pyric-tools 0.1.0-alpha.7

package/dist/serve/worker/host-auth.js

@@ -0,0 +1,434 @@
+/**
+ * SharedWorker host — auth subsystem: PER-PORT SESSIONS (#754).
+ *
+ * The worker hosts ONE sandbox (one user pool, one data store, one ruleset)
+ * but each connected port (tab / client) owns its OWN session: sign-ins mint
+ * an authentic identity via `sandbox.mintSession` (credentials validated /
+ * identity really created — NOT the impersonation lens) and bind it to the
+ * port. Auth-state fan-out is port-scoped: tab A signing in does not fire
+ * tab B's `onAuthStateChanged`. Data ops without an explicit Studio lens
+ * run under the port's session (see `sessionDb` in host.ts).
+ *
+ * Session persistence is CLIENT-side: the page records its uid in web
+ * storage (SessionStore, honoring setPersistence) and re-establishes it on
+ * reload via the `auth.restorePortSession` op. The worker holds no session
+ * record — the user POOL still rides the sandbox snapshot (#629).
+ *
+ * Imports only from `./host-context.js` + external packages (no circular
+ * imports).
+ */
+import { post, ok, fail, bestEffortFlush } from './host-context.js';
+import { getAuth, sandbox as authSandboxOps, } from 'pyric/auth';
+import { serializeUser, } from './protocol.js';
+/**
+ * Synthetic password seeded for bridged provider identities (popup/redirect).
+ * Provider users never authenticate with a password — this just satisfies the
+ * SeedUser shape. Matches `ServeAuthHelper`'s in-page constant in spirit.
+ */
+const PROVIDER_SYNTHETIC_PASSWORD = '__pyric_popup_no_password__';
+// ─── Auth: per-port sessions + port-scoped fan-out ────────────────────────
+/**
+ * Per-port auth subscription registry. Map<port, Map<subId, target>>.
+ *
+ * SEPARATE FROM `ctx.subs` (Firestore listeners): auth subs are routing
+ * entries only. With per-port sessions there is no worker-wide auth
+ * listener at all — a port's session changes fan out to THAT port's subs
+ * (see {@link setPortSession}).
+ */
+const _authSubs = new WeakMap();
+export function authSubsFor(ctx) {
+    let m = _authSubs.get(ctx);
+    if (!m) {
+        m = new Map();
+        _authSubs.set(ctx, m);
+    }
+    return m;
+}
+/**
+ * Lazily create the ONE shared auth handle — the user pool + admin surface.
+ * Calling `getAuth(sandbox)` also (re)registers the auth service with the
+ * persistence registry, so the user DB rides the snapshot (#629). Its
+ * `currentUser` is never set in served mode; sessions live per-port.
+ *
+ * Idempotent: returns the cached `ctx.auth` on repeat calls.
+ */
+export function ensureAuth(ctx) {
+    if (ctx.auth)
+        return ctx.auth;
+    ctx.auth = getAuth(ctx.sandbox);
+    if (ctx.sessionMode === undefined)
+        ctx.sessionMode = 'LOCAL';
+    return ctx.auth;
+}
+function portSessionsFor(ctx) {
+    return (ctx.portSessions ??= new Map());
+}
+/** The port's signed-in session, or null (absent from the map = signed out). */
+export function portSession(ctx, port) {
+    return portSessionsFor(ctx).get(port) ?? null;
+}
+/**
+ * Bind (or clear) a port's session and fan the change out to THAT PORT's
+ * authState/idToken subs — the per-port analog of the old cross-tab
+ * broadcast. Every sign-in mints a fresh token (mintSession did), so the
+ * idToken stream fires alongside authState, matching the real observers.
+ */
+function setPortSession(ctx, port, session) {
+    portSessionsFor(ctx).set(port, session);
+    // Prod parity on auth transitions: re-establish this port's session-bound
+    // Firestore listeners under the NEW identity, so a sign-out re-evaluates
+    // live streams (auth-gated data is revoked, not leaked) and a sign-in
+    // grants them. Studio-lens subs (explicit actAs) are untouched.
