pyric-tools 0.1.0-alpha.7

package/dist/deploy/preflight.js

@@ -0,0 +1,440 @@
+/**
+ * Pre-flight checks for a Firebase project before kicking off a
+ * full deploy (hosting + rules + indexes). Three cheap GETs
+ * (~200ms total) that surface the common "won't work" conditions
+ * up front so the playground can show actionable remediation
+ * (Console deeplinks, missing IAM scopes) instead of a half-
+ * deployed app.
+ *
+ * The checks:
+ *
+ *   - `hosting-site`     — `firebasehosting.googleapis.com` GET on
+ *                          `projects/{p}/sites/{siteId}`. Default
+ *                          siteId is `projectId` (Firebase auto-
+ *                          provisions a default site that matches).
+ *   - `firestore-db`     — `firestore.googleapis.com` GET on
+ *                          `projects/{p}/databases/(default)`.
+ *   - `iam-permissions`  — `iam.googleapis.com` POST
+ *                          `projects/{p}:testIamPermissions` for
+ *                          the four scopes deploy needs.
+ *
+ * Every check returns a `PreflightCheckResult`. Error codes mirror
+ * the existing deploy primitives' shapes (`permission-denied`,
+ * `not-found`, plus `service-not-enabled` when the upstream API
+ * is disabled on the target project and `network-error` when
+ * fetch rejects). `runPreflight` fans them out in parallel and
+ * aggregates.
+ *
+ * Pure fetch + no `node:*` imports — runs in the browser host
+ * (Firebase Auth `getIdToken`) and the Node host (service-account
+ * JWT exchange) alike.
+ *
+ * See the design rationale, the
+ * `Pre-flight checks` track, for the audit that produced these
+ * three checks and their endpoints.
+ */
+const HOSTING_API = 'https://firebasehosting.googleapis.com/v1beta1';
+const FIRESTORE_API = 'https://firestore.googleapis.com/v1';
+const IAM_API = 'https://iam.googleapis.com/v1';
+/** Scopes the playground deploy path needs end-to-end. */
+const DEFAULT_REQUIRED_PERMISSIONS = [
+    'firebase.projects.get',
+    'firebasehosting.admin',
+    'datastore.databases.get',
+    'datastore.databases.create',
+];
+// ─── helpers ─────────────────────────────────────────────────────────
+function hostingConsoleUrl(projectId) {
+    return `https://console.firebase.google.com/project/${encodeURIComponent(projectId)}/hosting`;
+}
+function firestoreConsoleUrl(projectId) {
+    return `https://console.firebase.google.com/project/${encodeURIComponent(projectId)}/firestore`;
+}
+/**
+ * Parse a Google REST error body and return its first error
+ * reason (e.g. `SERVICE_DISABLED`). Returns `null` when the body
+ * isn't JSON, isn't shaped like a Google error, or has no
+ * `reason` field. Used to distinguish "API disabled on the
+ * project" from a real permission denial.
+ */
+function extractErrorReason(body) {
+    try {
+        const parsed = JSON.parse(body);
+        const detail = parsed.error?.details?.find((d) => typeof d?.reason === 'string');
+        if (detail?.reason)
+            return detail.reason;
+        if (parsed.error?.status === 'PERMISSION_DENIED')
+            return null;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function extractErrorMessage(body, fallback) {
+    try {
+        const parsed = JSON.parse(body);
+        if (parsed.error?.message)
+            return parsed.error.message;
+    }
+    catch {
+        /* fall through */
+    }
+    return body || fallback;
+}
+// ─── individual checks ──────────────────────────────────────────────
+/**
+ * Probe the named Hosting site. A 200 means the site exists and
+ * the caller has permission to read it; 404 means the site
+ * doesn't exist yet (uncommon — Firebase auto-creates a default
+ * site whose id equals the project id); 401/403 means the
+ * caller's credentials lack `firebasehosting.admin` (or the
+ * Hosting API is disabled on the project, surfaced as
+ * `service-not-enabled`).
