pyric-tools 0.1.0-alpha.7

package/dist/serve/entries/auth-helper-dom.js

@@ -0,0 +1,116 @@
+const PROVIDER_LABEL = {
+    'google.com': 'Google',
+    'facebook.com': 'Facebook',
+    'github.com': 'GitHub',
+    'apple.com': 'Apple',
+};
+const STYLE = `
+  dialog[data-pyric-auth] { border: 1px solid #2a2a35; border-radius: 12px; background: #16161d;
+    color: #e8e8ee; font: 14px/1.45 system-ui, sans-serif; padding: 20px; width: min(420px, 92vw); }
+  dialog[data-pyric-auth]::backdrop { background: rgb(0 0 0 / 0.6); }
+  dialog[data-pyric-auth] h2 { margin: 0 0 4px; font-size: 16px; }
+  dialog[data-pyric-auth] p { margin: 0 0 14px; font-size: 12px; color: #9a9aa8; }
+  dialog[data-pyric-auth] .ids { display: grid; gap: 8px; margin-bottom: 14px; }
+  dialog[data-pyric-auth] .ids button { display: flex; gap: 10px; align-items: center; text-align: left;
+    padding: 8px 10px; border: 1px solid #2a2a35; border-radius: 8px; background: none; color: inherit; cursor: pointer; }
+  dialog[data-pyric-auth] .ids button:hover { border-color: #4a4a5a; background: rgb(255 255 255 / 0.05); }
+  dialog[data-pyric-auth] form { display: grid; gap: 8px; border-top: 1px solid #2a2a35; padding-top: 14px; }
+  dialog[data-pyric-auth] input, dialog[data-pyric-auth] textarea { background: none; color: inherit;
+    border: 1px solid #2a2a35; border-radius: 8px; padding: 8px 10px; font: inherit; }
+  dialog[data-pyric-auth] textarea { font-family: ui-monospace, monospace; font-size: 12px; }
+  dialog[data-pyric-auth] .row { display: flex; justify-content: flex-end; gap: 8px; margin-top: 6px; }
+  dialog[data-pyric-auth] .row button { padding: 8px 14px; border-radius: 8px; border: none; cursor: pointer; font: inherit; }
+  dialog[data-pyric-auth] .cancel { background: none; color: #9a9aa8; }
+  dialog[data-pyric-auth] .submit { background: #5b5bd6; color: white; }
+  dialog[data-pyric-auth] .err { color: #ff6b6b; font-size: 12px; }
+`;
+export function mountAuthHelperDialog(helper) {
+    const style = document.createElement('style');
+    style.textContent = STYLE;
+    document.head.appendChild(style);
+    const dialog = document.createElement('dialog');
+    dialog.setAttribute('data-pyric-auth', '');
+    document.body.appendChild(dialog);
+    // <dialog> cancel (Escape) + backdrop click → cancel the flow.
+    dialog.addEventListener('cancel', () => helper.cancel());
+    dialog.addEventListener('click', (e) => {
+        if (e.target === dialog)
+            helper.cancel(); // backdrop only
+    });
+    const render = () => {
+        const snap = helper.snapshot();
+        if (!snap.request) {
+            if (dialog.open)
+                dialog.close();
+            return;
+        }
+        const provider = PROVIDER_LABEL[snap.request.providerId] ?? snap.request.providerId;
+        dialog.replaceChildren();
+        const h2 = document.createElement('h2');
+        h2.textContent = `Sign in with ${provider}`;
+        const p = document.createElement('p');
+        p.textContent =
+            'pyric dev sign-in helper — pick a test account or add one. Custom claims let rules using request.auth.token.* run against this identity.';
+        dialog.append(h2, p);
+        if (snap.identities.length > 0) {
+            const ids = document.createElement('div');
+            ids.className = 'ids';
+            for (const id of snap.identities) {
+                const btn = document.createElement('button');
+                btn.type = 'button';
+                const label = id.displayName || id.email || id.uid;
+                btn.textContent = id.email && id.displayName ? `${label} — ${id.email}` : label;
+                btn.addEventListener('click', () => helper.pick(id.uid));
+                ids.appendChild(btn);
+            }
+            dialog.appendChild(ids);
+        }
+        const form = document.createElement('form');
+        form.method = 'dialog';
+        const email = document.createElement('input');
+        email.type = 'email';
+        email.placeholder = 'email@example.com';
+        email.required = true;
+        const name = document.createElement('input');
+        name.type = 'text';
+        name.placeholder = 'Display name (optional)';
+        const claims = document.createElement('textarea');
+        claims.rows = 3;
+        claims.placeholder = 'Custom claims JSON (optional)\ne.g. { "admin": true }';
+        const err = document.createElement('div');
+        err.className = 'err';
+        const row = document.createElement('div');
+        row.className = 'row';
+        const cancel = document.createElement('button');
+        cancel.type = 'button';
+        cancel.className = 'cancel';
+        cancel.textContent = 'Cancel';
+        cancel.addEventListener('click', () => helper.cancel());
+        const submit = document.createElement('button');
+        submit.type = 'submit';
+        submit.className = 'submit';
+        submit.textContent = 'Sign in';
+        row.append(cancel, submit);
+        form.append(email, name, claims, err, row);
+        form.addEventListener('submit', (e) => {
+            e.preventDefault();
+            let parsed;
+            if (claims.value.trim()) {
+                try {
+                    parsed = JSON.parse(claims.value);
+                }
+                catch {
+                    err.textContent = 'Custom claims must be valid JSON.';
+                    return;
+                }
+            }
+            helper.add({ email: email.value.trim(), displayName: name.value.trim() || undefined, customClaims: parsed });
+        });
+        dialog.appendChild(form);
+        if (!dialog.open)
+            dialog.showModal();
+    };
+    helper.subscribe(render);
+    render();
+}
+//# sourceMappingURL=auth-helper-dom.js.map

