pyric-tools 0.1.0-alpha.7

package/dist/deploy/firestore/recipes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipes.d.ts","sourceRoot":"","sources":["../../../src/deploy/firestore/recipes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAiBH;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;CAIhB,CAAC"}

package/dist/deploy/firestore/recipes.js

@@ -0,0 +1,34 @@
+/**
+ * Paste-in templates for `firestore.rules.ensure(scope, recipe)`.
+ *
+ * Each recipe is a single config object ready to hand to
+ * `rules.ensure`. Adding a new recipe is a single object export;
+ * the consumer pattern stays uniform.
+ */
+const PYRIC_SESSIONS_SNIPPET = `    match /pyric_sessions/{sessionId} {
+      // Anyone signed in (anonymous OK) can create. Read/edit denied
+      // by default — owner reads via the Firebase Console.
+      allow create: if request.auth != null;
+      allow read, update, delete: if false;
+    }`;
+const PYRIC_SESSIONS_FRESH = `rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+${PYRIC_SESSIONS_SNIPPET}
+  }
+}
+`;
+/**
+ * The multi-tenant playground session-archive recipe. Allows any
+ * signed-in user (anonymous OK) to write a `pyric_sessions/{id}`
+ * document; read/update/delete are denied by default. The project
+ * owner reads via the Firebase Console.
+ *
+ * Pass to `firestore.rules.ensure(scope, recipes.pyricSessions)`.
+ */
+export const pyricSessions = {
+    marker: 'match /pyric_sessions/',
+    snippet: PYRIC_SESSIONS_SNIPPET,
+    freshTemplate: PYRIC_SESSIONS_FRESH,
+};
+//# sourceMappingURL=recipes.js.map

package/dist/deploy/firestore/recipes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipes.js","sourceRoot":"","sources":["../../../src/deploy/firestore/recipes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,sBAAsB,GAAG;;;;;MAKzB,CAAC;AAEP,MAAM,oBAAoB,GAAG;;;EAG3B,sBAAsB;;;CAGvB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,wBAAwB;IAChC,OAAO,EAAE,sBAAsB;IAC/B,aAAa,EAAE,oBAAoB;CAC3B,CAAC"}

package/dist/deploy/firestore/rules.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Firestore rules deploy primitives. Pure-fetch over the
+ * `firebaserules.googleapis.com/v1` API. Every public function
+ * takes a `ProjectScope` per F3 and resolves the token per F4.
+ *
+ * Primitives (`fetch`, `deploy`) throw `AdminApiError` on non-2xx.
+ * Orchestrators (`ensure`, `check`) return outcome types so the
+ * caller's UI can branch each path explicitly.
+ */
+import { type ProjectScope } from '../scope.js';
+/**
+ * Fetch the Firestore rules source the project currently has
+ * deployed (the `cloud.firestore` release). Returns `null` when no
+ * release exists yet (greenfield project / Firestore not yet
+ * initialized) — callers should write a fresh ruleset in that case.
+ *
+ * Throws `AdminApiError` on transport / auth failures so callers
+ * can branch (e.g. show a permission-denied toast).
+ */
+export declare function fetchCurrentRules(scope: ProjectScope): Promise<string | null>;
+/**
+ * Deploy a rules source to the `cloud.firestore` release. Two-step
+ * server flow: create a new ruleset, then PATCH the release to
+ * point at its name.
+ */
+export declare function deploy(scope: ProjectScope, source: string): Promise<void>;
+/**
+ * Inject a rule snippet into an existing rules source.
+ *
+ * Strategy: locate `match /databases/{database}/documents {` and
+ * insert the snippet on the next line. Handles the common shape
+ * (Firebase Console default + every example in the docs) without
+ * parsing.
+ *
+ * - Returns the new source when the snippet is added.
+ * - Returns `null` when `marker` is already present (no-op).
+ * - Throws when the `documents { … }` block can't be located.
+ */
+export declare function inject(currentSource: string, snippet: string, marker: string): string | null;
+export type RuleCheckResult = {
+    state: 'configured';
+} | {
+    state: 'not-configured';
+} | {
+    state: 'no-rules-yet';
+} | {
+    state: 'check-failed';
+    message: string;
+};
+/**
+ * Read-only probe: does the project's currently-deployed Firestore
+ * ruleset already contain `marker`? Used by UIs to decide whether
+ * to surface a "Configure rule" button.
+ */
+export declare function check(scope: ProjectScope, marker: string): Promise<RuleCheckResult>;
+export type EnsureRuleOutcome = {
+    ok: true;
+    status: 'already-configured' | 'merged' | 'fresh';
+} | {
+    ok: false;
+    code: 'permission-denied' | 'merge-failed' | 'unknown';
+    message: string;
+};
+/**
+ * Idempotent rule installer. Three branches:
+ *
+ *   - Project has no Firestore rules yet → deploy `freshTemplate`.
+ *   - Rules exist and contain `marker` → no-op (`already-configured`).
+ *   - Rules exist but lack `marker` → inject `snippet` and deploy.
+ */
+export declare function ensure(scope: ProjectScope, config: {
+    marker: string;
+    snippet: string;
+    freshTemplate: string;
+}): Promise<EnsureRuleOutcome>;
+//# sourceMappingURL=rules.d.ts.map