+    ctx.resubscribePortSubs?.(port);
+    const serialized = serializeUser(session?.user ?? null);
+    const bySubId = authSubsFor(ctx).get(port);
+    if (!bySubId)
+        return;
+    for (const [subId] of bySubId) {
+        post(port, { t: 'snap', subId, value: serialized });
+    }
+}
+/** Tear down a disconnected port's session (called from cleanupPort). */
+export function cleanupPortSession(ctx, port) {
+    ctx.portSessions?.delete(port);
+}
+// ─── Auth op handlers ─────────────────────────────────────────────────────
+/** Serialized UserCredential reply shape for a minted session. */
+function credReply(session, providerId) {
+    return {
+        user: serializeUser(session.user),
+        providerId,
+        operationType: 'signIn',
+    };
+}
+export async function handleAuthOp(ctx, port, msg) {
+    const auth = ensureAuth(ctx);
+    switch (msg.method) {
+        case 'auth.createUser': {
+            try {
+                const session = authSandboxOps.mintSession(auth, {
+                    kind: 'createPassword', email: msg.email, password: msg.password,
+                });
+                setPortSession(ctx, port, session);
+                await bestEffortFlush(ctx); // new user record must be durable at ack
+                ok(port, msg.id, credReply(session, null));
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.signInEmail': {
+            try {
+                const session = authSandboxOps.mintSession(auth, {
+                    kind: 'password', email: msg.email, password: msg.password,
+                });
+                setPortSession(ctx, port, session);
+                ok(port, msg.id, credReply(session, null));
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.signInAnonymously': {
+            try {
+                // Match `firebase/auth` semantics per session: if THIS PORT is
+                // already anonymous, reuse that identity (StrictMode double-mounts
+                // must not leak a fresh uid per mount). Other ports' anonymous
+                // sessions are other users — that's the multi-user point.
+                const existing = portSession(ctx, port);
+                if (existing && existing.user.isAnonymous) {
+                    ok(port, msg.id, credReply(existing, null));
+                    break;
+                }
+                const session = authSandboxOps.mintSession(auth, { kind: 'anonymous' });
+                setPortSession(ctx, port, session);
+                await bestEffortFlush(ctx); // anonymous sign-in creates a user record
+                ok(port, msg.id, credReply(session, null));
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.signOut': {
+            try {
+                setPortSession(ctx, port, null);
+                ok(port, msg.id, null);
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.restorePortSession': {
+            // Per-tab reload restore (#754): soft — an unknown/disabled uid means
+            // signed out (null), never an error. The page clears its stale record.
+            try {
+                let session = null;
+                try {
+                    session = authSandboxOps.mintSession(auth, { kind: 'uid', uid: msg.uid });
+                }
+                catch {
+                    session = null;
+                }
+                if (session)
+                    setPortSession(ctx, port, session);
+                ok(port, msg.id, session ? serializeUser(session.user) : null);
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.getIdToken': {
+            try {
+                const user = requireSessionUser(ctx, port, 'getIdToken');
+                const token = await user.getIdToken(msg.forceRefresh);
+                ok(port, msg.id, token);
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.getIdTokenResult': {
+            try {
+                const user = requireSessionUser(ctx, port, 'getIdTokenResult');
+                const r = await user.getIdTokenResult(msg.forceRefresh);
+                ok(port, msg.id, {
+                    token: r.token,
+                    claims: r.claims,
+                    expirationTime: r.expirationTime,
+                    issuedAtTime: r.issuedAtTime,
+                    authTime: r.authTime,
+                    signInProvider: r.signInProvider ?? null,
+                });
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.setPersistence': {
+            // Accepted for surface parity; the CLIENT's SessionStore owns where
+            // (or whether) the session uid is recorded. Nothing to do worker-side.
+            ctx.sessionMode = msg.mode;
+            ok(port, msg.id, null);
+            break;
+        }
+        case 'auth.getCurrentUser': {
+            try {
+                ok(port, msg.id, serializeUser(portSession(ctx, port)?.user ?? null));
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.updateProfile': {
+            // Update THIS PORT's signed-in user's profile (displayName / photoURL).
+            // Updates the stored record (by uid) via the sandbox op, then mutates the
+            // port session's `User` in place so a subsequent `auth.getCurrentUser`
+            // (and the client mirror hydrated from the reply) is consistent. Does NOT
+            // fire onAuthStateChanged/onIdTokenChanged — matching firebase/auth.