package/dist/serve/entries/auth-helper-dom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-dom.js","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-dom.ts"],"names":[],"mappings":"AAaA,MAAM,cAAc,GAA2B;IAC7C,YAAY,EAAE,QAAQ;IACtB,cAAc,EAAE,UAAU;IAC1B,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,OAAO;CACrB,CAAC;AAEF,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;CAmBb,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAElC,+DAA+D;IAC/D,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,gBAAgB;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpF,MAAM,CAAC,eAAe,EAAE,CAAC;QAEzB,MAAM,EAAE,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACxC,EAAE,CAAC,WAAW,GAAG,gBAAgB,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,WAAW;YACX,0IAA0I,CAAC;QAC7I,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAErB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC1C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC7C,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;gBACpB,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC;gBACnD,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAChF,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzD,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QACrB,KAAK,CAAC,WAAW,GAAG,mBAAmB,CAAC;QACxC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,yBAAyB,CAAC;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAChB,MAAM,CAAC,WAAW,GAAG,uDAAuD,CAAC;QAC7E,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC5B,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC;QAC9B,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC5B,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACpC,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,IAAI,MAA2C,CAAC;YAChD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAA4B,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,WAAW,GAAG,mCAAmC,CAAC;oBACtD,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzB,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IACvC,CAAC,CAAC;IAEF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC;AACX,CAAC"}

package/dist/serve/entries/auth.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The bundle the import map serves for `firebase/auth`.
+ *
+ * DUAL-PATH (Phase 3c): when a SharedWorker is available, auth routes to the
+ * ONE worker-hosted sandbox — shared user pool + data, PER-TAB sessions
+ * (#754: each tab signs in as its own user). Otherwise it runs against the
+ * in-page sandbox — the unchanged fallback. Branch picked ONCE at load
+ * (`useWorker`).
+ *
+ * PROVIDER SIGN-IN (the no-regression seam): `signInWithPopup`/
+ * `signInWithRedirect` can't cross the worker port — the `AuthFlowResolver`
+ * (and its `ServeAuthHelper` picker) live in-page. So on the worker path we
+ * RESOLVE the identity in-page (the helper, installed by `init.ts` on the
+ * in-page auth), then hand it to the worker via `acceptProviderCredential`
+ * (the `auth.acceptIdentity` op). Email/password + anonymous go straight to
+ * the worker. The COMPLETE surface is exported on both paths (import-time
+ * parity). Browser-bundled by `../bundler.ts`; never imported by node-side.
+ */
+import * as ipAuth from 'pyric/auth';
+import { getAuth as pyricGetAuth, setPersistence as pyricSetPersistence } from 'pyric/auth';
+export declare const onAuthStateChanged: typeof ipAuth.onAuthStateChanged;
+export declare const onIdTokenChanged: typeof ipAuth.onIdTokenChanged;
+export declare const signInAnonymously: typeof ipAuth.signInAnonymously;
+export declare const signInWithEmailAndPassword: typeof ipAuth.signInWithEmailAndPassword;
+export declare const createUserWithEmailAndPassword: typeof ipAuth.createUserWithEmailAndPassword;
+export declare const signOut: typeof ipAuth.signOut;
+export declare const connectAuthEmulator: typeof ipAuth.connectAuthEmulator;
+/**
+ * `updateProfile(user, { displayName?, photoURL? })` — updates the signed-in
+ * user's profile on the picked path (worker or in-page). Both `wc` and `ipAuth`
+ * export a top-level `updateProfile`; cast to the canonical `pyric/auth` shape.
+ * (Fixes #746: the served `firebase/auth` entry didn't re-export this at all.)
+ */
+export declare const updateProfile: typeof ipAuth.updateProfile;
+export declare const GoogleAuthProvider: typeof ipAuth.GoogleAuthProvider;
+export declare const EmailAuthProvider: typeof ipAuth.EmailAuthProvider;
+export declare const FacebookAuthProvider: typeof ipAuth.FacebookAuthProvider;
+export declare const GithubAuthProvider: typeof ipAuth.GithubAuthProvider;
+export declare const OAuthProvider: typeof ipAuth.OAuthProvider;
+export declare const browserLocalPersistence: ipAuth.Persistence;
+export declare const browserSessionPersistence: ipAuth.Persistence;
+export declare const inMemoryPersistence: ipAuth.Persistence;
+export declare const getAuth: typeof pyricGetAuth;
+/** `setPersistence`: selects which web storage holds THIS TAB's session (and
+ *  migrates the current one). On the worker path the record is still client-
+ *  side (#754 — per-port sessions restore via `auth.restorePortSession`); the
+ *  RPC just keeps the worker's surface-parity mode in sync. */
+export declare const setPersistence: typeof pyricSetPersistence;
+export declare const signInWithPopup: typeof ipAuth.signInWithPopup;
+/**
+ * `signInWithRedirect` over the worker resolves like popup — the pyric
+ * emulator helper does not actually navigate, so the identity is picked + the
+ * worker signs in immediately. The result is delivered through the sign-in +
+ * `onAuthStateChanged`; `getRedirectResult` returns null on the worker path
+ * (there is no deferred post-navigation result to replay). v1 behavior.
+ */
+export declare const signInWithRedirect: typeof ipAuth.signInWithRedirect;
+export declare const getRedirectResult: typeof ipAuth.getRedirectResult;
+/** Direct credential sign-in: unsupported over the worker in v1 (the
+ *  worker-client rejects with a clear error); in-page passes through. */
+export declare const signInWithCredential: typeof ipAuth.signInWithCredential;
+//# sourceMappingURL=auth.d.ts.map