package/dist/deploy/firestore/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/deploy/firestore/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAO/D;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgCnF;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CACpB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAmBf;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,YAAY,CAAA;CAAE,GACvB;IAAE,KAAK,EAAE,gBAAgB,CAAA;CAAE,GAC3B;IAAE,KAAK,EAAE,cAAc,CAAA;CAAE,GACzB;IAAE,KAAK,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C;;;;GAIG;AACH,wBAAsB,KAAK,CACzB,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,GAAG,QAAQ,GAAG,OAAO,CAAA;CAAE,GAC/D;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,mBAAmB,GAAG,cAAc,GAAG,SAAS,CAAC;IACvD,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;;;;GAMG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACjE,OAAO,CAAC,iBAAiB,CAAC,CA2B5B"}

package/dist/deploy/firestore/rules.js

@@ -0,0 +1,180 @@
+/**
+ * Firestore rules deploy primitives. Pure-fetch over the
+ * `firebaserules.googleapis.com/v1` API. Every public function
+ * takes a `ProjectScope` per F3 and resolves the token per F4.
+ *
+ * Primitives (`fetch`, `deploy`) throw `AdminApiError` on non-2xx.
+ * Orchestrators (`ensure`, `check`) return outcome types so the
+ * caller's UI can branch each path explicitly.
+ */
+import { AdminApiError } from '../scope.js';
+const RULES_API = 'https://firebaserules.googleapis.com/v1';
+/**
+ * Fetch the Firestore rules source the project currently has
+ * deployed (the `cloud.firestore` release). Returns `null` when no
+ * release exists yet (greenfield project / Firestore not yet
+ * initialized) — callers should write a fresh ruleset in that case.
+ *
+ * Throws `AdminApiError` on transport / auth failures so callers
+ * can branch (e.g. show a permission-denied toast).
+ */
+export async function fetchCurrentRules(scope) {
+    const token = await scope.resolveToken();
+    const releaseRes = await fetch(`${RULES_API}/projects/${encodeURIComponent(scope.projectId)}/releases/cloud.firestore`, { headers: { Authorization: `Bearer ${token}` } });
+    if (releaseRes.status === 404)
+        return null;
+    if (!releaseRes.ok) {
+        throw new AdminApiError(releaseRes.status, await releaseRes.text(), `Failed to read release: ${releaseRes.status}`);
+    }
+    const release = (await releaseRes.json());
+    const rulesetRes = await fetch(`${RULES_API}/${release.rulesetName}`, {
+        headers: { Authorization: `Bearer ${token}` },
+    });
+    if (!rulesetRes.ok) {
+        throw new AdminApiError(rulesetRes.status, await rulesetRes.text(), `Failed to read ruleset: ${rulesetRes.status}`);
+    }
+    const ruleset = (await rulesetRes.json());
+    const file = ruleset.source.files.find((f) => f.name.endsWith('.rules')) ??
+        ruleset.source.files[0];
+    if (!file)
+        throw new AdminApiError(0, '', 'Ruleset has no source files');
+    return file.content;
+}
+/**
+ * Deploy a rules source to the `cloud.firestore` release. Two-step
+ * server flow: create a new ruleset, then PATCH the release to
+ * point at its name.
+ */
+export async function deploy(scope, source) {
+    const token = await scope.resolveToken();
+    const headers = {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+    };
+    const createRes = await fetch(`${RULES_API}/projects/${encodeURIComponent(scope.projectId)}/rulesets`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({
+            source: { files: [{ name: 'firestore.rules', content: source }] },
+        }),
+    });
+    if (!createRes.ok) {
+        throw new AdminApiError(createRes.status, await createRes.text(), `Failed to create ruleset: ${createRes.status}`);
+    }
+    const created = (await createRes.json());
+    const releaseName = `projects/${scope.projectId}/releases/cloud.firestore`;
+    // Try PATCH first (common case: release already exists from a prior
+    // deploy). On 404 the release hasn't been created yet — happens on
+    // any project that has never deployed Firestore rules via the API
+    // (a fresh project, or one whose only prior rules came from the