+ */
+export async function checkHostingSite(scope, siteId) {
+    const id = 'hosting-site';
+    let token;
+    try {
+        token = await scope.resolveToken();
+    }
+    catch (e) {
+        return {
+            id,
+            ok: false,
+            summary: 'Failed to resolve access token for hosting check',
+            error: {
+                code: 'network-error',
+                message: e instanceof Error ? e.message : String(e),
+            },
+        };
+    }
+    let res;
+    try {
+        res = await fetch(`${HOSTING_API}/projects/${encodeURIComponent(scope.projectId)}/sites/${encodeURIComponent(siteId)}`, { headers: { Authorization: `Bearer ${token}` } });
+    }
+    catch (e) {
+        return {
+            id,
+            ok: false,
+            summary: 'Network error contacting Firebase Hosting',
+            error: {
+                code: 'network-error',
+                message: e instanceof Error ? e.message : String(e),
+            },
+        };
+    }
+    if (res.ok) {
+        const site = (await res.json().catch(() => ({})));
+        return {
+            id,
+            ok: true,
+            summary: `Hosting site '${siteId}' exists`,
+            data: {
+                name: site.name,
+                defaultUrl: site.defaultUrl,
+                type: site.type,
+                siteId,
+            },
+        };
+    }
+    const body = await res.text().catch(() => '');
+    if (res.status === 404) {
+        return {
+            id,
+            ok: false,
+            summary: `Hosting site '${siteId}' not found`,
+            consoleUrl: hostingConsoleUrl(scope.projectId),
+            error: {
+                code: 'not-found',
+                message: extractErrorMessage(body, `Hosting site '${siteId}' not found`),
+            },
+        };
+    }
+    if (res.status === 401 || res.status === 403) {
+        const reason = extractErrorReason(body);
+        if (reason === 'SERVICE_DISABLED') {
+            return {
+                id,
+                ok: false,
+                summary: 'Firebase Hosting API is not enabled on this project',
+                consoleUrl: hostingConsoleUrl(scope.projectId),
+                error: {
+                    code: 'service-not-enabled',
+                    message: extractErrorMessage(body, 'Firebase Hosting API disabled'),
+                },
+            };
+        }
+        return {
+            id,
+            ok: false,
+            summary: 'Permission denied reading hosting site',
+            consoleUrl: hostingConsoleUrl(scope.projectId),
+            error: {
+                code: 'permission-denied',
+                message: extractErrorMessage(body, `Hosting denied: ${res.status}`),
+            },
+        };
+    }
+    return {
+        id,
+        ok: false,
+        summary: `Hosting check failed (HTTP ${res.status})`,
+        error: {
+            code: 'unknown',
+            message: extractErrorMessage(body, `HTTP ${res.status}`),
+        },
+    };
+}
+/**
+ * Probe the `(default)` Firestore database. A 200 means the
+ * database exists; 404 means the user hasn't initialized
+ * Firestore in the Console yet (we don't auto-create — the
+ * Console flow asks the user to pick a location, which we
+ * shouldn't decide for them). 403 + `SERVICE_DISABLED` means the
+ * Firestore API itself is off on the project.