package/dist/serve/entries/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,MAAM,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,cAAc,IAAI,mBAAmB,EAAE,MAAM,YAAY,CAAC;AA0B5F,eAAO,MAAM,kBAAkB,kCAAuB,CAAC;AACvD,eAAO,MAAM,gBAAgB,gCAAqB,CAAC;AACnD,eAAO,MAAM,iBAAiB,iCAAsB,CAAC;AACrD,eAAO,MAAM,0BAA0B,0CAA+B,CAAC;AACvE,eAAO,MAAM,8BAA8B,8CAAmC,CAAC;AAC/E,eAAO,MAAM,OAAO,uBAAY,CAAC;AACjC,eAAO,MAAM,mBAAmB,mCAAwB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAA4D,OAAO,MAAM,CAAC,aAAa,CAAC;AAGlH,eAAO,MAAM,kBAAkB,kCAA4B,CAAC;AAC5D,eAAO,MAAM,iBAAiB,iCAA2B,CAAC;AAC1D,eAAO,MAAM,oBAAoB,oCAA8B,CAAC;AAChE,eAAO,MAAM,kBAAkB,kCAA4B,CAAC;AAC5D,eAAO,MAAM,aAAa,6BAAuB,CAAC;AAClD,eAAO,MAAM,uBAAuB,oBAAiC,CAAC;AACtE,eAAO,MAAM,yBAAyB,oBAAmC,CAAC;AAC1E,eAAO,MAAM,mBAAmB,oBAA6B,CAAC;AAG9D,eAAO,MAAM,OAAO,EAIf,OAAO,YAAY,CAAC;AAEzB;;;+DAG+D;AAC/D,eAAO,MAAM,cAAc,EAgBtB,OAAO,mBAAmB,CAAC;AAiChC,eAAO,MAAM,eAAe,EAKvB,OAAO,MAAM,CAAC,eAAe,CAAC;AAEnC;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAK1B,OAAO,MAAM,CAAC,kBAAkB,CAAC;AAEtC,eAAO,MAAM,iBAAiB,EAIzB,OAAO,MAAM,CAAC,iBAAiB,CAAC;AAErC;yEACyE;AACzE,eAAO,MAAM,oBAAoB,EAE5B,OAAO,MAAM,CAAC,oBAAoB,CAAC"}