+    // Firebase Console's separate path). Fall back to POST against the
+    // releases collection to create it.
+    const patchRes = await fetch(`${RULES_API}/${releaseName}`, {
+        method: 'PATCH',
+        headers,
+        body: JSON.stringify({
+            release: { name: releaseName, rulesetName: created.name },
+        }),
+    });
+    if (patchRes.ok)
+        return;
+    if (patchRes.status !== 404) {
+        throw new AdminApiError(patchRes.status, await patchRes.text(), `Failed to update release: ${patchRes.status}`);
+    }
+    const createReleaseRes = await fetch(`${RULES_API}/projects/${encodeURIComponent(scope.projectId)}/releases`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({
+            name: releaseName,
+            rulesetName: created.name,
+        }),
+    });
+    if (!createReleaseRes.ok) {
+        throw new AdminApiError(createReleaseRes.status, await createReleaseRes.text(), `Failed to create release: ${createReleaseRes.status}`);
+    }
+}
+/**
+ * Inject a rule snippet into an existing rules source.
+ *
+ * Strategy: locate `match /databases/{database}/documents {` and
+ * insert the snippet on the next line. Handles the common shape
+ * (Firebase Console default + every example in the docs) without
+ * parsing.
+ *
+ * - Returns the new source when the snippet is added.
+ * - Returns `null` when `marker` is already present (no-op).
+ * - Throws when the `documents { … }` block can't be located.
+ */
+export function inject(currentSource, snippet, marker) {
+    if (currentSource.includes(marker))
+        return null;
+    const matchLineRe = /(match\s+\/databases\/\{database\}\/documents\s*\{)/;
+    const m = matchLineRe.exec(currentSource);
+    if (!m) {
+        throw new Error('Could not locate the `match /databases/{database}/documents` block in the current rules. ' +
+            'Paste the rule snippet manually instead.');
+    }
+    const insertAt = m.index + m[0].length;
+    return (currentSource.slice(0, insertAt) +
+        '\n' +
+        snippet +
+        '\n' +
+        currentSource.slice(insertAt));
+}
+/**
+ * Read-only probe: does the project's currently-deployed Firestore
+ * ruleset already contain `marker`? Used by UIs to decide whether
+ * to surface a "Configure rule" button.
+ */
+export async function check(scope, marker) {
+    try {
+        const current = await fetchCurrentRules(scope);
+        if (current === null)
+            return { state: 'no-rules-yet' };
+        return current.includes(marker)
+            ? { state: 'configured' }
+            : { state: 'not-configured' };
+    }
+    catch (e) {
+        return {
+            state: 'check-failed',
+            message: e instanceof Error ? e.message : String(e),
+        };
+    }
+}
+/**
+ * Idempotent rule installer. Three branches:
+ *
+ *   - Project has no Firestore rules yet → deploy `freshTemplate`.
+ *   - Rules exist and contain `marker` → no-op (`already-configured`).
+ *   - Rules exist but lack `marker` → inject `snippet` and deploy.
+ */
+export async function ensure(scope, config) {
+    try {
+        const current = await fetchCurrentRules(scope);
+        if (current === null) {
+            await deploy(scope, config.freshTemplate);
+            return { ok: true, status: 'fresh' };
+        }
+        const merged = inject(current, config.snippet, config.marker);
+        if (merged === null)
+            return { ok: true, status: 'already-configured' };
+        await deploy(scope, merged);
+        return { ok: true, status: 'merged' };
+    }
+    catch (e) {
+        if (e instanceof AdminApiError &&
+            (e.status === 401 || e.status === 403)) {
+            return { ok: false, code: 'permission-denied', message: e.message };
+        }
+        if (e instanceof Error && e.message.includes('Could not locate')) {
+            return { ok: false, code: 'merge-failed', message: e.message };
+        }
+        return {
+            ok: false,
+            code: 'unknown',
+            message: e instanceof Error ? e.message : String(e),
+        };
+    }
+}
+//# sourceMappingURL=rules.js.map

