;SACxD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC;AAID,SAAS,qBAAqB,CAAC,MAAqB;IAClD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;IACnE,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;YACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,6CAA6C,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY,IAAI,KAAK,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;YACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,oDAAoD,EAAE,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,mCAAmC,EAAE,CAAC;QAC9E,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC;YACzC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,oBAAoB,EAAE,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,uCAAuC,EAAE,CAAC;YACnF,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;YAChG,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,kEAAkE,EAAE,CAAC;YAC9G,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAuBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAmB,EACnB,aAAqB;IAErB,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IAEzC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,mBAAmB,IAAI,aAAa,EAAE,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,4DAA4D;SACtE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IACpE,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,uBAAuB,EAAE,CAAC,KAAK,CAAC,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG;SAC3E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa;QACb,KAAK,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC;SACJ;KACF,CAAC;AACJ,CAAC"}

package/dist/deploy/firestore/recipes.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Paste-in templates for `firestore.rules.ensure(scope, recipe)`.
+ *
+ * Each recipe is a single config object ready to hand to
+ * `rules.ensure`. Adding a new recipe is a single object export;
+ * the consumer pattern stays uniform.
+ */
+/**
+ * The multi-tenant playground session-archive recipe. Allows any
+ * signed-in user (anonymous OK) to write a `pyric_sessions/{id}`
+ * document; read/update/delete are denied by default. The project
+ * owner reads via the Firebase Console.
+ *
+ * Pass to `firestore.rules.ensure(scope, recipes.pyricSessions)`.
+ */
+export declare const pyricSessions: {
+    readonly marker: "match /pyric_sessions/";
+    readonly snippet: "    match /pyric_sessions/{sessionId} {\n      // Anyone signed in (anonymous OK) can create. Read/edit denied\n      // by default — owner reads via the Firebase Console.\n      allow create: if request.auth != null;\n      allow read, update, delete: if false;\n    }";
+    readonly freshTemplate: "rules_version = '2';\nservice cloud.firestore {\n  match /databases/{database}/documents {\n    match /pyric_sessions/{sessionId} {\n      // Anyone signed in (anonymous OK) can create. Read/edit denied\n      // by default — owner reads via the Firebase Console.\n      allow create: if request.auth != null;\n      allow read, update, delete: if false;\n    }\n  }\n}\n";
+};
+//# sourceMappingURL=recipes.d.ts.map