package/dist/serve/entries/auth.js

@@ -0,0 +1,128 @@
+/**
+ * The bundle the import map serves for `firebase/auth`.
+ *
+ * DUAL-PATH (Phase 3c): when a SharedWorker is available, auth routes to the
+ * ONE worker-hosted sandbox — shared user pool + data, PER-TAB sessions
+ * (#754: each tab signs in as its own user). Otherwise it runs against the
+ * in-page sandbox — the unchanged fallback. Branch picked ONCE at load
+ * (`useWorker`).
+ *
+ * PROVIDER SIGN-IN (the no-regression seam): `signInWithPopup`/
+ * `signInWithRedirect` can't cross the worker port — the `AuthFlowResolver`
+ * (and its `ServeAuthHelper` picker) live in-page. So on the worker path we
+ * RESOLVE the identity in-page (the helper, installed by `init.ts` on the
+ * in-page auth), then hand it to the worker via `acceptProviderCredential`
+ * (the `auth.acceptIdentity` op). Email/password + anonymous go straight to
+ * the worker. The COMPLETE surface is exported on both paths (import-time
+ * parity). Browser-bundled by `../bundler.ts`; never imported by node-side.
+ */
+import * as ipAuth from 'pyric/auth';
+import { getAuth as pyricGetAuth, setPersistence as pyricSetPersistence } from 'pyric/auth';
+import * as wcRaw from '../worker/client.js';
+import { acceptProviderCredential } from '../worker/client.js';
+import { sandbox, workerDb, useWorker, sessionStore } from './runtime.js';
+// PROVIDER ENFORCEMENT SEAM: in worker mode the page-local sandbox is only
+// the UI vehicle for popup/redirect resolution — the WORKER's provider config
+// (what Studio's toggles write) is the authority, enforced by its
+// `auth.acceptIdentity` gate. Delegate the page-local gate so the picker
+// opens for providers the worker may have enabled (the page's defaults —
+// password/anonymous only — would otherwise veto them sight unseen).
+//
+// NON-WORKER (in-page fallback) mode keeps LOCAL gating against the page
+// sandbox's own config. There is no worker to consult in that mode, so the
+// documented sandbox defaults (password/anonymous on, OAuth off until
+// `sandbox.setAuthProviderConfig`) apply honestly — a deliberate, simple leg.
+if (useWorker) {
+    ipAuth.sandbox.delegateProviderEnforcement(pyricGetAuth(sandbox), true);
+}
+// Worker-client auth, cast to the canonical pyric/auth surface for the picked
+// bindings (same names + shapes). Provider-bridge specifics are explicit below.
+const wc = wcRaw;
+/** Observers + email/anon sign-in: worker-client or in-page. */
+const A = useWorker ? wc : ipAuth;
+export const onAuthStateChanged = A.onAuthStateChanged;
+export const onIdTokenChanged = A.onIdTokenChanged;
+export const signInAnonymously = A.signInAnonymously;
+export const signInWithEmailAndPassword = A.signInWithEmailAndPassword;
+export const createUserWithEmailAndPassword = A.createUserWithEmailAndPassword;
+export const signOut = A.signOut;
+export const connectAuthEmulator = A.connectAuthEmulator;
+/**
+ * `updateProfile(user, { displayName?, photoURL? })` — updates the signed-in
+ * user's profile on the picked path (worker or in-page). Both `wc` and `ipAuth`
+ * export a top-level `updateProfile`; cast to the canonical `pyric/auth` shape.
+ * (Fixes #746: the served `firebase/auth` entry didn't re-export this at all.)
+ */
+export const updateProfile = (useWorker ? wc.updateProfile : ipAuth.updateProfile);
+// ── Provider value classes + persistence markers — path-independent ───────
+export const GoogleAuthProvider = ipAuth.GoogleAuthProvider;
+export const EmailAuthProvider = ipAuth.EmailAuthProvider;
+export const FacebookAuthProvider = ipAuth.FacebookAuthProvider;
+export const GithubAuthProvider = ipAuth.GithubAuthProvider;
+export const OAuthProvider = ipAuth.OAuthProvider;
+export const browserLocalPersistence = ipAuth.browserLocalPersistence;
+export const browserSessionPersistence = ipAuth.browserSessionPersistence;
+export const inMemoryPersistence = ipAuth.inMemoryPersistence;
+// ── getAuth — worker-backed auth (reusing the shared worker port) or in-page.
+export const getAuth = (useWorker
+    ? (_app) => wc.getAuth(workerDb)
+    : (target) => pyricGetAuth((target ?? sandbox)));
+/** `setPersistence`: selects which web storage holds THIS TAB's session (and
+ *  migrates the current one). On the worker path the record is still client-
+ *  side (#754 — per-port sessions restore via `auth.restorePortSession`); the
+ *  RPC just keeps the worker's surface-parity mode in sync. */
+export const setPersistence = (useWorker
+    ? (async (auth, persistence) => {
+        sessionStore.setMode(persistence.type);
+        return wc.setPersistence(auth, persistence);
+    })
+    : async (auth, persistence) => {
+        sessionStore.setMode(persistence.type);
+        return pyricSetPersistence(auth, persistence);
+    });
+// ── Provider sign-in (popup/redirect) — the in-page→worker bridge ─────────
+/**
+ * Resolve a provider identity IN-PAGE (the ServeAuthHelper picker, via the
+ * in-page auth's installed AuthFlowResolver), then hand it to the worker. The
+ * helper seeds `{ sub, ...claims }` into the resolved credential's token, so we
+ * strip `sub` to recover the original custom claims for the worker seed.
+ *
+ * Enforcement lives at the hand-off: `auth.acceptIdentity` gates against the
+ * WORKER's provider config and rejects `auth/operation-not-allowed` for a
+ * disabled provider (matching prod, where the popup opens and the error
+ * surfaces after the interaction). The page-local gate is delegated above.
+ */
+async function bridgeProviderSignIn(provider) {
+    const inPageAuth = pyricGetAuth(sandbox);
+    const cred = await ipAuth.signInWithPopup(inPageAuth, provider);
+    const tokenResult = await cred.user.getIdTokenResult();
+    const { sub: _sub, ...customClaims } = (tokenResult.claims ?? {});
+    const providerId = cred.providerId ?? provider.providerId ?? 'oidc';
+    return acceptProviderCredential(wc.getAuth(workerDb), {
+        uid: cred.user.uid,
+        email: cred.user.email,
+        displayName: cred.user.displayName,
+        customClaims,
+        providerId,
+    });
+}
+export const signInWithPopup = (useWorker
+    ? (_auth, provider) => bridgeProviderSignIn(provider)
+    : ipAuth.signInWithPopup);
+/**
+ * `signInWithRedirect` over the worker resolves like popup — the pyric
+ * emulator helper does not actually navigate, so the identity is picked + the
+ * worker signs in immediately. The result is delivered through the sign-in +
+ * `onAuthStateChanged`; `getRedirectResult` returns null on the worker path
+ * (there is no deferred post-navigation result to replay). v1 behavior.
+ */
+export const signInWithRedirect = (useWorker
+    ? (_auth, provider) => bridgeProviderSignIn(provider)
+    : ipAuth.signInWithRedirect);
+export const getRedirectResult = (useWorker
+    ? async (_auth) => null
+    : ipAuth.getRedirectResult);
+/** Direct credential sign-in: unsupported over the worker in v1 (the
+ *  worker-client rejects with a clear error); in-page passes through. */
+export const signInWithCredential = (useWorker ? wc.signInWithCredential : ipAuth.signInWithCredential);
+//# sourceMappingURL=auth.js.map