+            try {
+                const session = portSession(ctx, port);
+                if (!session)
+                    throw makeNoUserError('updateProfile');
+                const profile = { displayName: msg.displayName, photoURL: msg.photoURL };
+                authSandboxOps.updateProfile(auth, session.user.uid, profile);
+                applyProfileToUser(session.user, profile);
+                await bestEffortFlush(ctx);
+                ok(port, msg.id, serializeUser(session.user));
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.acceptIdentity': {
+            // Provider sign-in bridge: the page resolved a popup/redirect identity
+            // in-page (ServeAuthHelper) and hands it here. GATE FIRST: the page
+            // sandbox delegates provider enforcement to this worker (its picker
+            // opens unconditionally), so THIS is where Studio's provider toggles
+            // bite — a disabled provider throws `auth/operation-not-allowed`
+            // before any user-DB write. Then seed it into the user DB (so rules
+            // `request.auth.token.*` claims resolve AND it shows in the picker
+            // next time), and mint THIS PORT's session for it — provider users
+            // have no password. Mirrors ServeAuthHelper.add's seeding.
+            try {
+                const { uid, email, displayName, customClaims, providerId } = msg.identity;
+                authSandboxOps.assertAuthProviderEnabled(auth, providerId);
+                authSandboxOps.seedUsers(auth, [{
+                        uid,
+                        email: email ?? '',
+                        password: PROVIDER_SYNTHETIC_PASSWORD,
+                        displayName: displayName ?? undefined,
+                        customClaims: customClaims ?? {},
+                        providerId,
+                    }]);
+                const session = authSandboxOps.mintSession(auth, { kind: 'uid', uid });
+                setPortSession(ctx, port, session);
+                await bestEffortFlush(ctx); // seeded provider identity must be durable
+                ok(port, msg.id, credReply(session, providerId));
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.listUsers': {
+            // Admin user-DB enumeration (Pyric Studio data browse).
+            try {
+                ok(port, msg.id, authSandboxOps.listUsers(auth));
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.adminCreateUser': {
+            try {
+                const created = authSandboxOps.createUser(auth, msg.request);
+                await bestEffortFlush(ctx);
+                ok(port, msg.id, created);
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.adminUpdateUser': {
+            try {
+                const updated = authSandboxOps.updateUser(auth, msg.uid, msg.request);
+                await bestEffortFlush(ctx);
+                ok(port, msg.id, updated);
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.adminDeleteUser': {
+            try {
+                authSandboxOps.deleteUser(auth, msg.uid);
+                await bestEffortFlush(ctx);
+                ok(port, msg.id, null);
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.adminClearUsers': {
+            try {
+                authSandboxOps.clearUsers(auth);
+                await bestEffortFlush(ctx);
+                ok(port, msg.id, null);
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.getProviderConfig': {
+            // Sign-in provider config (Pyric Studio S-AUTH "Sign-in providers"
+            // section). `setProviderConfig` emits a `provider_config_update`
+            // sandbox event, so a caller subscribed to the event stream (the
+            // worker's event feed, which `subscribeUsers` already rides) sees
+            // toggles live without a dedicated subscription message here.
+            try {
+                ok(port, msg.id, authSandboxOps.getAuthProviderConfig(auth));
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'auth.setProviderConfig': {
+            try {
+                authSandboxOps.setAuthProviderConfig(auth, msg.providerId, msg.enabled);
+                ok(port, msg.id, null);
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        default: {
+            fail(port, msg.id, new Error(`Unknown auth method: ${String(msg.method)}`));
+        }
+    }
+}
+/** The port session's User, or throw `auth/no-current-user`. */
+function requireSessionUser(ctx, port, api) {
+    const session = portSession(ctx, port);
+    if (!session)
+        throw makeNoUserError(api);
+    return session.user;
+}
+/**
+ * Mutate a port session's `User` `displayName` / `photoURL` (and the first
+ * `providerData` entry's) in place so a subsequent `auth.getCurrentUser`
+ * reflects an `auth.updateProfile`. Fields are `readonly` at the type level
+ * but plain data at runtime; only an explicitly-provided field is applied
+ * (`null` clears, `undefined` leaves untouched).