package/dist/deploy/firestore/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../src/deploy/firestore/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAqB,MAAM,aAAa,CAAC;AAE/D,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAK5D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAmB;IACzD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,KAAK,CAC5B,GAAG,SAAS,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,2BAA2B,EACvF,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAClD,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,aAAa,CACrB,UAAU,CAAC,MAAM,EACjB,MAAM,UAAU,CAAC,IAAI,EAAE,EACvB,2BAA2B,UAAU,CAAC,MAAM,EAAE,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAgB,CAAC;IAEzD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE;QACpE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,aAAa,CACrB,UAAU,CAAC,MAAM,EACjB,MAAM,UAAU,CAAC,IAAI,EAAE,EACvB,2BAA2B,UAAU,CAAC,MAAM,EAAE,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAgB,CAAC;IACzD,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,6BAA6B,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAmB,EAAE,MAAc;IAC9D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IACzC,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,KAAK,EAAE;QAChC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,KAAK,CAC3B,GAAG,SAAS,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EACvE;QACE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;SAClE,CAAC;KACH,CACF,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CACrB,SAAS,CAAC,MAAM,EAChB,MAAM,SAAS,CAAC,IAAI,EAAE,EACtB,6BAA6B,SAAS,CAAC,MAAM,EAAE,CAChD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAqB,CAAC;IAE7D,MAAM,WAAW,GAAG,YAAY,KAAK,CAAC,SAAS,2BAA2B,CAAC;IAC3E,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,gEAAgE;IAChE,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,IAAI,WAAW,EAAE,EAAE;QAC1D,MAAM,EAAE,OAAO;QACf,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE;SAC1D,CAAC;KACH,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO;IACxB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CACrB,QAAQ,CAAC,MAAM,EACf,MAAM,QAAQ,CAAC,IAAI,EAAE,EACrB,6BAA6B,QAAQ,CAAC,MAAM,EAAE,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAClC,GAAG,SAAS,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EACvE;QACE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,OAAO,CAAC,IAAI;SAC1B,CAAC;KACH,CACF,CAAC;IACF,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CACrB,gBAAgB,CAAC,MAAM,EACvB,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAC7B,6BAA6B,gBAAgB,CAAC,MAAM,EAAE,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,MAAM,CACpB,aAAqB,EACrB,OAAe,EACf,MAAc;IAEd,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,WAAW,GAAG,qDAAqD,CAAC;IAC1E,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2FAA2F;YACzF,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,CACL,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;QAChC,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC9B,CAAC;AACJ,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,KAAmB,EACnB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QACvD,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC7B,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE;YACzB,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,KAAmB,EACnB,MAAkE;IAElE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACvE,MAAM,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IACE,CAAC,YAAY,aAAa;YAC1B,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,EACtC,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACjE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACpD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/deploy/from-admin-app.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `getDeploy(app)` — build a `ProjectScope` from an already-initialized
+ * firebase-admin App. Mirrors the modular Web SDK's `getFirestore(app)` /
+ * `getAuth(app)` shape so Firebase devs reach for it without learning
+ * a new entry-point.
+ *
+ * The App must have been initialized with a `cert(...)` credential
+ * (i.e. via a service-account key). For raw base64 SA env vars without
+ * a firebase-admin App in hand, use {@link fromServiceAccount} from
+ * the same package — it'll build the ProjectScope without touching
+ * firebase-admin.
+ *
+ * Resolves the OAuth access token via the credential's internal
+ * `getAccessToken()` (the stable accessor used by firebase tooling).
+ * Wraps in `memoizeTtl` so consumers get caching for free.
+ */
+import type { App as AdminApp } from 'firebase-admin/app';
+import type { ProjectScope } from './scope.js';
+export declare function getDeploy(app: AdminApp): ProjectScope;
+//# sourceMappingURL=from-admin-app.d.ts.map