package/dist/serve/entries/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/serve/entries/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,MAAM,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,cAAc,IAAI,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE1E,2EAA2E;AAC3E,8EAA8E;AAC9E,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,8EAA8E;AAC9E,IAAI,SAAS,EAAE,CAAC;IACd,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,EAAE,GAAG,KAAiC,CAAC;AAE7C,gEAAgE;AAChE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAClC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,0BAA0B,CAAC;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,8BAA8B,CAAC;AAC/E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAgC,CAAC;AAElH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;AAClD,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,CAAC;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;AAE9D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,SAAS;IACP,CAAC,CAAC,CAAC,IAAc,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,QAAiB,CAAC;IACnD,CAAC,CAAC,CAAC,MAA2C,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,IAAI,OAAO,CAAU,CAAC,CACzE,CAAC;AAEzB;;;+DAG+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAS;IACP,CAAC,CAAC,CAAC,KAAK,EACJ,IAA+C,EAC/C,WAAsD,EACtD,EAAE;QACF,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,OAAQ,EAAE,CAAC,cAA6C,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC;IACJ,CAAC,CAAC,KAAK,EACH,IAA+C,EAC/C,WAAsD,EACtD,EAAE;QACF,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC,CACwB,CAAC;AAEhC,6EAA6E;AAE7E;;;;;;;;;;GAUG;AACH,KAAK,UAAU,oBAAoB,CACjC,QAAsD;IAEtD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACvD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IAC7F,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAK,QAAoC,CAAC,UAAU,IAAI,MAAM,CAAC;IAChF,OAAO,wBAAwB,CAAC,EAAE,CAAC,OAAO,CAAC,QAAiB,CAAU,EAAE;QACtE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;QAClB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;QACtB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;QAClC,YAAY;QACZ,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,SAAS;IACP,CAAC,CAAC,CAAC,KAAc,EAAE,QAAsD,EAAE,EAAE,CACzE,oBAAoB,CAAC,QAAQ,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,eAAe,CACM,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAAS;IACP,CAAC,CAAC,CAAC,KAAc,EAAE,QAAyD,EAAE,EAAE,CAC5E,oBAAoB,CAAC,QAAQ,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CACM,CAAC;AAEtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,SAAS;IACP,CAAC,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE,CAAC,IAAI;IACjC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACM,CAAC;AAErC;yEACyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAC5B,CAAC"}

package/dist/serve/entries/bridge-url.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Re-anchor a bridge WebSocket URL to the page's own origin.
+ *
+ * `pyric dev` / the vite plugin bake their OWN host into the bridge URL it
+ * sends the page (e.g. `ws://localhost:5173/__pyric/sandbox`). But the page may
+ * have been loaded over a different host (Tailscale, a LAN IP) or scheme
+ * (`https` via `tailscale serve`, which then requires `wss`). Connecting to the
+ * baked `localhost` from a remote tab dials the WRONG machine (the client's own
+ * localhost), so the WS fails.
+ *
+ * Keep only the PATH from the server's URL and rebuild the scheme + host from the
+ * page's `location`. The bridge is always mounted on the same server that served
+ * the page, so the page's origin is the correct target wherever it is reached,
+ * with no plugin configuration. This also sidesteps the localhost / 127.0.0.1 /
+ * ::1 family ambiguity, because the browser dials the exact host it loaded from.
+ *
+ * Pure (location is injected) so it is unit-testable. Returns `raw` unchanged if
+ * it cannot be parsed.
+ */
+export declare function toPageOriginWsUrl(raw: string, loc: {
+    href: string;
+    protocol: string;
+    host: string;
+}): string;
+//# sourceMappingURL=bridge-url.d.ts.map

package/dist/serve/entries/bridge-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-url.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/bridge-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpD,MAAM,CAQR"}

package/dist/serve/entries/bridge-url.js

@@ -0,0 +1,30 @@
+/**
+ * Re-anchor a bridge WebSocket URL to the page's own origin.
+ *
+ * `pyric dev` / the vite plugin bake their OWN host into the bridge URL it
+ * sends the page (e.g. `ws://localhost:5173/__pyric/sandbox`). But the page may
+ * have been loaded over a different host (Tailscale, a LAN IP) or scheme
+ * (`https` via `tailscale serve`, which then requires `wss`). Connecting to the
+ * baked `localhost` from a remote tab dials the WRONG machine (the client's own
+ * localhost), so the WS fails.
+ *
+ * Keep only the PATH from the server's URL and rebuild the scheme + host from the
+ * page's `location`. The bridge is always mounted on the same server that served
+ * the page, so the page's origin is the correct target wherever it is reached,
+ * with no plugin configuration. This also sidesteps the localhost / 127.0.0.1 /
+ * ::1 family ambiguity, because the browser dials the exact host it loaded from.
+ *
+ * Pure (location is injected) so it is unit-testable. Returns `raw` unchanged if
+ * it cannot be parsed.
+ */
+export function toPageOriginWsUrl(raw, loc) {
+    try {
+        const path = new URL(raw, loc.href).pathname;
+        const scheme = loc.protocol === 'https:' ? 'wss:' : 'ws:';
+        return `${scheme}//${loc.host}${path}`;
+    }
+    catch {
+        return raw;
+    }
+}
+//# sourceMappingURL=bridge-url.js.map