+ */
+function applyProfileToUser(user, profile) {
+    const mutable = user;
+    if (profile.displayName !== undefined)
+        mutable.displayName = profile.displayName;
+    if (profile.photoURL !== undefined)
+        mutable.photoURL = profile.photoURL;
+    const provider0 = user.providerData?.[0];
+    if (provider0) {
+        if (profile.displayName !== undefined)
+            provider0.displayName = profile.displayName;
+        if (profile.photoURL !== undefined)
+            provider0.photoURL = profile.photoURL;
+    }
+}
+/** Build an `auth/no-current-user`-style error for token ops with no user. */
+function makeNoUserError(api) {
+    const err = new Error(`${api}: no current user is signed in.`);
+    err.code = 'auth/no-current-user';
+    return err;
+}
+export function isAuthOp(method) {
+    return method.startsWith('auth.');
+}
+// ─── Auth subscription handlers ───────────────────────────────────────────
+/**
+ * Register an auth subscription for a port. A routing entry only — the
+ * port's session changes (its own sign-ins/outs) fan out to it via
+ * {@link setPortSession}. Fires the PORT's current session immediately
+ * (initial-fire parity with onAuthStateChanged/onIdTokenChanged).
+ */
+export function handleAuthSub(ctx, port, msg) {
+    ensureAuth(ctx);
+    const subs = authSubsFor(ctx);
+    let bySubId = subs.get(port);
+    if (!bySubId) {
+        bySubId = new Map();
+        subs.set(port, bySubId);
+    }
+    if (bySubId.has(msg.subId))
+        return; // idempotent
+    bySubId.set(msg.subId, msg.target);
+    // Initial fire — mirror the real observers, which invoke the callback once
+    // with the current state on registration. Per-port: THIS port's session.
+    post(port, { t: 'snap', subId: msg.subId, value: serializeUser(portSession(ctx, port)?.user ?? null) });
+}
+export function handleAuthUnsub(ctx, port, subId) {
+    const subs = authSubsFor(ctx);
+    const bySubId = subs.get(port);
+    if (!bySubId || !bySubId.has(subId))
+        return false;
+    bySubId.delete(subId);
+    if (bySubId.size === 0)
+        subs.delete(port);
+    return true;
+}
+//# sourceMappingURL=host-auth.js.map

package/dist/serve/worker/host-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-auth.js","sourceRoot":"","sources":["../../../src/serve/worker/host-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAA+B,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EACL,OAAO,EACP,OAAO,IAAI,cAAc,GAI1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,aAAa,GAGd,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AAElE,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,OAAO,EAAgE,CAAC;AAE9F,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC9B,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC;IAC7D,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,IAAc;IACtD,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY,EAAE,IAAc,EAAE,OAA6B;IACjF,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAExC,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,gEAAgE;IAChE,GAAG,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC;IAEhC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,IAAc;IAC7D,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,6EAA6E;AAE7E,kEAAkE;AAClE,SAAS,SAAS,CAAC,OAAsB,EAAE,UAAyB;IAClE,OAAO;QACL,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,UAAU;QACV,aAAa,EAAE,QAAiB;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,IAAc,EAAE,GAAc;IAC7E,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE7B,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE;oBAC/C,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ;iBACjE,CAAC,CAAC;gBACH,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACnC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,yCAAyC;gBACrE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE;oBAC/C,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ;iBAC3D,CAAC,CAAC;gBACH,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACnC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,wBAAwB,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC;gBACH,+DAA+D;gBAC/D,mEAAmE;gBACnE,+DAA+D;gBAC/D,0DAA0D;gBAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACxC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1C,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;oBAC5C,MAAM;gBACR,CAAC;gBACD,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;gBACxE,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACnC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,0CAA0C;gBACtE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAC/B,sEAAsE;YACtE,uEAAuE;YACvE,IAAI,CAAC;gBACH,IAAI,OAAO,GAAyB,IAAI,CAAC;gBACzC,IAAI,CAAC;oBACH,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,OAAO;oBAAE,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAChD,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;gBACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACtD,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,uBAAuB,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;gBAC/D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACxD,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;oBACf,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,cAAc,EAAE,CAAC,CAAC,cAAc;oBAChC,YAAY,EAAE,CAAC,CAAC,YAAY;oBAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;iBACzC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,oEAAoE;YACpE,uEAAuE;YACvE,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC;YAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QAED,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACvC,IAAI,CAAC,OAAO;oBAAE,MAAM,eAAe,CAAC,eAAe,CAAC,CAAC;gBACrD,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACzE,cAAc,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC9D,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC1C,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,qEAAqE;YACrE,iEAAiE;YACjE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,2DAA2D;YAC3D,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAC3E,cAAc,CAAC,yBAAyB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAC3D,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;wBAC9B,GAAG;wBACH,KAAK,EAAE,KAAK,IAAI,EAAE;wBAClB,QAAQ,EAAE,2BAA2B;wBACrC,WAAW,EAAE,WAAW,IAAI,SAAS;wBACrC,YAAY,EAAE,YAAY,IAAI,EAAE;wBAChC,UAAU;qBACX,CAAC,CAAC,CAAC;gBACJ,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBACvE,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACnC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,2CAA2C;gBACvE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,wDAAwD;YACxD,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CACvC,IAAI,EACJ,GAAG,CAAC,OAA0D,CAC/D,CAAC;gBACF,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CACvC,IAAI,EACJ,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,OAA0D,CAC/D,CAAC;gBACF,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;gBACzC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAChC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,wBAAwB,CAAC,CAAC,CAAC;YAC9B,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,kEAAkE;YAClE,8DAA8D;YAC9D,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,wBAAwB,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC;gBACH,cAAc,CAAC,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBACxE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAE,GAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,SAAS,kBAAkB,CAAC,GAAY,EAAE,IAAc,EAAE,GAAW;IACnE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CACzB,IAAU,EACV,OAAkE;IAElE,MAAM,OAAO,GAAG,IAAgD,CAAC;IACjE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACjF,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAE1B,CAAC;IACd,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,SAAS,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACnF,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,GAAG,iCAAiC,CAA6B,CAAC;IAC3F,GAAG,CAAC,IAAI,GAAG,sBAAsB,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAA2B;IAClD,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,6EAA6E;AAE7E;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,IAAc,EAAE,GAAmB;IAC7E,UAAU,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,aAAa;IACjD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEnC,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,IAAc,EAAE,KAAa;IACzE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/serve/worker/host-context.d.ts

@@ -0,0 +1,180 @@
+/**
+ * SharedWorker host — shared foundation (context + reply helpers).
+ *
+ * The `HostCtx` is the single per-worker context shared across ALL connected
+ * ports and across the auth + event-stream subsystems. `PortLike`, `post`,
+ * `ok`, and `fail` are the minimal port + reply primitives every subsystem
+ * uses. This module imports NOTHING from the sibling `host-*` files, so it is
+ * the dependency root (no circular imports).
+ */
+import type { Firestore } from 'pyric/firestore';
+import type { Database } from 'pyric/database/modular';
+import type { Sandbox, PersistenceBackend } from 'pyric/sandbox';
+import type { Auth, MintedSession } from 'pyric/auth';
+import type { FirebaseStorage } from 'pyric/storage';
+import { type OutboundMessage, type AuthPersistenceMode, type PolicyRequest } from './protocol.js';
+/** Minimal postMessage interface. Fake ports in tests implement this. */
+export interface PortLike {
+    postMessage(msg: OutboundMessage): void;
+}
+export interface HostCtx {
+    /** The single shared Firestore handle (sandbox-live — reads currentUser per op). */
+    db: Firestore;
+    /** The underlying Sandbox, for setRules + direct sandbox ops. */
+    sandbox: Sandbox;
+    /** Stable per-SharedWorker instance id (see {@link INSTANCE_ID_KEY}). Reported
+     *  via `getVersion` so the UI can identify which sandbox instance this is. */