package/dist/deploy/from-admin-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-admin-app.d.ts","sourceRoot":"","sources":["../../src/deploy/from-admin-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,GAAG,IAAI,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAO/C,wBAAgB,SAAS,CAAC,GAAG,EAAE,QAAQ,GAAG,YAAY,CAmBrD"}

package/dist/deploy/from-admin-app.js

@@ -0,0 +1,18 @@
+import { memoizeTtl } from './memoize-ttl.js';
+export function getDeploy(app) {
+    const projectId = app.options.projectId;
+    if (!projectId) {
+        throw new Error('getDeploy: firebase-admin App has no projectId. Initialize with `projectId` in the options.');
+    }
+    const credential = app.options.credential;
+    if (!credential || typeof credential.getAccessToken !== 'function') {
+        throw new Error('getDeploy: firebase-admin App was not initialized with a cert credential ' +
+            '(no `getAccessToken` on app.options.credential). Use admin.credential.cert(saCert) at init time.');
+    }
+    const resolveToken = memoizeTtl(async () => {
+        const tokenObj = await credential.getAccessToken();
+        return { token: tokenObj.access_token, expiresIn: tokenObj.expires_in };
+    });
+    return { projectId, resolveToken };
+}
+//# sourceMappingURL=from-admin-app.js.map

package/dist/deploy/from-admin-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-admin-app.js","sourceRoot":"","sources":["../../src/deploy/from-admin-app.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAM9C,MAAM,UAAU,SAAS,CAAC,GAAa;IACrC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,UAAwD,CAAC;IACxF,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,kGAAkG,CACrG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;QACzC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AACrC,CAAC"}

package/dist/deploy/from-service-account.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `fromServiceAccount` — build a `ProjectScope` from a Google service
+ * account JSON file. Exchanges the SA key for a short-lived OAuth
+ * access token via the standard JWT-bearer flow, and wires
+ * `memoizeTtl` internally so consumers get caching for free.
+ *
+ * No `firebase-admin` dependency — uses only Node's built-in
+ * `crypto` for RS256 signing and `fetch` for the token exchange.
+ *
+ * **Node-only inside a browser-safe package**: the function itself
+ * requires `node:fs/promises` + `node:crypto`. Those modules are
+ * imported via dynamic `import()` inside the function body so the
+ * top-level pyric-tools/deploy entry stays browser-bundle safe. A
+ * browser host that imports `pyric-tools/deploy` but never calls
+ * `fromServiceAccount` will not have `node:*` modules in its
+ * bundle graph.
+ */
+import type { ProjectScope } from './scope.js';
+/**
+ * Read the service account from a JSON file and return a
+ * `ProjectScope` whose `resolveToken` is memoized internally.
+ *
+ * The JSON file path can be:
+ * - An absolute / relative filesystem path (Node only).
+ * - A base64-encoded JSON string (when prefixed with `base64:`),
+ *   for environments that ship the SA in an env var.
+ */
+export declare function fromServiceAccount(saJsonOrPath: string): Promise<ProjectScope>;
+//# sourceMappingURL=from-service-account.d.ts.map

package/dist/deploy/from-service-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-service-account.d.ts","sourceRoot":"","sources":["../../src/deploy/from-service-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAyB/C;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,YAAY,CAAC,CAcvB"}