package/dist/serve/entries/bridge-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-url.js","sourceRoot":"","sources":["../../../src/serve/entries/bridge-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,GAAqD;IAErD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,OAAO,GAAG,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/serve/entries/database.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The bundle the import map serves for `firebase/database`.
+ *
+ * The SharedWorker client already carries the RTDB data-plane used by Studio
+ * and the Playground. This entry gives served apps the same common modular SDK
+ * surface while the in-page fallback delegates to `pyric/database`.
+ */
+import * as ip from 'pyric/database/modular';
+import { getDatabase as pyricGetDatabase } from 'pyric/database/modular';
+export declare const getDatabase: typeof pyricGetDatabase;
+export declare const ref: typeof ip.ref;
+export declare const child: typeof ip.child;
+export declare const get: typeof ip.get;
+export declare const set: typeof ip.set;
+export declare const update: typeof ip.update;
+export declare const remove: typeof ip.remove;
+export declare const push: typeof ip.push;
+export declare const onValue: typeof ip.onValue;
+export declare const off: typeof ip.off;
+export declare const serverTimestamp: typeof ip.serverTimestamp;
+export declare const connectDatabaseEmulator: typeof ip.connectDatabaseEmulator;
+export declare const runTransaction: typeof ip.runTransaction;
+export declare const query: typeof ip.query;
+export declare const orderByChild: typeof ip.orderByChild;
+export declare const orderByKey: typeof ip.orderByKey;
+export declare const orderByValue: typeof ip.orderByValue;
+export declare const startAt: typeof ip.startAt;
+export declare const startAfter: typeof ip.startAfter;
+export declare const endAt: typeof ip.endAt;
+export declare const endBefore: typeof ip.endBefore;
+export declare const equalTo: typeof ip.equalTo;
+export declare const limitToFirst: typeof ip.limitToFirst;
+export declare const limitToLast: typeof ip.limitToLast;
+//# sourceMappingURL=database.d.ts.map

package/dist/serve/entries/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/database.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC7C,OAAO,EAAE,WAAW,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAiBzE,eAAO,MAAM,WAAW,EAKnB,OAAO,gBAAgB,CAAC;AAE7B,eAAO,MAAM,GAAG,EAAqC,OAAO,EAAE,CAAC,GAAG,CAAC;AACnE,eAAO,MAAM,KAAK,EAAyC,OAAO,EAAE,CAAC,KAAK,CAAC;AAC3E,eAAO,MAAM,GAAG,EAAqC,OAAO,EAAE,CAAC,GAAG,CAAC;AACnE,eAAO,MAAM,GAAG,EAAqC,OAAO,EAAE,CAAC,GAAG,CAAC;AACnE,eAAO,MAAM,MAAM,EAA2C,OAAO,EAAE,CAAC,MAAM,CAAC;AAC/E,eAAO,MAAM,MAAM,EAA2C,OAAO,EAAE,CAAC,MAAM,CAAC;AAC/E,eAAO,MAAM,IAAI,EAAuC,OAAO,EAAE,CAAC,IAAI,CAAC;AACvE,eAAO,MAAM,OAAO,EAA6C,OAAO,EAAE,CAAC,OAAO,CAAC;AACnF,eAAO,MAAM,GAAG,EAAqC,OAAO,EAAE,CAAC,GAAG,CAAC;AACnE,eAAO,MAAM,eAAe,EAEvB,OAAO,EAAE,CAAC,eAAe,CAAC;AAC/B,eAAO,MAAM,uBAAuB,EAE/B,OAAO,EAAE,CAAC,uBAAuB,CAAC;AASvC,eAAO,MAAM,cAAc,EAEtB,OAAO,EAAE,CAAC,cAAc,CAAC;AAE9B,eAAO,MAAM,KAAK,EAEb,OAAO,EAAE,CAAC,KAAK,CAAC;AACrB,eAAO,MAAM,YAAY,EAEpB,OAAO,EAAE,CAAC,YAAY,CAAC;AAC5B,eAAO,MAAM,UAAU,EAElB,OAAO,EAAE,CAAC,UAAU,CAAC;AAC1B,eAAO,MAAM,YAAY,EAEpB,OAAO,EAAE,CAAC,YAAY,CAAC;AAC5B,eAAO,MAAM,OAAO,EAEf,OAAO,EAAE,CAAC,OAAO,CAAC;AACvB,eAAO,MAAM,UAAU,EAElB,OAAO,EAAE,CAAC,UAAU,CAAC;AAC1B,eAAO,MAAM,KAAK,EAEb,OAAO,EAAE,CAAC,KAAK,CAAC;AACrB,eAAO,MAAM,SAAS,EAEjB,OAAO,EAAE,CAAC,SAAS,CAAC;AACzB,eAAO,MAAM,OAAO,EAEf,OAAO,EAAE,CAAC,OAAO,CAAC;AACvB,eAAO,MAAM,YAAY,EAEpB,OAAO,EAAE,CAAC,YAAY,CAAC;AAC5B,eAAO,MAAM,WAAW,EAEnB,OAAO,EAAE,CAAC,WAAW,CAAC"}

package/dist/serve/entries/database.js

@@ -0,0 +1,42 @@
+/**
+ * The bundle the import map serves for `firebase/database`.
+ *
+ * The SharedWorker client already carries the RTDB data-plane used by Studio
+ * and the Playground. This entry gives served apps the same common modular SDK
+ * surface while the in-page fallback delegates to `pyric/database`.
+ */
+import * as ip from 'pyric/database/modular';
+import { getDatabase as pyricGetDatabase } from 'pyric/database/modular';
+import { rtdbChild, rtdbConnectDatabaseEmulator, rtdbGet, rtdbGetDatabase, rtdbOff, rtdbOnValue, rtdbPush, rtdbRef, rtdbRemove, rtdbServerTimestamp, rtdbSet, rtdbUpdate, } from '../worker/client.js';
+import { sandbox, workerDb, useWorker } from './runtime.js';
+export const getDatabase = (useWorker
+    ? (_app) => rtdbGetDatabase(workerDb)
+    : (target) => pyricGetDatabase((target ?? sandbox)));
+export const ref = (useWorker ? rtdbRef : ip.ref);
+export const child = (useWorker ? rtdbChild : ip.child);
+export const get = (useWorker ? rtdbGet : ip.get);
+export const set = (useWorker ? rtdbSet : ip.set);
+export const update = (useWorker ? rtdbUpdate : ip.update);
+export const remove = (useWorker ? rtdbRemove : ip.remove);
+export const push = (useWorker ? rtdbPush : ip.push);
+export const onValue = (useWorker ? rtdbOnValue : ip.onValue);
+export const off = (useWorker ? rtdbOff : ip.off);
+export const serverTimestamp = (useWorker ? rtdbServerTimestamp : ip.serverTimestamp);
+export const connectDatabaseEmulator = (useWorker ? rtdbConnectDatabaseEmulator : ip.connectDatabaseEmulator);
+function unsupportedWorkerApi(name) {
+    throw new Error(`firebase/database ${name}() is not supported over the pyric SharedWorker yet. ` +
+        'Use the in-page fallback for this operation.');
+}
+export const runTransaction = (useWorker ? (() => unsupportedWorkerApi('runTransaction')) : ip.runTransaction);
+export const query = (useWorker ? (() => unsupportedWorkerApi('query')) : ip.query);
+export const orderByChild = (useWorker ? (() => unsupportedWorkerApi('orderByChild')) : ip.orderByChild);
+export const orderByKey = (useWorker ? (() => unsupportedWorkerApi('orderByKey')) : ip.orderByKey);
+export const orderByValue = (useWorker ? (() => unsupportedWorkerApi('orderByValue')) : ip.orderByValue);
+export const startAt = (useWorker ? (() => unsupportedWorkerApi('startAt')) : ip.startAt);
+export const startAfter = (useWorker ? (() => unsupportedWorkerApi('startAfter')) : ip.startAfter);
+export const endAt = (useWorker ? (() => unsupportedWorkerApi('endAt')) : ip.endAt);
+export const endBefore = (useWorker ? (() => unsupportedWorkerApi('endBefore')) : ip.endBefore);
+export const equalTo = (useWorker ? (() => unsupportedWorkerApi('equalTo')) : ip.equalTo);
+export const limitToFirst = (useWorker ? (() => unsupportedWorkerApi('limitToFirst')) : ip.limitToFirst);
+export const limitToLast = (useWorker ? (() => unsupportedWorkerApi('limitToLast')) : ip.limitToLast);
+//# sourceMappingURL=database.js.map

package/dist/serve/entries/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../src/serve/entries/database.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC7C,OAAO,EAAE,WAAW,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,OAAO,EACP,eAAe,EACf,OAAO,EACP,WAAW,EACX,QAAQ,EACR,OAAO,EACP,UAAU,EACV,mBAAmB,EACnB,OAAO,EACP,UAAU,GACX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,SAAS;IACP,CAAC,CAAC,CAAC,IAAc,EAAE,EAAE,CAAC,eAAe,CAAC,QAAS,CAAC;IAChD,CAAC,CAAC,CAAC,MAA+C,EAAE,EAAE,CAClD,gBAAgB,CAAC,CAAC,MAAM,IAAI,OAAO,CAAU,CAAC,CAC1B,CAAC;AAE7B,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAkB,CAAC;AACnE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAoB,CAAC;AAC3E,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAkB,CAAC;AACnE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAkB,CAAC;AACnE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAqB,CAAC;AAC/E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAqB,CAAC;AAC/E,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAmB,CAAC;AACvE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAsB,CAAC;AACnF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAkB,CAAC;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CACxB,CAAC;AAC/B,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAChC,CAAC;AAEvC,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,uDAAuD;QAC9E,8CAA8C,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CACnD,CAAC;AAE9B,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAC1C,CAAC;AACrB,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CACjD,CAAC;AAC5B,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAC/C,CAAC;AAC1B,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CACjD,CAAC;AAC5B,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAC5C,CAAC;AACvB,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAC/C,CAAC;AAC1B,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAC1C,CAAC;AACrB,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAC9C,CAAC;AACzB,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAC5C,CAAC;AACvB,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CACjD,CAAC;AAC5B,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAChD,CAAC"}