+ */
+export async function checkFirestoreDatabase(scope) {
+    const id = 'firestore-db';
+    let token;
+    try {
+        token = await scope.resolveToken();
+    }
+    catch (e) {
+        return {
+            id,
+            ok: false,
+            summary: 'Failed to resolve access token for firestore check',
+            error: {
+                code: 'network-error',
+                message: e instanceof Error ? e.message : String(e),
+            },
+        };
+    }
+    let res;
+    try {
+        res = await fetch(`${FIRESTORE_API}/projects/${encodeURIComponent(scope.projectId)}/databases/(default)`, { headers: { Authorization: `Bearer ${token}` } });
+    }
+    catch (e) {
+        return {
+            id,
+            ok: false,
+            summary: 'Network error contacting Firestore',
+            error: {
+                code: 'network-error',
+                message: e instanceof Error ? e.message : String(e),
+            },
+        };
+    }
+    if (res.ok) {
+        const db = (await res.json().catch(() => ({})));
+        return {
+            id,
+            ok: true,
+            summary: `Firestore default database exists (${db.locationId ?? 'unknown location'})`,
+            data: {
+                name: db.name,
+                locationId: db.locationId,
+                type: db.type,
+            },
+        };
+    }
+    const body = await res.text().catch(() => '');
+    if (res.status === 404) {
+        return {
+            id,
+            ok: false,
+            summary: 'Firestore default database not initialized',
+            consoleUrl: firestoreConsoleUrl(scope.projectId),
+            error: {
+                code: 'not-found',
+                message: extractErrorMessage(body, 'Firestore default database not found'),
+            },
+        };
+    }
+    if (res.status === 401 || res.status === 403) {
+        const reason = extractErrorReason(body);
+        if (reason === 'SERVICE_DISABLED') {
+            return {
+                id,
+                ok: false,
+                summary: 'Cloud Firestore API is not enabled on this project',
+                consoleUrl: firestoreConsoleUrl(scope.projectId),
+                error: {
+                    code: 'service-not-enabled',
+                    message: extractErrorMessage(body, 'Cloud Firestore API disabled'),
+                },
+            };
+        }
+        return {
+            id,
+            ok: false,
+            summary: 'Permission denied reading firestore database',
+            consoleUrl: firestoreConsoleUrl(scope.projectId),
+            error: {
+                code: 'permission-denied',
+                message: extractErrorMessage(body, `Firestore denied: ${res.status}`),
+            },
+        };
+    }
+    return {
+        id,
+        ok: false,
+        summary: `Firestore check failed (HTTP ${res.status})`,
+        error: {
+            code: 'unknown',
+            message: extractErrorMessage(body, `HTTP ${res.status}`),
+        },
+    };
+}
+/**
+ * Ask IAM which of `permissions` the caller's credentials are
+ * granted on the project. Returns `ok: true` only when every
+ * requested permission comes back in the response; otherwise
+ * marks the result as `permission-denied` and lists the missing
+ * scopes in `data.missing`.
+ *
+ * The endpoint itself needs `iam.permissions.testIamPermissions`
+ * (subsumed by Owner/Editor). A 403 from this endpoint usually
+ * means the IAM API is off on the project — we surface that as
+ * `service-not-enabled` when the body reports `SERVICE_DISABLED`.
+ */
+export async function checkIamPermissions(scope, permissions = DEFAULT_REQUIRED_PERMISSIONS) {
+    const id = 'iam-permissions';
+    let token;
+    try {
+        token = await scope.resolveToken();
+    }
+    catch (e) {
+        return {
+            id,
+            ok: false,
+            summary: 'Failed to resolve access token for IAM check',
+            error: {
+                code: 'network-error',
+                message: e instanceof Error ? e.message : String(e),
+            },
+        };
+    }
+    let res;
+    try {
+        res = await fetch(`${IAM_API}/projects/${encodeURIComponent(scope.projectId)}:testIamPermissions`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ permissions }),
+        });
+    }
+    catch (e) {
+        return {
+            id,
+            ok: false,
+            summary: 'Network error contacting IAM',
+            error: {
+                code: 'network-error',
+                message: e instanceof Error ? e.message : String(e),
+            },
+        };
+    }
+    if (res.ok) {
+        const parsed = (await res.json().catch(() => ({})));
+        const granted = parsed.permissions ?? [];
+        const grantedSet = new Set(granted);
+        const missing = permissions.filter((p) => !grantedSet.has(p));
+        if (missing.length === 0) {
+            return {
+                id,
+                ok: true,
+                summary: `All ${permissions.length} required IAM permissions granted`,
