pyric-tools 0.1.0-alpha.7

package/dist/serve/docs-ui/llms.txt

@@ -0,0 +1,221 @@
+# Pyric
+
+> Pyric is Firebase for agents: a Firebase-shaped SDK and toolchain
+> (in-browser sandbox, rules tooling, replay verification, deploy)
+> that lets developers and AI agents work against Firebase semantics
+> without touching a live project.
+
+Every page below is also served as raw markdown at the linked `.md` URL.
+
+## pyric-tools
+
+- [pyric-tools](/__pyric/ui/docs/pyric-tools.md): The pyric CLI + programmatic helpers (deploy, bridge, discover, auth-config), organised by the four Diátaxis quadrants: learn, do, look up, understand.
+- [Getting started — scaffold, run pyric dev, and let an agent drive](/__pyric/ui/docs/pyric-tools-tutorials-getting-started.md): By the end of this tutorial you will have:
+- [Server adoption — run your firebase-admin app on the pyric sandbox](/__pyric/ui/docs/pyric-tools-tutorials-server-adoption.md): You have an existing Node server that uses firebase-admin — Realtime Database, Auth, Storage. By the end of this tutorial it runs against the pyric in-browser sandbox with zero code changes: no pyric imports, no config edits, no emulator suite, no Firebase project.
+- [Wire Claude Code to your pyric sandbox (manual MCP wiring)](/__pyric/ui/docs/pyric-tools-tutorials-wire-claude-code.md): By the end of this tutorial you will have:
+- [Build a standalone pyric binary](/__pyric/ui/docs/pyric-tools-how-to-build-a-standalone-binary.md): Ship pyric as a single self-contained executable — no Node, no npm, no node_modules. Built with bun build --compile.
+- [How to configure auth providers and authorised domains](/__pyric/ui/docs/pyric-tools-how-to-configure-auth-providers-and-domains.md): When you move from building in the sandbox to running against a real Firebase project, you have to prepare that project's authentication: turn on the sign-in providers your app uses, and authorise the domains your app will redirect from. pyric auth:configure-provider and pyric auth:manage-domains do both from the CLI (or from an agent), so you don't have to click through the Firebase Console.
+- [How to infer a schema from an existing Firestore](/__pyric/ui/docs/pyric-tools-how-to-discover-a-schema-from-firestore.md): You have a real Firestore database and you want its inferred shape — the collections, their fields, field types, presence ratios, enum-like value sets, and example values. This guide walks you through running pyric firestore:discover against that database so you can use the output to write security rules, seed the local sandbox, or hand a schema to an agent.
+- [How to promote sandbox state to a committable fixture](/__pyric/ui/docs/pyric-tools-how-to-promote-sandbox-state-to-a-fixture.md): You have been working in the sandbox interactively — signing in test users, creating documents — and you want to commit that state so teammates, tests, and CI all start from the same place. pyric snapshot promotes the lived sandbox state into a single fixture file that pyric verify and pyric dev --seed can consume.
+- [Persistence and multi-tab with pyric dev](/__pyric/ui/docs/pyric-tools-how-to-serve-persistence-and-multi-tab.md): When you run pyric dev, your app's firebase/* imports are served from an in-browser pyric sandbox instead of real Firebase. This guide covers how that sandbox keeps (or doesn't keep) data, the flags that control it, and what to do if the SharedWorker that backs it acts up.
+- [Use the Vite plugin (pyric-tools/vite)](/__pyric/ui/docs/pyric-tools-how-to-use-the-vite-plugin.md): The pyricSandbox() Vite plugin gives a source-driven app the same firebase/ → pyric-sandbox swap that pyric dev gives a static app — without leaving your normal vite dev loop (HMR, source maps, your own router/UI stack). Your app's firebase/ imports stay exactly as written; the plugin swaps them at Vite's module-resolution layer. A plain vite build keeps the real firebase package; only vite dev and an explicit sandbox build (vite build --mode development) run the swap — see Two build flavors.
+- [How to verify your rules against a captured session](/__pyric/ui/docs/pyric-tools-how-to-verify-against-a-captured-session.md): pyric verify replays a captured sandbox session against candidate rules and reports service-labelled divergences. It works for Firestore and Realtime Database captures. It answers the question that makes "build in the sandbox, swap to prod" safe: will the rules I'm about to ship break what I built?
+- [pyric CLI reference](/__pyric/ui/docs/pyric-tools-reference-cli.md): The complete command + flag surface of the pyric binary. This is the authoritative source for flags, defaults, and exit codes — guides and tutorials link here rather than restating them.
+- [Verify API](/__pyric/ui/docs/pyric-tools-reference-verify.md): pyric-tools/verify verifies captured sandbox sessions from code. It uses the same fixture format and replay behavior as pyric verify.
+- [pyric-tools/bridge](/__pyric/ui/docs/pyric-tools-bridge.md): Bridge between an external MCP client (Claude Code, Cursor) and a browser-resident pyric sandbox.
+
+## pyric-tools / deploy
+
+- [pyric-tools/deploy](/__pyric/ui/docs/pyric-tools-deploy.md): Firebase control-plane primitives — Hosting, Cloud Functions Gen 2, Firestore rules, Firestore indexes, Firestore database provisioning, and Realtime Database rules — without the firebase CLI. Pure-fetch over OAuth access tokens; works in Node and the browser alike.
+- [Deploy a Cloud Function](/__pyric/ui/docs/pyric-tools-deploy-tutorials-01-deploy-a-cloud-function.md): In this tutorial you will use pyric-tools/deploy to deploy a small Cloud Function Gen 2 to a Firebase project. By the end you will have:
+- [How to build a ProjectScope from Firebase Auth (browser)](/__pyric/ui/docs/pyric-tools-deploy-how-to-build-projectscope-from-firebase-auth.md): This guide shows you how to build a ProjectScope in a browser host using the currently-signed-in Firebase Auth user.
+- [How to build a ProjectScope from a service account](/__pyric/ui/docs/pyric-tools-deploy-how-to-build-projectscope-from-service-account.md): This guide shows you how to wire a Google service-account JSON into a ProjectScope for use with every primitive in pyric-tools/deploy.
+- [How to bundle and deploy a Cloud Function](/__pyric/ui/docs/pyric-tools-deploy-how-to-bundle-and-deploy-a-function.md): This guide shows you how to deploy one or more Cloud Functions Gen 2 from a source directory.
+- [How to deploy Firestore indexes](/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-firestore-indexes.md): This guide shows you how to deploy a firestore.indexes.json-shaped config and how to wait for the resulting builds.
+- [How to deploy Firestore rules](/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-firestore-rules.md): This guide shows you how to deploy a Firestore rules source through pyric-tools/deploy. Choose the approach that matches your situation — a one-shot replace, an idempotent ensure, or a manual flow.
+- [How to deploy Hosting rewrites that route to Cloud Functions](/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-hosting-rewrites.md): This guide shows you how to deploy static files to Firebase Hosting with rewrites that send specific URL paths to a deployed Cloud Function.
+- [How to deploy Realtime Database rules](/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-realtime-database-rules.md): This guide shows you how to deploy a Realtime Database rules JSON file through the Pyric CLI or through pyric-tools/deploy.
+- [How to deploy to a Hosting preview channel](/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-to-a-preview-channel.md): This guide shows you how to deploy a site to a temporary preview URL instead of the live channel — the same model as firebase hosting:channel:deploy.
+- [How to handle AdminApiError and Outcome failures](/__pyric/ui/docs/pyric-tools-deploy-how-to-handle-errors-and-outcomes.md): This guide shows you how to react to failures from pyric-tools/deploy. Two error shapes turn up depending on whether you called a primitive (throws) or an orchestrator (returns).
+- [How to provision a Firestore database](/__pyric/ui/docs/pyric-tools-deploy-how-to-provision-a-firestore-database.md): This guide shows you how to create (or confirm the existence of) a Firestore database in a Firebase project.
+- [How to register deploy tools with an agent](/__pyric/ui/docs/pyric-tools-deploy-how-to-register-tools-with-an-agent.md): This guide shows you how to expose pyric-tools/deploy's primitives as @inbrowser/agent tool handlers, so an LLM-driven agent can deploy rules, indexes, and functions through structured tool calls.