+    instanceId: string;
+    /** The shared Storage handle (Pyric Studio data browse). Lazily created on
+     *  the first storage op via `getStorage(initializeApp({ sandbox }))`. */
+    storage?: FirebaseStorage;
+    /** Shared RTDB handle. Lazily created for the playground shared-runtime path. */
+    rtdb?: Database;
+    /** Cached admin (rules-bypass) RTDB handle for Studio/Playground data inspection. */
+    adminRtdb?: Database;
+    /** Cached admin (rules-bypass) Storage handle for the `{ mode: 'admin' }`
+     *  lens — `pyric/storage/internal`'s `getAdminStorageSandbox`, the handle
+     *  the pyric-admin remote arm's storage ops resolve to. */
+    adminStorage?: FirebaseStorage;
+    /** Per-uid/token Storage handles for the impersonation lens (rules evaluate
+     *  as that user). Mirrors {@link HostCtx.lensRtdbs}. */
+    lensStorages?: Map<string, FirebaseStorage>;
+    /** Cached genuinely-UNAUTHENTICATED Firestore handle for the
+     *  `{ mode: 'anon' }` lens — `getFirestore(sandbox.withAuth(null))`, so
+     *  rules evaluate with `request.auth == null`. The remote arm's
+     *  `withAuth(null)`; distinct from an absent lens (the port's session). */
+    anonDb?: Firestore;
+    /** Cached unauthenticated RTDB handle for the `{ mode: 'anon' }` lens. */
+    anonRtdb?: Database;
+    /** Cached unauthenticated Storage handle for the `{ mode: 'anon' }` lens. */
+    anonStorage?: FirebaseStorage;
+    /** Per-uid RTDB handles carrying a port session's real identity. */
+    sessionRtdbs?: Map<string, Database>;
+    /** Per-uid/token RTDB handles for the Studio impersonation lens. */
+    lensRtdbs?: Map<string, Database>;
+    /** Current active rules metadata for shared-runtime diagnostics and revert. */
+    activeRules?: {
+        firestore?: ActiveRulesState;
+        database?: ActiveRulesState;
+    };
+    /** Per-port subscription registry. Map<port, Map<subId, unsub>>. */
+    subs: Map<PortLike, Map<string, () => void>>;
+    /**
+     * The ONE shared auth handle for the worker — the USER POOL (who exists)
+     * and the admin surface. Lazily created on first auth op or auth
+     * subscription. Sessions (who a connection IS) are per-port: see
+     * {@link HostCtx.portSessions} (#754). The handle's own `currentUser`
+     * stays null in served mode.
+     */
+    auth?: Auth;
+    /**
+     * Per-connection identity (#754): each port's signed-in session, minted
+     * via `sandbox.mintSession` (an authentic session — validated
+     * credentials / a really-minted identity, NOT the impersonation lens).
+     * A port absent from the map, or mapped to null, is signed out. The
+     * user pool + data + rules stay shared across ports.
+     */
+    portSessions?: Map<PortLike, MintedSession | null>;
+    /**
+     * Re-establish a port's session-bound Firestore listeners under its NEW
+     * session (#754) — set lazily by host.ts (which owns subs) and invoked by
+     * host-auth.ts on every port session change, mirroring prod's stream
+     * re-establishment on auth transitions: a sign-out re-evaluates live
+     * listeners so an auth-gated stream loses access instead of leaking the
+     * previous user's data. (A ctx hook, not an import — host-auth must not
+     * import host.ts.)
+     */
+    resubscribePortSubs?: (port: PortLike) => void;
+    /**
+     * Per-uid Firestore handles carrying a PORT SESSION's identity —
+     * `getFirestore(sandbox.withAuth(session.state))`, so rules see the
+     * session's uid AND its custom claims on `request.auth.token`. Keyed by
+     * uid (two ports as the same user share one handle). Distinct from
+     * {@link HostCtx.lensHandles}, which is the Studio debugging lens
+     * (uid-only, caller-gated writes).
+     */
+    sessionDbs?: Map<string, Firestore>;
+    /**
+     * The backend used for named state branches (save/switch). Session
+     * persistence is NOT here anymore: per-tab sessions persist client-side
+     * in web storage (the page restores via `auth.restorePortSession`),
+     * mirroring how the real SDK owns persistence in the client (#754).
+     */
+    sessionBackend?: PersistenceBackend;
+    /**
+     * Accepted `auth.setPersistence` mode, kept for surface parity. The
+     * worker itself no longer writes a session record — the CLIENT's
+     * SessionStore honors the mode (which web storage slot, or none).
+     */
+    sessionMode?: AuthPersistenceMode;
+    /**
+     * Per-uid impersonation Firestore handles (Pyric Studio auth lens, T2).
+     * Keyed by the impersonated uid. Each is a FROZEN-identity
+     * `getFirestore(sandbox.withAuth({ uid }))` handle whose ops evaluate
+     * security rules AS that user — the rules-debugging primitive. Cached so
+     * repeated `{ mode: 'as', uid }` ops reuse one handle (and so the modular
+     * layer's per-ctx ref cache stays warm). Lazily populated by `lensDb`.