package/dist/serve/entries/firestore.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The bundle the import map serves for `firebase/firestore`.
+ *
+ * DUAL-PATH (Phase 3c): when a SharedWorker is available, the data ops route
+ * to the ONE worker-hosted sandbox (multi-tab sync + IDB/`--persist`
+ * durability); otherwise they run against the in-page sandbox — the unchanged
+ * fallback. The branch is picked ONCE at module load (`useWorker`).
+ *
+ * The COMPLETE modular surface is exported on BOTH paths: a missing named
+ * export fails the page at import time (the firebase/app failure class), so the
+ * worker path fills the functions the thin worker-client lacks (`or`/`and`,
+ * `Timestamp`, the client-cache config no-ops) right here.
+ *
+ * Browser-bundled by `../bundler.ts`; never imported by node-side code.
+ */
+import * as ip from 'pyric/firestore';
+import { getFirestore as pyricGetFirestore } from 'pyric/firestore';
+export declare const onSnapshot: typeof ip.onSnapshot;
+export declare const collection: typeof ip.collection;
+export declare const collectionGroup: typeof ip.collectionGroup;
+export declare const doc: typeof ip.doc;
+export declare const getDoc: typeof ip.getDoc;
+export declare const getDocs: typeof ip.getDocs;
+export declare const setDoc: typeof ip.setDoc;
+export declare const addDoc: typeof ip.addDoc;
+export declare const updateDoc: typeof ip.updateDoc;
+export declare const deleteDoc: typeof ip.deleteDoc;
+export declare const query: typeof ip.query;
+export declare const where: typeof ip.where;
+export declare const orderBy: typeof ip.orderBy;
+export declare const limit: typeof ip.limit;
+export declare const limitToLast: typeof ip.limitToLast;
+export declare const startAt: typeof ip.startAt;
+export declare const startAfter: typeof ip.startAfter;
+export declare const endAt: typeof ip.endAt;
+export declare const endBefore: typeof ip.endBefore;
+export declare const runTransaction: typeof ip.runTransaction;
+export declare const writeBatch: typeof ip.writeBatch;
+export declare const serverTimestamp: typeof ip.serverTimestamp;
+export declare const increment: typeof ip.increment;
+export declare const arrayUnion: typeof ip.arrayUnion;
+export declare const arrayRemove: typeof ip.arrayRemove;
+export declare const deleteField: typeof ip.deleteField;
+export declare const Timestamp: typeof ip.Timestamp;
+export declare const or: typeof ip.or;
+export declare const and: typeof ip.and;
+export declare const getFirestore: typeof pyricGetFirestore;
+/** firebase's sentinel value, re-exported for settings parity. */
+export declare const CACHE_SIZE_UNLIMITED = -1;
+export declare function initializeFirestore(app?: Parameters<typeof pyricGetFirestore>[0], settings?: unknown): ReturnType<typeof getFirestore>;
+export declare function persistentLocalCache(_settings?: unknown): {
+    kind: string;
+};
+export declare function memoryLocalCache(_settings?: unknown): {
+    kind: string;
+};
+export declare function persistentSingleTabManager(_settings?: unknown): {
+    kind: string;
+};
+export declare function persistentMultipleTabManager(): {
+    kind: string;
+};
+export declare function enableIndexedDbPersistence(_db?: unknown): Promise<void>;
+export declare function clearIndexedDbPersistence(_db?: unknown): Promise<void>;
+/** Resolves immediately — sandbox writes apply synchronously in-page; over the
+ *  worker the RPC ack already settled (judgment zone 4, recorded). */
+export declare function waitForPendingWrites(_db?: unknown): Promise<void>;
+//# sourceMappingURL=firestore.d.ts.map

package/dist/serve/entries/firestore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/firestore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAcpE,eAAO,MAAM,UAAU,sBAAe,CAAC;AACvC,eAAO,MAAM,UAAU,sBAAe,CAAC;AACvC,eAAO,MAAM,eAAe,2BAAoB,CAAC;AACjD,eAAO,MAAM,GAAG,eAAQ,CAAC;AACzB,eAAO,MAAM,MAAM,kBAAW,CAAC;AAC/B,eAAO,MAAM,OAAO,mBAAY,CAAC;AACjC,eAAO,MAAM,MAAM,kBAAW,CAAC;AAC/B,eAAO,MAAM,MAAM,kBAAW,CAAC;AAC/B,eAAO,MAAM,SAAS,qBAAc,CAAC;AACrC,eAAO,MAAM,SAAS,qBAAc,CAAC;AACrC,eAAO,MAAM,KAAK,iBAAU,CAAC;AAC7B,eAAO,MAAM,KAAK,iBAAU,CAAC;AAC7B,eAAO,MAAM,OAAO,mBAAY,CAAC;AACjC,eAAO,MAAM,KAAK,iBAAU,CAAC;AAC7B,eAAO,MAAM,WAAW,uBAAgB,CAAC;AACzC,eAAO,MAAM,OAAO,mBAAY,CAAC;AACjC,eAAO,MAAM,UAAU,sBAAe,CAAC;AACvC,eAAO,MAAM,KAAK,iBAAU,CAAC;AAC7B,eAAO,MAAM,SAAS,qBAAc,CAAC;AACrC,eAAO,MAAM,cAAc,0BAAmB,CAAC;AAC/C,eAAO,MAAM,UAAU,sBAAe,CAAC;AACvC,eAAO,MAAM,eAAe,2BAAoB,CAAC;AACjD,eAAO,MAAM,SAAS,qBAAc,CAAC;AACrC,eAAO,MAAM,UAAU,sBAAe,CAAC;AACvC,eAAO,MAAM,WAAW,uBAAgB,CAAC;AACzC,eAAO,MAAM,WAAW,uBAAgB,CAAC;AAIzC,eAAO,MAAM,SAAS,qBAAe,CAAC;AAYtC,eAAO,MAAM,EAAE,EAA+D,OAAO,EAAE,CAAC,EAAE,CAAC;AAC3F,eAAO,MAAM,GAAG,EAAiE,OAAO,EAAE,CAAC,GAAG,CAAC;AAI/F,eAAO,MAAM,YAAY,EAKpB,OAAO,iBAAiB,CAAC;AAmB9B,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,wBAAgB,mBAAmB,CACjC,GAAG,CAAC,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAC7C,QAAQ,CAAC,EAAE,OAAO,GACjB,UAAU,CAAC,OAAO,YAAY,CAAC,CAGjC;AAED,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAG1E;AAED,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAEtE;AAED,wBAAgB,0BAA0B,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAEhF;AAED,wBAAgB,4BAA4B,IAAI;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAE/D;AAED,wBAAsB,0BAA0B,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED,wBAAsB,yBAAyB,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED;sEACsE;AACtE,wBAAsB,oBAAoB,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAG"}