+- [Public API](/__pyric/ui/docs/pyric-tools-deploy-reference-api.md): This page describes every symbol re-exported from pyric-tools/deploy. Symbols are grouped by submodule and listed in the order they appear in index.ts.
+- [pyric deploy agent I/O — --schema and --json](/__pyric/ui/docs/pyric-tools-deploy-reference-cli-agent-io.md): The deploy CLI wraps ToolHandlers, and the ToolHandler is the schema — there is no hand-authored copy to drift. Three knobs (wired for hosting today; rules / indexes / functions are follow-ups and reject the flags with a clear error):
+- [Error codes by operation](/__pyric/ui/docs/pyric-tools-deploy-reference-error-codes.md): Every operation in pyric-tools/deploy surfaces failures one of three ways:
+- [firestore namespace](/__pyric/ui/docs/pyric-tools-deploy-reference-firestore-namespace.md): Firestore rules, indexes, and database provisioning primitives.
+- [functions namespace](/__pyric/ui/docs/pyric-tools-deploy-reference-functions-namespace.md): Cloud Functions Gen 2 deploy primitives. Every method takes a ProjectScope first.
+- [firebase.json hosting config — supported keys and REST translation](/__pyric/ui/docs/pyric-tools-deploy-reference-hosting-config.md): The hosting block of firebase.json is the public config shape (HostingJsonConfig). It is translated to the Hosting REST ServingConfig exactly the way firebase-tools' convertConfig does (clones/firebase-tools/src/deploy/hosting/convertConfig.ts — every translation below is pinned by a test in test/deploy/hosting/config.test.ts citing the relevant lines).
+- [hosting namespace](/__pyric/ui/docs/pyric-tools-deploy-reference-hosting-namespace.md): Firebase Hosting deploy primitives. Every method takes a ProjectScope as its first argument and resolves the token internally per-dispatch.
+- [rtdb namespace](/__pyric/ui/docs/pyric-tools-deploy-reference-rtdb-namespace.md): Realtime Database rules deploy primitives.
+- [ProjectScope, Outcome, AdminApiError](/__pyric/ui/docs/pyric-tools-deploy-reference-scope-and-outcome.md): The three foundation types every primitive and orchestrator in pyric-tools/deploy uses.
+- [Tool factories](/__pyric/ui/docs/pyric-tools-deploy-reference-tool-factories.md): Four factories wrap the namespaces as @inbrowser/agent ToolHandler[]. Each takes a ProjectScopedDeps shape and returns the handlers for its domain.
+- [Primitives throw, orchestrators return](/__pyric/ui/docs/pyric-tools-deploy-explanation-primitives-vs-orchestrators.md): Every public function in pyric-tools/deploy is one of two things, and the two report failures differently. Knowing which is which makes the error-handling code make sense.
+- [Token caching and memoizeTtl](/__pyric/ui/docs/pyric-tools-deploy-explanation-token-caching.md): OAuth access tokens have a TTL, typically 3600 seconds for Google Cloud. Refresh too often and you waste round trips and rate limits; refresh too late and a token expires mid-deploy and the operation fails. memoizeTtl is the package's answer to "when do I get a fresh token?"
+- [Why no firebase CLI dependency](/__pyric/ui/docs/pyric-tools-deploy-explanation-why-no-firebase-cli.md): pyric-tools/deploy deliberately doesn't shell out to the firebase CLI. This page explains the tradeoffs.
+- [Why this package exists](/__pyric/ui/docs/pyric-tools-deploy-explanation-why-this-package-exists.md): Firebase has a deploy CLI (firebase) and a TypeScript admin SDK (firebase-admin). Both are good at what they do. Neither does what pyric-tools/deploy does, which is:
+
+## pyric / firestore
+
+- [pyric/firestore](/__pyric/ui/docs/pyric-firestore.md): Modular Web SDK Firestore adapter for the Pyric sandbox. Mirrors firebase/firestore's tree-shakable shape — getDoc, setDoc, query, where, onSnapshot, runTransaction — with two backends picked at init time:
+- [Write a sandbox-backed demo](/__pyric/ui/docs/pyric-firestore-tutorials-01-write-a-sandbox-demo.md): In this tutorial you will build a tiny notes-app using pyric/firestore against the sandbox backend. By the end you'll have set rules, seeded data, written, read, watched a query, and seen a denial — all in-process.
+- [Swap the demo to the prod backend](/__pyric/ui/docs/pyric-firestore-tutorials-02-swap-to-prod-backend.md): In this tutorial you will take the demo from Write a sandbox-backed demo and swap it to talk to a real Firebase project. The only code change is one line.
+- [How to build queries with where, orderBy, limit](/__pyric/ui/docs/pyric-firestore-how-to-build-queries.md): This guide shows you how to compose query constraints.
+- [How to migrate from firebase/firestore](/__pyric/ui/docs/pyric-firestore-how-to-migrate-from-firebase-firestore.md): This guide shows you how to swap firebase/firestore for pyric/firestore in an existing codebase.
+- [How to pick a backend at init time](/__pyric/ui/docs/pyric-firestore-how-to-pick-a-backend.md): This guide shows you how to choose between the sandbox and prod backends — and how to switch between them without changing the rest of your code.
+- [How to run a transaction](/__pyric/ui/docs/pyric-firestore-how-to-run-a-transaction.md): This guide shows you how to use runTransaction against either backend.
+- [How to use onSnapshot](/__pyric/ui/docs/pyric-firestore-how-to-use-onsnapshot.md): This guide shows you how to register snapshot listeners with the modular Web SDK shape.
+- [How to use sandbox-only operations](/__pyric/ui/docs/pyric-firestore-how-to-use-sandbox-ops.md): This guide shows you how to deploy rules, seed data, and dump state — operations that only work against the sandbox backend.
+- [Public API](/__pyric/ui/docs/pyric-firestore-reference-api.md): pyric/firestore re-exports a large surface that mirrors firebase/firestore. The lists below group by area; for individual function signatures, the package matches the upstream SDK closely enough that the official Web SDK reference applies.
+- [Feature matrix — pyric/firestore vs firebase/firestore](/__pyric/ui/docs/pyric-firestore-reference-feature-matrix.md): Side-by-side coverage of the modular Web SDK surface. Use this to decide what's safe to write in code that has to run against both the pyric sandbox and prod Firebase.
+- [getFirestore overloads](/__pyric/ui/docs/pyric-firestore-reference-getfirestore.md): The single factory dispatches by the shape of its argument.
+- [Query constraints](/__pyric/ui/docs/pyric-firestore-reference-query-constraints.md): pyric/firestore mirrors firebase/firestore's constraint factories. Compose them via query(...).
+- [Sandbox-only operations](/__pyric/ui/docs/pyric-firestore-reference-sandbox-ops.md): Three operations live under the sandbox namespace export and only work against sandbox-backed Firestore handles. Calling them on a prod-backed handle throws SandboxError('failed-precondition').
+- [Tool factories](/__pyric/ui/docs/pyric-firestore-reference-tool-factories.md): createFirestoreDataTools(deps) wraps the modular Firestore data plane as @inbrowser/agent tool handlers.
+- [Why rules tooling lives in a sibling package](/__pyric/ui/docs/pyric-firestore-explanation-rules-tooling-is-separate.md): pyric/firestore is the data plane. It doesn't ship the rules parser, the linter, the simulator, the validator, the modules resolver, or the value wrappers. Those live in pyric/rules. The split looks bureaucratic; the reason is the swap-in contract.
+- [The TARGET_SYMBOL opacity contract](/__pyric/ui/docs/pyric-firestore-explanation-target-symbol-opacity.md): The public Firestore type has exactly one property:
+- [Why two backends behind one surface](/__pyric/ui/docs/pyric-firestore-explanation-two-backends-one-surface.md): pyric/firestore exposes getFirestore(target) with two overloads: one accepting a SandboxContext, one accepting a FirebaseApp. The same downstream functions (getDoc, setDoc, onSnapshot, ...) work against either. This page explains the design.
+- [pyric/firestore compatibility matrix](/__pyric/ui/docs/pyric-firestore-compat.md): The single readable contract for "what this shim guarantees vs the production firebase/firestore SDK."