+     */
+    lensHandles?: Map<string, Firestore>;
+    /**
+     * Cached admin (rules-bypass) Firestore handle for the `{ mode: 'admin' }`
+     * lens (Pyric Studio, Gap #2). A modular `getAdminFirestore(sandbox)` handle
+     * whose ops skip security-rule evaluation — Studio's "edit anything as admin"
+     * (F2). Lazily populated by `lensDb`.
+     */
+    adminDb?: Firestore;
+    /**
+     * The latest runtime confirm-policy pushed by the Studio permission dial
+     * (F3) via the `set-policy` op. `undefined` until the dial sets one. This is
+     * the WORKER-SIDE governance store — the source of truth Studio reflects and a
+     * future in-worker agent runtime would consult.
+     *
+     * HONEST LIMITATION: the interactive policy that gates AGENT TOOL CALLS lives
+     * in the bridge — a SEPARATE node process whose handler is built once at
+     * startup. This store does NOT reach into a running bridge; pushing a live
+     * policy there is a separate transport (an HTTP control route or a restart).
+     * See `PolicyRequest` in protocol.ts for the full rationale.
+     */
+    policy?: PolicyRequest;
+    /**
+     * Lazily-built agent tool dispatcher (the canonical sandbox tool set) bound to
+     * THIS worker's sandbox. The bridge peer forwards `tool` messages here so the
+     * agent executes against the one shared sandbox, not a separate in-page
+     * backend. Cached so the handler array is built once.
+     */
+    toolDispatch?: (name: string, args: Record<string, unknown>) => Promise<{
+        ok: boolean;
+        summary: string;
+        data?: unknown;
+    }>;
+}
+export interface ActiveRulesState {
+    source: unknown;
+    updatedAt: number;
+    status: 'active' | 'error';
+    messages: Array<{
+        severity: 'info' | 'warn' | 'error';
+        text: string;
+        line?: number;
+        column?: number;
+    }>;
+    lastKnownGood?: unknown;
+}
+export declare function post(port: PortLike, msg: OutboundMessage): void;
+export declare function ok(port: PortLike, id: string, value: unknown): void;
+export declare function fail(port: PortLike, id: string, err: unknown): void;
+/**
+ * Await a persistence flush BEFORE acking a mutating op, so an acknowledged
+ * write is durable in IndexedDB when the reply reaches the client. This is
+ * the worker's ONLY durability mechanism: there is no beforeterminate-style
+ * event for a SharedWorker, so a teardown on last-tab close/reload can kill
+ * the worker inside the controller's debounce window — an un-flushed write
+ * would be silently lost (the reload-durability bug).
+ *
+ * "Best-effort" refers to the REPLY, not the flush: a flush failure (e.g.
+ * storage quota) must not turn a successful in-memory mutation into a wire
+ * error, but it IS logged — a silently swallowed flush failure is exactly
+ * how a broken flush contract stays invisible.
+ */
+export declare function bestEffortFlush(ctx: HostCtx): Promise<void>;
+//# sourceMappingURL=host-context.d.ts.map

package/dist/serve/worker/host-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-context.d.ts","sourceRoot":"","sources":["../../../src/serve/worker/host-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AAIvB,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;CACzC;AAID,MAAM,WAAW,OAAO;IACtB,oFAAoF;IACpF,EAAE,EAAE,SAAS,CAAC;IACd,iEAAiE;IACjE,OAAO,EAAE,OAAO,CAAC;IACjB;kFAC8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB;6EACyE;IACzE,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,qFAAqF;IACrF,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB;;+DAE2D;IAC3D,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B;4DACwD;IACxD,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;;;+EAG2E;IAC3E,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,oEAAoE;IACpE,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrC,oEAAoE;IACpE,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,+EAA+E;IAC/E,WAAW,CAAC,EAAE;QACZ,SAAS,CAAC,EAAE,gBAAgB,CAAC;QAC7B,QAAQ,CAAC,EAAE,gBAAgB,CAAC;KAC7B,CAAC;IACF,oEAAoE;IACpE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;IAC7C;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC,CAAC;IACnD;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;IAC/C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC3B,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,wBAAgB,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,GAAG,IAAI,CAE/D;AAED,wBAAgB,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAEnE;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAInE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjE"}