package/dist/deploy/from-service-account.js

@@ -0,0 +1,115 @@
+/**
+ * `fromServiceAccount` — build a `ProjectScope` from a Google service
+ * account JSON file. Exchanges the SA key for a short-lived OAuth
+ * access token via the standard JWT-bearer flow, and wires
+ * `memoizeTtl` internally so consumers get caching for free.
+ *
+ * No `firebase-admin` dependency — uses only Node's built-in
+ * `crypto` for RS256 signing and `fetch` for the token exchange.
+ *
+ * **Node-only inside a browser-safe package**: the function itself
+ * requires `node:fs/promises` + `node:crypto`. Those modules are
+ * imported via dynamic `import()` inside the function body so the
+ * top-level pyric-tools/deploy entry stays browser-bundle safe. A
+ * browser host that imports `pyric-tools/deploy` but never calls
+ * `fromServiceAccount` will not have `node:*` modules in its
+ * bundle graph.
+ */
+import { memoizeTtl } from './memoize-ttl.js';
+const GOOGLE_TOKEN_URI = 'https://oauth2.googleapis.com/token';
+const SCOPE = [
+    // Broad scopes covering everything `pyric-tools/deploy` touches:
+    // Firebase Hosting, Cloud Functions, Firestore Admin, Storage,
+    // Identity Toolkit, Cloud Resource Manager.
+    'https://www.googleapis.com/auth/firebase',
+    'https://www.googleapis.com/auth/cloud-platform',
+].join(' ');
+/**
+ * Read the service account from a JSON file and return a
+ * `ProjectScope` whose `resolveToken` is memoized internally.
+ *
+ * The JSON file path can be:
+ * - An absolute / relative filesystem path (Node only).
+ * - A base64-encoded JSON string (when prefixed with `base64:`),
+ *   for environments that ship the SA in an env var.
+ */
+export async function fromServiceAccount(saJsonOrPath) {
+    const sa = await loadServiceAccount(saJsonOrPath);
+    const resolveToken = memoizeTtl(async () => {
+        const { access_token, expires_in } = await exchangeJwtForAccessToken(sa);
+        return { token: access_token, expiresIn: expires_in };
+    });
+    // Freeze the returned scope so `projectId` can't be mutated at
+    // runtime. TS `readonly` is compile-time-only; Object.freeze
+    // enforces it at runtime — defense in depth for the
+    // security-relevant identity field.
+    return Object.freeze({
+        projectId: sa.project_id,
+        resolveToken,
+    });
+}
+async function loadServiceAccount(saJsonOrPath) {
+    let raw;
+    if (saJsonOrPath.startsWith('base64:')) {
+        raw = Buffer.from(saJsonOrPath.slice('base64:'.length), 'base64').toString('utf-8');
+    }
+    else if (saJsonOrPath.trim().startsWith('{')) {
+        raw = saJsonOrPath;
+    }
+    else {
+        // Dynamic import keeps `node:fs/promises` out of browser bundles
+        // when this function isn't called.
+        const { readFile } = await import('node:fs/promises');
+        raw = await readFile(saJsonOrPath, 'utf-8');
+    }
+    const parsed = JSON.parse(raw);
+    if (!parsed.client_email || !parsed.private_key || !parsed.project_id) {
+        throw new Error('fromServiceAccount: input is missing required fields (client_email, private_key, project_id)');
+    }
+    return parsed;
+}
+async function exchangeJwtForAccessToken(sa) {
+    const jwt = await buildSignedJwt(sa);
+    const res = await fetch(sa.token_uri ?? GOOGLE_TOKEN_URI, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+            assertion: jwt,
+        }).toString(),
+    });
+    if (!res.ok) {
+        throw new Error(`fromServiceAccount: token exchange failed (${res.status}): ${await res.text()}`);
+    }
+    return (await res.json());
+}
+async function buildSignedJwt(sa) {
+    // Dynamic import keeps `node:crypto` out of browser bundles when
+    // `fromServiceAccount` is never called.
+    const { createSign } = await import('node:crypto');
+    const now = Math.floor(Date.now() / 1000);
+    const header = { alg: 'RS256', typ: 'JWT' };
+    const claims = {
+        iss: sa.client_email,
+        scope: SCOPE,
+        aud: sa.token_uri ?? GOOGLE_TOKEN_URI,
+        exp: now + 3600,
+        iat: now,
+    };
+    const headerB64 = base64UrlEncode(JSON.stringify(header));
+    const claimsB64 = base64UrlEncode(JSON.stringify(claims));
+    const signingInput = `${headerB64}.${claimsB64}`;
+    const signer = createSign('RSA-SHA256');
+    signer.update(signingInput);
+    signer.end();
+    const signature = signer.sign(sa.private_key);
+    const signatureB64 = base64UrlEncodeBuffer(signature);
+    return `${signingInput}.${signatureB64}`;
+}
+function base64UrlEncode(s) {
+    return base64UrlEncodeBuffer(Buffer.from(s, 'utf-8'));
+}
+function base64UrlEncodeBuffer(b) {
+    return b.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+//# sourceMappingURL=from-service-account.js.map