+
+## pyric / rules
+
+- [pyric/rules](/__pyric/ui/docs/pyric-rules.md): Pyric-native Firestore Security Rules tooling. A browser-safe parser, linter, modules resolver, in-process simulator, and Rules Test API client — packaged so the data-plane swap-in (pyric/firestore) stays minimal.
+- [Lint your first rules file](/__pyric/ui/docs/pyric-rules-tutorials-01-lint-your-first-rules-file.md): In this tutorial you will install pyric/rules, write a small rules file with a deliberate problem in it, and use the linter to find that problem. By the end you will have seen the parse → lint cycle end-to-end, and you will know what a LintWarning looks like in practice.
+- [Write a test suite for your rules](/__pyric/ui/docs/pyric-rules-tutorials-02-write-a-test-suite-for-your-rules.md): In this tutorial you will pick up where Lint your first rules file left off and add a suite of test cases. You will use the in-process simulator — SimulateFirestoreRulesHandler — so the whole loop stays local. No Firebase project, no network, no deployment.
+- [How to compare two rulesets for weakening](/__pyric/ui/docs/pyric-rules-how-to-compare-rulesets-for-weakening.md): When you ship a rules change, the most dangerous mistake is silently removing a security predicate to make a failing test pass. This guide shows you how to catch that before it deploys.
+- [How to inspect rules through the AST](/__pyric/ui/docs/pyric-rules-how-to-inspect-rules-via-the-ast.md): This guide shows you how to parse rules into a typed AST and walk the tree for custom analysis — building bespoke lint rules, generating documentation, or extracting structural facts the built-in linter doesn't surface.
+- [How to lint a rules source](/__pyric/ui/docs/pyric-rules-how-to-lint-rules-source.md): This guide shows you how to lint a Firestore rules source and act on the result.
+- [How to pin request.time for deterministic tests](/__pyric/ui/docs/pyric-rules-how-to-pin-request-time.md): A rule that reads request.time evaluates against wallclock by default. That makes any date-gated test flaky: the same TestCase run twice can decide ALLOW once and DENY the next. This guide shows you how to pin time so the verdict is reproducible.
+- [How to register rules tools with an agent](/__pyric/ui/docs/pyric-rules-how-to-register-tools-with-an-agent.md): This guide shows you how to expose the rules surface as tool handlers for an @inbrowser/agent registry — so an LLM-driven agent can lint, simulate, and test rules through structured tool calls.
+- [How to resolve 2+modules imports](/__pyric/ui/docs/pyric-rules-how-to-resolve-module-imports.md): This guide shows you how to write rules that import reusable helper functions and resolve them into a standard Firestore rules source.
+- [How to simulate rules locally](/__pyric/ui/docs/pyric-rules-how-to-simulate-rules-locally.md): This guide shows you how to evaluate Firestore rules in-process against a list of test cases, without deploying or contacting Google's servers.
+- [How to test rules against the Firebase Rules Test API](/__pyric/ui/docs/pyric-rules-how-to-test-rules-against-firebase.md): This guide shows you how to evaluate Firestore rules against Google's live Rules Test API. Use this when the local simulator returns UNSUPPORTED, or when you need parity with what production will actually decide.
+- [Public API](/__pyric/ui/docs/pyric-rules-reference-api.md): This page describes every symbol re-exported from pyric/rules. Symbols are grouped by submodule and listed alphabetically within each group.
+- [AST](/__pyric/ui/docs/pyric-rules-reference-ast.md): The AST is the typed tree produced by parseToAST / parseToASTOrError. Every shape is exported from pyric/rules.
+- [Errors](/__pyric/ui/docs/pyric-rules-reference-errors.md): The package surfaces failures in three ways: structured values for the parser, throwable classes for the evaluator, and Outcome-shaped objects for the handlers. This page lists every error type.
+- [Lint rules](/__pyric/ui/docs/pyric-rules-reference-lint-rules.md): This page lists every lint rule emitted by lintFirestoreRules. Each entry gives the rule code, default severity, what it detects, and the suggested fix.
+- [Simulator context and result states](/__pyric/ui/docs/pyric-rules-reference-simulator-context.md): The simulator evaluates expressions against a SimulationContext. This page describes its shape and the three result states a test case can land in.
+- [Standard library modules](/__pyric/ui/docs/pyric-rules-reference-stdlib-modules.md): Fifteen modules ship with pyric/rules. Each module is a .rules file living under src/rules/modules/stdlib/; imports resolve automatically without any configuration.
+- [TestCase schema](/__pyric/ui/docs/pyric-rules-reference-test-case-schema.md): TestCase is the unit of work for both the local simulator (SimulateFirestoreRulesHandler) and the live Rules Test API client (TestFirestoreRulesHandler). The Zod schema is exported as TestCaseSchema; the inferred type is exported as TestCase.
+- [Validator findings](/__pyric/ui/docs/pyric-rules-reference-validator-findings.md): validateFirestoreRules(ast) returns an array of ValidationFinding:
+- [Value wrappers](/__pyric/ui/docs/pyric-rules-reference-value-wrappers.md): The simulator and the sentinel expression engine model Firestore's runtime types as TypeScript classes. Every wrapper extends RulesValue, exposes equals, toJSON, and toString, and dispatches method calls via callMethod.
+- [Agent failure modes the linter catches](/__pyric/ui/docs/pyric-rules-explanation-agent-failure-modes.md): Most of the linter's compilation and budget rules came from production: we hit the limit, learned the number, encoded it. A separate set of rules came from somewhere different — watching LLM-driven agents try to write rules and fail in characteristic ways.
+- [Lint vs validate vs simulate vs test](/__pyric/ui/docs/pyric-rules-explanation-lint-vs-validate-vs-simulate-vs-test.md): The package offers four distinct ways to look at a rules source. Their names suggest they overlap. They don't, and the distinction matters when you're building a CI pipeline or an agent loop.
+- [The runtime budget and shared gates](/__pyric/ui/docs/pyric-rules-explanation-runtime-budget-and-shared-gates.md): Firestore rules have two kinds of limits: ones it tells you about (compilation failures, returned as 400 INVALID_ARGUMENT) and ones it doesn't (runtime evaluation budget exhaustion, returned as a silent 403 PERMISSION_DENIED that looks identical to a denied rule).
+- [The sentinel expression engine ($expr)](/__pyric/ui/docs/pyric-rules-explanation-sentinel-expression-engine.md): Firestore writes are usually concrete — { count: 5, owner: 'alice' }. But sometimes you want a write whose value depends on the document at write time: "increment count by one if it's less than 100", "set lastSeen to the current request time", "merge this list with the existing one and dedupe". The Firestore SDK offers a handful of FieldValue sentinels for the most common cases (increment, arrayUnion, serverTimestamp), but anything outside that small set requires a transaction.
+- [Simulator vs Rules Test API](/__pyric/ui/docs/pyric-rules-explanation-simulator-vs-rules-test-api.md): Two surfaces evaluate rules against test cases. They share a type signature and a result shape; they disagree on tradeoffs. Choosing between them is a deliberate decision, not an implementation detail.
+- [The 2+modules extension](/__pyric/ui/docs/pyric-rules-explanation-the-2-plus-modules-extension.md): Firestore rules don't have imports. The DSL has functions, but every function has to be defined in the same file as the match block that calls it. This means real-world rules either repeat the same helper code across files (and drift) or live in one giant file (and become unreadable).
+- [Value wrapper design](/__pyric/ui/docs/pyric-rules-explanation-value-wrappers-design.md): Firestore rules have a small but real type system. request.time is a timestamp. request.path is a path. bytes[0:10] is a bytes value. is duration, is timestamp, is reference are type tests. None of these have first-class JavaScript representations — Timestamp is not a primitive, Path is not a primitive — so the simulator has to model them somehow.
+- [Why this package exists](/__pyric/ui/docs/pyric-rules-explanation-why-this-package-exists.md): Firestore Security Rules is a small DSL that sits between every read and write your app makes. In Pyric we have two distinct needs around that DSL:
+
+## pyric / sandbox
+
+- [pyric/sandbox](/__pyric/ui/docs/pyric-sandbox.md): In-process Firebase sandbox — the foundation every other @pyric/* data-plane package plugs into. Holds documents, rules, and listener state for a single isolated environment. Identity-agnostic by design; every operation flows through a SandboxContext that names the auth identity it should evaluate under.
+- [Your first sandbox session](/__pyric/ui/docs/pyric-sandbox-tutorials-01-your-first-sandbox-session.md): In this tutorial you will create a sandbox, deploy a tiny set of rules, write a document as one user, deny a read as another, and inspect the result. By the end you'll have seen the three core ideas — Sandbox, SandboxContext, SandboxError — work together in one short script.
+- [Use the sandbox in a test harness](/__pyric/ui/docs/pyric-sandbox-tutorials-02-use-the-sandbox-in-a-test-harness.md): In this tutorial you will wire pyric/sandbox into a real test suite. By the end you will have:
+- [Build a traffic monitor](/__pyric/ui/docs/pyric-sandbox-tutorials-03-build-a-traffic-monitor.md): In this tutorial you will build a tiny event monitor over the sandbox. You'll subscribe to sandbox.onEvent, see allowed and denied operations stream through, watch listener attaches and snapshot deliveries fire on the same channel, then filter the stream by kind. By the end you'll have run a working monitor against a real sandbox and felt the unified event shape through your fingers.
+- [How to run multiple isolated sandboxes in parallel](/__pyric/ui/docs/pyric-sandbox-how-to-multiple-isolated-sandboxes.md): This guide shows you how to keep multiple sandboxes alive at once — for fleet tests, multi-tenant simulations, or any workload that needs more than one isolated environment.
+- [How to observe sandbox events](/__pyric/ui/docs/pyric-sandbox-how-to-observe-events.md): One subscription covers everything observable. sandbox.onEvent(cb) fires a SandboxEvent for every rule evaluation, every committed write, every snapshot delivered to a listener callback, every suppressed re-eval, every listener attach / detach / errored, and every reset / dispose boundary. Filter on event.kind to recover whichever slice your code cares about.
+- [How to pick between pyric-admin and pyric/firestore](/__pyric/ui/docs/pyric-sandbox-how-to-pick-an-adapter.md): Two adapter packages sit on top of pyric/sandbox. Both expose Firestore. They look the same from a distance and shape differently up close. This guide helps you pick.
+- [How to replay a captured event stream](/__pyric/ui/docs/pyric-sandbox-how-to-replay-events.md): The sandbox captures every SandboxEvent it emits. Hand the captured stream to replay(events, rules) from pyric/sandbox and the engine re-issues every write against a fresh sandbox, classifying the differences against an optional snapshot of the original state.
+- [How to reset between tests](/__pyric/ui/docs/pyric-sandbox-how-to-reset-between-tests.md): This guide shows you how to keep one sandbox alive across many tests without state leakage.
+- [How to seed initial data and rules](/__pyric/ui/docs/pyric-sandbox-how-to-seed-data-and-rules.md): This guide shows you how to bring a fresh sandbox up to a known state — rules deployed, documents in place — before your test code runs.
+- [How to switch users with withAuth](/__pyric/ui/docs/pyric-sandbox-how-to-switch-users.md): This guide shows you how to evaluate rules under different auth identities against the same sandbox.
+- [How to use admin reads to assert in tests](/__pyric/ui/docs/pyric-sandbox-how-to-use-admin-reads.md): This guide shows you how to use sandbox.admin to verify state in tests without writing rules that permit your test fixture.
+- [Public API](/__pyric/ui/docs/pyric-sandbox-reference-api.md): Every symbol re-exported from pyric/sandbox. The /internal sub-path is documented separately — see The /internal adapter protocol.
+- [Divergence](/__pyric/ui/docs/pyric-sandbox-reference-divergences.md): What replay(events, rules, opts, originalState) returns when the replayed state doesn't perfectly match the captured state. A discriminated union — filter on kind to handle each case.
+- [SandboxError codes](/__pyric/ui/docs/pyric-sandbox-reference-error-codes.md): Every error the sandbox raises is a SandboxError carrying a code. Catch with instanceof SandboxError, switch on code.
+- [The /internal adapter protocol](/__pyric/ui/docs/pyric-sandbox-reference-internal-protocol.md): The pyric/sandbox/internal sub-path is the adapter-only surface. Service-adapter packages (pyric-admin, pyric/firestore, future pyric/auth) consume it to reach the underlying LocalEnvironment and related primitives.
+- [Sandbox, SandboxContext, AuthState](/__pyric/ui/docs/pyric-sandbox-reference-sandbox-and-context.md): The three core types. Every other surface in the package builds on them.
+- [SandboxEvent](/__pyric/ui/docs/pyric-sandbox-reference-sandbox-event.md): The discriminated union sandbox.onEvent(cb) delivers. Filter on kind to recover any individual event family. The unified channel replaces the prior onRequest / onDenial / onSnapshotError triplet.
+- [SandboxSnapshot and admin reads](/__pyric/ui/docs/pyric-sandbox-reference-snapshot-and-admin.md): Two related surfaces. SandboxSnapshot is the shape returned by Sandbox.snapshot(). SandboxAdmin is the rule-bypass read surface exposed on Sandbox.admin.
+- [Every operation is a request](/__pyric/ui/docs/pyric-sandbox-explanation-every-op-is-a-request.md): The sandbox started with one observation channel — onDenial — and it surfaced the wrong subset of the truth. We expanded the surface to onRequest, then to a per-channel triplet (onRequest / onDenial / onSnapshotError), and finally collapsed them into one unified onEvent. This page explains the conceptual arc, what it implies about how to think about sandbox traffic, and the trade-offs we made along the way.
+- [Identity is a context, not a sandbox](/__pyric/ui/docs/pyric-sandbox-explanation-identity-is-a-context.md): The most-visible architectural decision in pyric/sandbox is that Sandbox does not carry an identity. To do anything as a user, you derive a SandboxContext via sandbox.withAuth(...). This page explains why.
+- [The /internal adapter protocol](/__pyric/ui/docs/pyric-sandbox-explanation-internal-adapter-protocol.md): pyric/sandbox ships a second sub-path: pyric/sandbox/internal. The public entry stays narrow — Sandbox, SandboxContext, SandboxError, listener channels, lifecycle. Anything an adapter needs but a consumer shouldn't reach for lives behind the /internal gate.
+- [Listener re-evaluation on deployRules](/__pyric/ui/docs/pyric-sandbox-explanation-listener-re-evaluation.md): A snapshot listener attached before a deployRules call gets re-evaluated under the new rules. This is a deliberate departure from production Firestore behaviour. The reasoning matters; this page lays it out.
+- [A local backend, not Firestore offline persistence](/__pyric/ui/docs/pyric-sandbox-explanation-local-backend-vs-firestore-offline.md): A natural worry when you see pyric dev keep data across refreshes and sync across tabs is: "are you reimplementing Firestore's offline + multi-tab persistence?" That feature is famously one of the hardest parts of the Firestore SDK, and reimplementing it would be a massive undertaking.
+- [Why service adapters live in sibling packages](/__pyric/ui/docs/pyric-sandbox-explanation-why-adapters-are-siblings.md): pyric/sandbox doesn't ship the data-plane API. The functions you actually call — getDoc, setDoc, collection, onSnapshot, runTransaction — live in pyric-admin (Admin-SDK-shaped) and pyric/firestore (modular Web-SDK-shaped). This page explains why.
+- [Why this package exists](/__pyric/ui/docs/pyric-sandbox-explanation-why-this-package-exists.md): The Firebase Emulator Suite is a Google-provided tool that runs a local copy of Firestore (and other services) in a sub-process. It's the canonical answer to "I want to test without hitting production." It works, but only in environments that can spawn an emulator. pyric/sandbox is what happens when you can't.
+
+## pyric / storage
+
+- [pyric/storage](/__pyric/ui/docs/pyric-storage.md): Firebase Storage adapter for the Pyric sandbox. Modular Web-SDK shape — getStorageSandbox, ref, uploadBytes, getBytes, listAll, deleteObject — backed by IndexedDB. A getStorageProd factory dispatches the same call sites to real Firebase Storage.
+- [Upload and download a session archive](/__pyric/ui/docs/pyric-storage-tutorials-01-upload-and-download.md): In this tutorial you will build the session-archive flow pyric/storage was designed for: upload a JSON blob, list the archive, download an entry, enforce rules so anonymous callers can't poison the bucket.