package/dist/deploy/from-service-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-service-account.js","sourceRoot":"","sources":["../../src/deploy/from-service-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,KAAK,GAAG;IACZ,iEAAiE;IACjE,+DAA+D;IAC/D,4CAA4C;IAC5C,0CAA0C;IAC1C,gDAAgD;CACjD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAeZ;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB;IAEpB,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;QACzC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;IACH,+DAA+D;IAC/D,6DAA6D;IAC7D,oDAAoD;IACpD,oCAAoC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,EAAE,CAAC,UAAU;QACxB,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,YAAoB;IACpD,IAAI,GAAW,CAAC;IAChB,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtF,CAAC;SAAM,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,GAAG,GAAG,YAAY,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,iEAAiE;QACjE,mCAAmC;QACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACtD,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,MAAwB,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,EAAkB;IACzD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,SAAS,IAAI,gBAAgB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,6CAA6C;YACzD,SAAS,EAAE,GAAG;SACf,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,CAAC,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAkB;IAC9C,iEAAiE;IACjE,wCAAwC;IACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,EAAE,CAAC,YAAY;QACpB,KAAK,EAAE,KAAK;QACZ,GAAG,EAAE,EAAE,CAAC,SAAS,IAAI,gBAAgB;QACrC,GAAG,EAAE,GAAG,GAAG,IAAI;QACf,GAAG,EAAE,GAAG;KACT,CAAC;IACF,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,EAAE,CAAC;IACb,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,GAAG,YAAY,IAAI,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAS;IACtC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACzF,CAAC"}

package/dist/deploy/functions/bundle.d.ts

@@ -0,0 +1,37 @@
+export interface BundleResult {
+    zip: Uint8Array;
+    /** Files included in the zip (relative POSIX paths). */
+    files: string[];
+    /**
+     * Inferred runtime from `package.json`'s `engines.node`. Caller
+     * uses this when no per-function `runtime` override is set.
+     * Format: `nodejs<major>` (e.g. `nodejs22`). Falls back to
+     * `nodejs22` when `engines.node` is missing or unparseable.
+     */
+    runtime: string;
+}
+export interface BundleOptions {
+    /**
+     * When true (default), the bundled `package.json` is rewritten to
+     * remove fields the Cloud Build buildpack should not touch:
+     *   - `devDependencies` — buildpack's `npm ci` errors on any
+     *      dev dep missing from the lockfile, and devDeps that are
+     *      unpublished workspace packages 404 entirely.
+     *   - `scripts.build` / `build:watch` / `prebuild` / `postbuild`
+     *      — the buildpack runs these by default; we ship pre-compiled
+     *      JS in `lib/` instead.
+     *
+     * The lockfile (`package-lock.json` / `npm-shrinkwrap.json`) is also
+     * dropped when slimming — once devDeps are stripped, any pinned
+     * lockfile is stale and `npm ci` fails the build. The buildpack
+     * falls back to `npm install --omit=dev` against the slim
+     * package.json, which resolves runtime deps correctly.
+     *
+     * Set `slim: false` to ship the package.json verbatim — useful when
+     * the function genuinely needs `npm run build` to run on the build
+     * server (e.g. native Node addons that compile per architecture).
+     */
+    slim?: boolean;
+}
+export declare function bundleFunctionSource(localDir: string, options?: BundleOptions): BundleResult;
+//# sourceMappingURL=bundle.d.ts.map

package/dist/deploy/functions/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../../src/deploy/functions/bundle.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,UAAU,CAAC;IAChB,wDAAwD;IACxD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAkBD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,aAAkB,GAC1B,YAAY,CAmDd"}