+- [How to enforce Storage rules](/__pyric/ui/docs/pyric-storage-how-to-enforce-rules.md): This guide shows you how to wire Storage rules into a sandbox-backed handle and watch them gate uploads, reads, and deletes.
+- [How to list and delete objects](/__pyric/ui/docs/pyric-storage-how-to-list-and-delete.md): This guide shows you how to enumerate objects under a prefix and remove them.
+- [How to round-trip metadata](/__pyric/ui/docs/pyric-storage-how-to-round-trip-metadata.md): This guide shows you how to set, read, and update Storage object metadata.
+- [How to switch between sandbox and prod backends](/__pyric/ui/docs/pyric-storage-how-to-switch-backends.md): pyric/storage has two entry points: getStorageSandbox(target, options?) and getStorageProd(app, options?). Pick by where you need the data to land.
+- [How to test rule expressions independently](/__pyric/ui/docs/pyric-storage-how-to-test-rule-expressions.md): This guide shows you how to verify a Storage rule expression without uploading anything. Useful when iterating on a complex rule or building a rules-test harness.
+- [Public API](/__pyric/ui/docs/pyric-storage-reference-api.md): Every symbol exported from pyric/storage.
+- [Error codes](/__pyric/ui/docs/pyric-storage-reference-error-codes.md): Operations through pyric/storage throw errors with Firebase-aligned code properties — 'storage/<noun>'. Catch by code.
+- [Storage rules subset](/__pyric/ui/docs/pyric-storage-reference-rules-subset.md): The Storage rules grammar in the v1 scope. Anything not listed is out of scope and will produce a parse error.
+- [StorageOptions](/__pyric/ui/docs/pyric-storage-reference-storage-options.md): The options bag for getStorageSandbox(target, options?).
+- [Implementation scope and deferred features](/__pyric/ui/docs/pyric-storage-explanation-implementation-scope.md): pyric/storage is a deliberate v1 scope. The scope is what the session-archive use case needed; anything beyond that is deferred. This page is the canonical list of what's not in the package and why.
+- [The session-archive driver](/__pyric/ui/docs/pyric-storage-explanation-session-archive-use-case.md): pyric/storage was scoped around one use case: storing completed agent sessions so a user can come back to them later. This page explains the use case and how it shaped the package.
+- [Why IndexedDB](/__pyric/ui/docs/pyric-storage-explanation-why-indexeddb.md): pyric/storage's sandbox backend persists blobs and metadata in IndexedDB. This page explains why, and what the choice implies.
+- [pyric/storage compatibility matrix](/__pyric/ui/docs/pyric-storage-compat.md): The single readable contract for "what this shim guarantees vs the production firebase/storage SDK."
+
+## pyric / auth
+
+- [pyric/auth](/__pyric/ui/docs/pyric-auth.md): Modular Web SDK Auth adapter for the Pyric sandbox. Mirrors firebase/auth's tree-shakable shape — getAuth, signInAnonymously, signInWithEmailAndPassword, onAuthStateChanged, signInWithPopup, GoogleAuthProvider — with two backends picked at init time:
+- [API reference — pyric/auth](/__pyric/ui/docs/pyric-auth-reference-api.md): Exact signatures of every public export, grouped by purpose. Sandbox-only behavior is called out per function.
+- [Feature matrix — pyric/auth vs firebase/auth](/__pyric/ui/docs/pyric-auth-reference-feature-matrix.md): Side-by-side coverage of the modular Web SDK Auth surface. Use this to decide what's safe to write in code that has to run against both the pyric sandbox and prod Firebase.
+- [Sandbox test driver — pyric/auth/sandbox.*](/__pyric/ui/docs/pyric-auth-reference-sandbox-test-driver.md): The sandbox export is pyric/auth's test-driver namespace. It mirrors pyric/firestore's sandbox.setRules / sandbox.seedDocuments pattern — methods exist only for sandbox-backed Auth handles and throw failed-precondition against a prod handle.
+- [pyric/auth compatibility matrix](/__pyric/ui/docs/pyric-auth-compat.md): The single readable contract for "what this shim guarantees vs the production firebase/auth SDK."
+
+## pyric / database
+
+- [Realtime Database](/__pyric/ui/docs/pyric-database.md): Pyric's Realtime Database surface has two parts:
+- [Author your first RTDB rules with constraints](/__pyric/ui/docs/pyric-database-tutorials-01-author-rtdb-rules-with-constraints.md): This tutorial creates a small Realtime Database rules document in memory, checks it, and simulates one write before you hand the generated JSON to deploy tooling.
+- [RTDB rules tooling](/__pyric/ui/docs/pyric-database-reference-rules-tooling.md): The pyric/rules/rtdb subpath is the canonical Realtime Database rules tooling entrypoint.
+- [Why RTDB rules authoring and deploy are separate](/__pyric/ui/docs/pyric-database-explanation-rules-authoring-and-deploy-are-separate.md): Pyric keeps Realtime Database rules authoring in pyric/rules/rtdb and project deployment in pyric-tools/deploy.
+- [@pyric/rtdb compatibility matrix](/__pyric/ui/docs/pyric-database-compat.md): The single readable contract for "what this package guarantees vs the production Firebase Realtime Database surface."
+
+## pyric-admin / firestore
+
+- [pyric-admin](/__pyric/ui/docs/pyric-admin-firestore.md): Admin-SDK-shaped Firestore adapter for the Pyric sandbox. Mirrors firebase-admin/firestore — db.collection(p).doc(p).get(), db.batch(), db.runTransaction() — over pyric/sandbox's in-process substrate. Streaming reads are covered too: a production-shaped onSnapshot ships as both a free function and a chainable .onSnapshot(...) method on refs and queries.
+- [Your first admin-shaped Firestore session](/__pyric/ui/docs/pyric-admin-firestore-tutorials-01-first-admin-session.md): In this tutorial you will use pyric-admin to write, read, batch, transact, and watch documents in a sandbox. By the end you will have seen every piece of the surface in action.
+- [How to run a transaction](/__pyric/ui/docs/pyric-admin-firestore-how-to-run-a-transaction.md): This guide shows you how to use runTransaction on a sandbox Firestore handle.
+- [How to seed and set rules](/__pyric/ui/docs/pyric-admin-firestore-how-to-seed-and-set-rules.md): This guide shows you how to use the sandbox-only setRules and seed methods on the Firestore handle.
+- [How to translate denials with denialContext](/__pyric/ui/docs/pyric-admin-firestore-how-to-translate-denials.md): This guide shows you how to read the structured denial frame attached to every permission-denied error from pyric-admin operations.
+- [How to use onSnapshot to watch a doc or query](/__pyric/ui/docs/pyric-admin-firestore-how-to-use-onsnapshot.md): This guide shows you how to register a snapshot listener and react to changes.
+- [How to write a batch](/__pyric/ui/docs/pyric-admin-firestore-how-to-write-a-batch.md): This guide shows you how to use WriteBatch for atomic multi-document writes.
+- [Public API](/__pyric/ui/docs/pyric-admin-firestore-reference-api.md): Every symbol re-exported from pyric-admin.
+- [onSnapshot overloads](/__pyric/ui/docs/pyric-admin-firestore-reference-onsnapshot.md): The Web-SDK-shaped streaming surface. Four overload groups mirror firebase/firestore's onSnapshot exactly, so existing call sites copied from production code typecheck unchanged.
+- [Re-exported types](/__pyric/ui/docs/pyric-admin-firestore-reference-re-exported-types.md): pyric-admin/firestore re-exports a large surface of types from the sandbox admin-firestore implementation and pyric/sandbox so most consumers can import the Firestore admin surface from one place. This page lists what comes from where and why.
+- [SandboxFirestore surface](/__pyric/ui/docs/pyric-admin-firestore-reference-sandbox-firestore.md): The handle returned from getFirestore(ctx). Extends Firestore from firebase-admin/firestore (via the simulator's compat impl) and adds three sandbox-only methods.
+- [Error translation and instanceof SandboxError](/__pyric/ui/docs/pyric-admin-firestore-explanation-error-translation.md): Every operation through a SandboxFirestore handle that fails throws a SandboxError. The underlying simulator throws FirestoreSimError; the admin handle wraps every method, catches those, and re-throws as SandboxError with structured denialContext. This page explains the layer.
+- [Per-call delegate construction](/__pyric/ui/docs/pyric-admin-firestore-explanation-per-call-delegate.md): Every production-shaped method on SandboxFirestore constructs a fresh Firestore delegate from pyric/sandbox/admin-firestore per call. This page explains why and what it costs.
+- [Why mirror the admin SDK shape](/__pyric/ui/docs/pyric-admin-firestore-explanation-why-mirror-admin-shape.md): pyric-admin re-implements the firebase-admin/firestore API. Same chainable style, same method names, same arguments, same return types. The behaviour is sandbox-aware (it talks to pyric/sandbox instead of Google's servers), but the surface is faithful.
+
+## @pyric/ui
+
+- [@pyric/ui](/__pyric/ui/docs/ui.md): Per-component reference. Each page is one-screen — import, minimal example, props table, common gotchas.
+- [<Badge>](/__pyric/ui/docs/ui-primitives-badge.md): Headless pill / tag. An inline <span> carrying data-pyric-badge and an optional data-pyric-badge-kind so consumers style categories with attribute selectors.
+- [<ConfirmDialog> + useConfirm](/__pyric/ui/docs/ui-primitives-confirmdialog.md): Headless confirmation dialog. Two ways to use:
+- [<CopyButton>](/__pyric/ui/docs/ui-primitives-copybutton.md): Clipboard button that exposes a data-copied attribute on the underlying <button> so consumers can style the success state. Ships no visual treatment of its own.
+- [<JsonView>](/__pyric/ui/docs/ui-primitives-jsonview.md): Headless collapsible JSON tree — one structural step above a <pre> dump. Object/array nodes are independently expandable; there's no editing and no syntax-color theme, just data-pyric-* hooks.
+- [<SegmentedControl>](/__pyric/ui/docs/ui-primitives-segmentedcontrol.md): Headless single-select chip group — reads as one widget, wired as an ARIA radiogroup.
+- [<ToastProvider> + useToast](/__pyric/ui/docs/ui-primitives-toast.md): Imperative toast queue. One <ToastProvider> per scope; any descendant calls useToast() to push toasts. Renders to document.body via portal.
+- [<VirtualList>](/__pyric/ui/docs/ui-primitives-virtuallist.md): Thin wrapper around @tanstack/react-virtual. Renders a scrollable container with absolutely-positioned rows; only the rows in view (plus overscan neighbors) mount to the DOM.
+- [<CollectionList>](/__pyric/ui/docs/ui-firestore-collectionlist.md): Headless list renderer for collections under a parent. The component is purely presentational — fetching is the consumer's job (via useCollectionList or otherwise).
+- [<DeleteWithConfirm>](/__pyric/ui/docs/ui-firestore-deletewithconfirm.md): Composition of useConfirm + useRecursiveDelete for safe deletion of a document or collection with progress tracking.
+- [<DocumentEditor>](/__pyric/ui/docs/ui-firestore-documenteditor.md): Compound component over useDocumentEditor. The hook owns a reducer-backed normalized field tree; the component renders the tree with per-type Edit widgets and add/remove affordances.
+- [<DocumentList>](/__pyric/ui/docs/ui-firestore-documentlist.md): Headless list renderer for documents in a collection. Above virtualizeThreshold (default 100), switches to virtualized rendering via <VirtualList>; below, renders a plain <ul>.
+- [<DocumentPreview>](/__pyric/ui/docs/ui-firestore-documentpreview.md): Read-only renderer for a Firestore document. Iterates top-level fields in lexicographic order; dispatches each value through the field-editor registry on its inferred type.
+- [<QueryBuilder>](/__pyric/ui/docs/ui-firestore-querybuilder.md): Single-level where/orderBy/limit query builder. Composes state into a real Firestore Query via the hook's buildQuery(base).
+- [<ReferencePicker>](/__pyric/ui/docs/ui-firestore-referencepicker.md): Pick a DocumentReference by typing a path OR by browsing the tree. Improvement over firebase-tools-ui's plain text input.
+- [<DeleteSelectionWithConfirm>](/__pyric/ui/docs/ui-storage-deleteselectionwithconfirm.md): Bulk + recursive delete behind the confirm-dialog primitive, with toasts on outcome — the storage counterpart of the Firestore half's <DeleteWithConfirm>. Objects delete via deleteObject; folders walk recursively (default impl: listAll-driven, including the create-folder placeholder sweep). Requires <ConfirmProvider> and <ToastProvider> ancestors.
+- [<ObjectBrowser>](/__pyric/ui/docs/ui-storage-objectbrowser.md): Headless row list for a storage path — folders first, then objects, from useStorageList's entries. Folder rows navigate, object rows select. Above virtualizeThreshold (default 100), switches to virtualized rendering via <VirtualList>; below, renders a plain <ul>.
+- [<ObjectInspector>](/__pyric/ui/docs/ui-storage-objectinspector.md): Headless inspector for one storage object: metadata fields + a content-type-driven preview. Previews come from a registry — image/ (blob-URL <img>) and text/ + application/json (text panel, 256KB cap, JSON pretty-printed) ship built in; consumers extend by prepending their own matchers. Bytes load lazily and only when the matched preview asks; blob URLs are revoked on path change/unmount.
+- [<PathBreadcrumb>](/__pyric/ui/docs/ui-storage-pathbreadcrumb.md): Headless breadcrumb for a storage path. Renders a root crumb plus one crumb per segment; every crumb (including the current one) is a real <button> firing onNavigate with that ancestor's absolute path.
+- [@pyric/ui/storage](/__pyric/ui/docs/ui-storage.md): Headless components + hooks for browsing AND administering Firebase Storage — list/navigate/select (the read path), upload, inspect, metadata editing, and bulk delete (the write path), plus rules-aware affordances (the gate pre-evaluates rules so denied actions warn BEFORE the click). Same one-handle contract as the Firestore half: every hook takes a FirebaseStorage handle (pyric/storage sandbox or prod), so the same components work against the in-browser sandbox and a real bucket.
+- [<UploadDropzone>](/__pyric/ui/docs/ui-storage-uploaddropzone.md): Headless drop target for file and folder uploads. Slot-based — the children render the chrome; the component owns the drag wiring, flattens the drop (folders traverse recursively via webkitGetAsEntry), and emits DroppedFile { file, relativePath }[] ready for useObjectUpload.
+- [Rules-aware affordances](/__pyric/ui/docs/ui-storage-rules-aware-affordances.md): The M7 differentiator: the storage UI knows what the rules will say before the click. One hook — useStorageRulesGate — evaluates the current identity against paths with the same evaluator the sandbox enforces with; the components annotate themselves from its verdicts. No emulator-UI equivalent exists.
+- [useStorageRulesGate](/__pyric/ui/docs/ui-storage-usestoragerulesgate.md): Pre-flight rules evaluation — evaluate the current identity against storage paths before the click, so the UI can mark denied affordances (data-pyric-denied rows, disabled-with-reason buttons) instead of letting the user discover a denial through a thrown storage/unauthorized. Built on the pure evaluator exports from pyric/storage (parseStorageRules + evaluateStorageRules) — the same evaluator the sandbox enforces with.
+- [@pyric/ui/traffic](/__pyric/ui/docs/ui-traffic.md): Headless components + hooks for observing rule-eval traffic — a Chrome DevTools Network-panel-style log and a per-rule heatmap, plus stats and grouping. Decoupled from pyric/sandbox: the data hook takes a source function, so the same components work against the sandbox or a production log feed.
+- [<RuleHeatmap>](/__pyric/ui/docs/ui-traffic-ruleheatmap.md): Per-rule fire / deny rollup — one row per rule, busiest first. Pairs with useRuleHeatmap, which does the aggregation.
+- [<TrafficDetail>](/__pyric/ui/docs/ui-traffic-trafficdetail.md): The drill-in panel for one traffic event — header, a consumer classification slot, then JSON sections for auth / request / resource before+after, the reasons list, triggeredBy, and groupId.
+- [<TrafficLog> · <TrafficRow> · <TrafficGroupRow>](/__pyric/ui/docs/ui-traffic-trafficlog.md): The event stream — a Chrome DevTools Network-panel-style list. Below 100 rows it's a plain <ul>; above, it virtualizes via <VirtualList>. Pass items (from useTrafficGroups) instead of events for collapsible group rows.
+- [<TrafficStats>](/__pyric/ui/docs/ui-traffic-trafficstats.md): The aggregation panel — totals, deny rate, and count breakdowns by method / origin / path. Pairs with useTrafficStats.
+- [<AuthSignInHelper> + useAuthFlowHelper](/__pyric/ui/docs/ui-auth-authsigninhelper.md): Emulator-style sign-in helper for sandbox auth: when an app calls signInWithPopup / signInWithRedirect against a sandbox Auth handle, the flow parks on a helper request; this pair renders an account picker + add-account form and settles the app's promise.
+- [Auth users admin — useAuthUsers, <AuthUserList>, <AuthUserForm>](/__pyric/ui/docs/ui-auth-authusers.md): Emulator-style user administration for a sandbox Auth handle: a live users table, an add/edit form with emulator-grade validation, and confirm-gated destructive actions.

package/dist/serve/entries/app.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The bundle the import map serves for `firebase/app`. Lets the canonical
+ * idiom — `import { initializeApp } from 'firebase/app'` — run unmodified:
+ * the Firebase config is accepted and ignored (there is no real backend to
+ * configure; the page runs on the pyric sandbox), and the returned handle is
+ * a `PyricApp` branded onto the page's ONE shared sandbox, so
+ * `getAuth(app)` / `getFirestore(app)` dispatch to the same backend the bare
+ * calls default to. Browser-bundled by `../bundler.ts`; never imported by
+ * node-side code.
+ */
+import { type PyricApp } from 'pyric/app';
+/** What app code passes — the real FirebaseOptions shape. Unused under
+ *  serve; kept on the handle (`app.options`) for code that reads it. */
+export type FirebaseOptions = Record<string, unknown>;
+export type ServeFirebaseApp = PyricApp & {
+    readonly name: string;
+    readonly options: FirebaseOptions;
+    automaticDataCollectionEnabled: boolean;
+};
+export declare function initializeApp(options?: FirebaseOptions, rawName?: string | {
+    name?: string;
+}): ServeFirebaseApp;
+export declare function getApp(name?: string): ServeFirebaseApp;
+export declare function getApps(): ServeFirebaseApp[];
+export declare function deleteApp(app: ServeFirebaseApp): Promise<void>;
+//# sourceMappingURL=app.d.ts.map

package/dist/serve/entries/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAuC,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG/E;wEACwE;AACxE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,8BAA8B,EAAE,OAAO,CAAC;CACzC,CAAC;AAMF,wBAAgB,aAAa,CAC3B,OAAO,GAAE,eAAoB,EAC7B,OAAO,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACnC,gBAAgB,CAoBlB;AAED,wBAAgB,MAAM,CAAC,IAAI,GAAE,MAAqB,GAAG,gBAAgB,CAapE;AAED,wBAAgB,OAAO,IAAI,gBAAgB,EAAE,CAE5C;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE"}

package/dist/serve/entries/app.js

@@ -0,0 +1,51 @@
+/**
+ * The bundle the import map serves for `firebase/app`. Lets the canonical
+ * idiom — `import { initializeApp } from 'firebase/app'` — run unmodified:
+ * the Firebase config is accepted and ignored (there is no real backend to
+ * configure; the page runs on the pyric sandbox), and the returned handle is
+ * a `PyricApp` branded onto the page's ONE shared sandbox, so
+ * `getAuth(app)` / `getFirestore(app)` dispatch to the same backend the bare
+ * calls default to. Browser-bundled by `../bundler.ts`; never imported by
+ * node-side code.
+ */
+import { initializeApp as pyricInitializeApp } from 'pyric/app';
+import { sandbox } from './runtime.js';
+const DEFAULT_NAME = '[DEFAULT]';
+const apps = new Map();
+let configNoticeShown = false;
+export function initializeApp(options = {}, rawName) {
+    const name = (typeof rawName === 'string' ? rawName : rawName?.name) ?? DEFAULT_NAME;
+    // One page, one sandbox: re-init (even with different options) returns the
+    // existing handle instead of firebase's app/duplicate-app — every "app" on
+    // a served page is the same backend anyway.
+    const existing = apps.get(name);
+    if (existing)
+        return existing;
+    if (!configNoticeShown && Object.keys(options).length > 0) {
+        configNoticeShown = true;
+        console.info('[pyric dev] initializeApp(): your Firebase config is unused on this page — firebase/* is served by the pyric sandbox.');
+    }
+    const app = Object.assign(pyricInitializeApp({ sandbox }), {
+        name,
+        options,
+        automaticDataCollectionEnabled: false,
+    });
+    apps.set(name, app);
+    return app;
+}
+export function getApp(name = DEFAULT_NAME) {
+    const app = apps.get(name);
+    if (!app) {
+        // firebase/app parity: reading an app before initializeApp is an app
+        // bug — surface it the way the real SDK would, not leniently.
+        throw Object.assign(new Error(`No Firebase App '${name}' has been created - call initializeApp() first (app/no-app).`), { code: 'app/no-app', name: 'FirebaseError' });
+    }
+    return app;
+}
+export function getApps() {
+    return [...apps.values()];
+}
+export async function deleteApp(app) {
+    apps.delete(app.name);
+}
+//# sourceMappingURL=app.js.map

package/dist/serve/entries/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../../src/serve/entries/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,aAAa,IAAI,kBAAkB,EAAiB,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAYvC,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;AACjD,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAE9B,MAAM,UAAU,aAAa,CAC3B,UAA2B,EAAE,EAC7B,OAAoC;IAEpC,MAAM,IAAI,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,YAAY,CAAC;IACrF,2EAA2E;IAC3E,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,iBAAiB,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,IAAI,CACV,uHAAuH,CACxH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;QACzD,IAAI;QACJ,OAAO;QACP,8BAA8B,EAAE,KAAK;KACtC,CAAqB,CAAC;IACvB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAe,YAAY;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,oBAAoB,IAAI,+DAA+D,CACxF,EACD,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAqB;IACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/serve/entries/auth-helper-core.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Sign-in helper core for `pyric dev` — the framework-free controller
+ * behind the account-picker dialog (the emulator's sign-in widget analog,
+ * and the second consumer of `pyric/auth`'s `AuthFlowResolver` seam after
+ * the playground; same settle/seed semantics, zero DOM).
+ *
+ * `resolver()` parks the SDK's popup/redirect promise; `pick`/`add`/`cancel`
+ * settle it. `add()` seeds the identity into the sandbox user DB first so
+ * `request.auth.token.*` claims resolve in rules AND the identity shows in
+ * the picker next time (the uid-join-key lesson from the auth audit).
+ *
+ * Bun-testable without a browser — the `<dialog>` shell in
+ * `./auth-helper-dom.ts` is a thin view over `subscribe`/`snapshot` and the
+ * three actions.
+ */
+import { sandbox as authSandbox, type AuthFlowRequest, type AuthFlowResolver } from 'pyric/auth';
+import type { Sandbox } from 'pyric/sandbox';
+export interface NewIdentitySpec {
+    email: string;
+    displayName?: string;
+    /** Parsed custom claims (the emulator's `customAttributes`). */
+    customClaims?: Record<string, unknown>;
+}
+export interface HelperSnapshot {
+    /** The in-flight request, or null when no popup/redirect is pending. */
+    request: AuthFlowRequest | null;
+    identities: ReturnType<typeof authSandbox.listIdentities>;
+}
+export declare class ServeAuthHelper {
+    private pending;
+    private readonly listeners;
+    private cached;
+    private readonly auth;
+    constructor(sandbox: Sandbox);
+    /** Wire this helper into the page's auth. Call once at init. */
+    install(): void;
+    resolver(): AuthFlowResolver;
+    subscribe(fn: () => void): () => void;
+    snapshot(): HelperSnapshot;
+    private emit;
+    pick(uid: string): void;
+    add(spec: NewIdentitySpec): void;
+    cancel(): void;
+    private take;
+    private credential;
+}
+//# sourceMappingURL=auth-helper-core.d.ts.map

package/dist/serve/entries/auth-helper-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-core.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAEL,OAAO,IAAI,WAAW,EAEtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAGtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC;CAC3D;AAWD,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;gBAEhB,OAAO,EAAE,OAAO;IAI5B,gEAAgE;IAChE,OAAO,IAAI,IAAI;IAIf,QAAQ,IAAI,gBAAgB;IAW5B,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAKrC,QAAQ,IAAI,cAAc;IAQ1B,OAAO,CAAC,IAAI;IAMZ,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAWvB,GAAG,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;IAkBhC,MAAM,IAAI,IAAI;IAWd,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,UAAU;CAuBnB"}

package/dist/serve/entries/auth-helper-core.js

@@ -0,0 +1,121 @@
+/**
+ * Sign-in helper core for `pyric dev` — the framework-free controller
+ * behind the account-picker dialog (the emulator's sign-in widget analog,
+ * and the second consumer of `pyric/auth`'s `AuthFlowResolver` seam after
+ * the playground; same settle/seed semantics, zero DOM).
+ *
+ * `resolver()` parks the SDK's popup/redirect promise; `pick`/`add`/`cancel`
+ * settle it. `add()` seeds the identity into the sandbox user DB first so
+ * `request.auth.token.*` claims resolve in rules AND the identity shows in
+ * the picker next time (the uid-join-key lesson from the auth audit).
+ *
+ * Bun-testable without a browser — the `<dialog>` shell in
+ * `./auth-helper-dom.ts` is a thin view over `subscribe`/`snapshot` and the
+ * three actions.
+ */
+import { getAuth, sandbox as authSandbox, } from 'pyric/auth';
+/** Seeds need a password field; popup identities never sign in with one. */
+const SYNTHETIC_PASSWORD = '__pyric_popup_no_password__';
+export class ServeAuthHelper {
+    pending = null;
+    listeners = new Set();
+    cached = null;
+    auth;
+    constructor(sandbox) {
+        this.auth = getAuth(sandbox);
+    }
+    /** Wire this helper into the page's auth. Call once at init. */
+    install() {
+        authSandbox.setAuthFlowResolver(this.auth, this.resolver());
+    }
+    resolver() {
+        const open = (req) => new Promise((resolve, reject) => {
+            if (this.pending)
+                this.cancel(); // one dialog at a time
+            this.pending = { req, resolve, reject };
+            this.emit();
+        });
+        return { openPopup: open, openRedirect: open };
+    }
+    // ─── view glue ──────────────────────────────────────────────────────
+    subscribe(fn) {
+        this.listeners.add(fn);
+        return () => this.listeners.delete(fn);
+    }
+    snapshot() {
+        this.cached ??= {
+            request: this.pending?.req ?? null,
+            identities: authSandbox.listIdentities(this.auth),
+        };
+        return this.cached;
+    }
+    emit() {
+        this.cached = null;
+        for (const l of this.listeners)
+            l();
+    }
+    // ─── actions ────────────────────────────────────────────────────────
+    pick(uid) {
+        const p = this.take();
+        if (!p)
+            return;
+        const id = authSandbox.listIdentities(this.auth).find((i) => i.uid === uid);
+        if (!id) {
+            p.reject(authError('auth/internal-error', `unknown identity ${uid}`));
+            return;
+        }
+        p.resolve(this.credential(id.uid, id.email, id.displayName, id.customClaims, p.req.providerId));
+    }
+    add(spec) {
+        const p = this.take();
+        if (!p)
+            return;
+        const uid = `${p.req.providerId}:${spec.email}`;
+        authSandbox.seedUsers(this.auth, [
+            {
+                uid,
+                email: spec.email,
+                password: SYNTHETIC_PASSWORD,
+                displayName: spec.displayName,
+                customClaims: spec.customClaims ?? {},
+            },
+        ]);
+        p.resolve(this.credential(uid, spec.email, spec.displayName ?? null, spec.customClaims ?? {}, p.req.providerId));
+    }
+    cancel() {
+        const p = this.take();
+        if (!p)
+            return;
+        p.reject(authError('auth/popup-closed-by-user', 'The popup has been closed by the user before finalizing the operation.'));
+    }
+    take() {
+        const p = this.pending;
+        this.pending = null;
+        this.emit();
+        return p;
+    }
+    credential(uid, email, displayName, claims, providerId) {
+        const user = {
+            uid,
+            email,
+            displayName,
+            isAnonymous: false,
+            getIdToken: async () => `pyric-serve-${uid}`,
+            getIdTokenResult: async () => ({
+                token: `pyric-serve-${uid}`,
+                claims: { sub: uid, ...claims },
+                expirationTime: new Date(Date.now() + 3600_000).toISOString(),
+                issuedAtTime: new Date().toISOString(),
+                authTime: new Date().toISOString(),
+            }),
+        };
+        return { user, providerId, operationType: 'signIn' };
+    }
+}
+function authError(code, message) {
+    const e = new Error(message);
+    e.name = 'FirebaseError';
+    e.code = code;
+    return e;
+}
+//# sourceMappingURL=auth-helper-core.js.map

package/dist/serve/entries/auth-helper-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-core.js","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,OAAO,EACP,OAAO,IAAI,WAAW,GAMvB,MAAM,YAAY,CAAC;AAgBpB,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAQzD,MAAM,OAAO,eAAe;IAClB,OAAO,GAAmB,IAAI,CAAC;IACtB,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAC3C,MAAM,GAA0B,IAAI,CAAC;IAC5B,IAAI,CAAO;IAE5B,YAAY,OAAgB;QAC1B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,gEAAgE;IAChE,OAAO;QACL,WAAW,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,CAAC,GAAoB,EAA2B,EAAE,CAC7D,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,uBAAuB;YACxD,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;QACL,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,uEAAuE;IACvE,SAAS,CAAC,EAAc;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,MAAM,KAAK;YACd,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI;YAClC,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;SAClD,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS;YAAE,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC,GAAW;QACd,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,MAAM,EAAE,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC5E,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,EAAE,oBAAoB,GAAG,EAAE,CAAC,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,GAAG,CAAC,IAAqB;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAChD,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE;YAC/B;gBACE,GAAG;gBACH,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,kBAAkB;gBAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;aACtC;SACF,CAAC,CAAC;QACH,CAAC,CAAC,OAAO,CACP,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CACtG,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,MAAM,CACN,SAAS,CACP,2BAA2B,EAC3B,wEAAwE,CACzE,CACF,CAAC;IACJ,CAAC;IAEO,IAAI;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,UAAU,CAChB,GAAW,EACX,KAAoB,EACpB,WAA0B,EAC1B,MAA+B,EAC/B,UAAkB;QAElB,MAAM,IAAI,GAAS;YACjB,GAAG;YACH,KAAK;YACL,WAAW;YACX,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,GAAG,EAAE;YAC5C,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC7B,KAAK,EAAE,eAAe,GAAG,EAAE;gBAC3B,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE;gBAC/B,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;gBAC7D,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACtC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACnC,CAAC;SACH,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;IACvD,CAAC;CACF;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAA6B,CAAC;IACzD,CAAC,CAAC,IAAI,GAAG,eAAe,CAAC;IACzB,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACd,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/serve/entries/auth-helper-dom.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The `<dialog>` shell over {@link ServeAuthHelper} — pyric dev's analog
+ * of the Auth emulator's sign-in widget. Pure-DOM (no framework): renders an
+ * account picker + an add-account form (email, display name, custom-claims
+ * JSON — emulator parity, `customAttributes`), opens when a popup/redirect
+ * request parks in the helper, closes on settle. Backdrop/Escape cancel →
+ * `auth/popup-closed-by-user` via the core.
+ *
+ * Verified through the scripted browser gate (the bun suite covers the core;
+ * this file is intentionally view-only).
+ */
+import type { ServeAuthHelper } from './auth-helper-core.js';
+export declare function mountAuthHelperDialog(helper: ServeAuthHelper): void;
+//# sourceMappingURL=auth-helper-dom.d.ts.map

package/dist/serve/entries/auth-helper-dom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-dom.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-dom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA8B7D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CA4FnE"}