+                data: { granted, requested: [...permissions], missing: [] },
+            };
+        }
+        return {
+            id,
+            ok: false,
+            summary: `Missing ${missing.length} of ${permissions.length} required IAM permissions`,
+            error: {
+                code: 'permission-denied',
+                message: `Missing permissions: ${missing.join(', ')}`,
+            },
+            data: { granted, requested: [...permissions], missing },
+        };
+    }
+    const body = await res.text().catch(() => '');
+    if (res.status === 404) {
+        return {
+            id,
+            ok: false,
+            summary: `Project '${scope.projectId}' not found by IAM`,
+            error: {
+                code: 'not-found',
+                message: extractErrorMessage(body, 'Project not found'),
+            },
+        };
+    }
+    if (res.status === 401 || res.status === 403) {
+        const reason = extractErrorReason(body);
+        if (reason === 'SERVICE_DISABLED') {
+            return {
+                id,
+                ok: false,
+                summary: 'IAM API is not enabled on this project',
+                error: {
+                    code: 'service-not-enabled',
+                    message: extractErrorMessage(body, 'IAM API disabled'),
+                },
+            };
+        }
+        return {
+            id,
+            ok: false,
+            summary: 'Permission denied calling testIamPermissions',
+            error: {
+                code: 'permission-denied',
+                message: extractErrorMessage(body, `IAM denied: ${res.status}`),
+            },
+        };
+    }
+    return {
+        id,
+        ok: false,
+        summary: `IAM check failed (HTTP ${res.status})`,
+        error: {
+            code: 'unknown',
+            message: extractErrorMessage(body, `HTTP ${res.status}`),
+        },
+    };
+}
+// ─── orchestrator ────────────────────────────────────────────────────
+const ALL_CHECKS = [
+    'hosting-site',
+    'firestore-db',
+    'iam-permissions',
+];
+/**
+ * Run the selected checks in parallel and aggregate.
+ * `options.checks` defaults to all three; `options.siteId`
+ * defaults to `projectId` (Firebase's auto-provisioned default
+ * site shares the project id). Result `ok` is the conjunction —
+ * every check must pass.
+ */
+export async function runPreflight(scope, options = {}) {
+    const siteId = options.siteId ?? scope.projectId;
+    const selected = options.checks ?? ALL_CHECKS;
+    const permissions = options.iamPermissions ?? DEFAULT_REQUIRED_PERMISSIONS;
+    const tasks = selected.map((id) => {
+        switch (id) {
+            case 'hosting-site':
+                return checkHostingSite(scope, siteId);
+            case 'firestore-db':
+                return checkFirestoreDatabase(scope);
+            case 'iam-permissions':
+                return checkIamPermissions(scope, permissions);
+        }
+    });
+    const results = await Promise.all(tasks);
+    return { ok: results.every((r) => r.ok), results };
+}
+//# sourceMappingURL=preflight.js.map

package/dist/deploy/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/deploy/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,MAAM,WAAW,GAAG,gDAAgD,CAAC;AACrE,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAC5D,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAEhD,0DAA0D;AAC1D,MAAM,4BAA4B,GAAsB;IACtD,uBAAuB;IACvB,uBAAuB;IACvB,yBAAyB;IACzB,4BAA4B;CAC7B,CAAC;AAoDF,wEAAwE;AAExE,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,OAAO,+CAA+C,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC;AAChG,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,OAAO,+CAA+C,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAK7B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,MAAM,EAAE,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QACzC,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,KAAK,mBAAmB;YAAE,OAAO,IAAI,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,QAAgB;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAC;QACpE,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAmB,EACnB,MAAc;IAEd,MAAM,EAAE,GAAqB,cAAc,CAAC;IAC5C,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,kDAAkD;YAC3D,KAAK,EAAE;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aACpD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CACf,GAAG,WAAW,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,EACpG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAClD,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,2CAA2C;YACpD,KAAK,EAAE;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aACpD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAI/C,CAAC;QACF,OAAO;YACL,EAAE;YACF,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,iBAAiB,MAAM,UAAU;YAC1C,IAAI,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM;aACP;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,iBAAiB,MAAM,aAAa;YAC7C,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9C,KAAK,EAAE;gBACL,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,MAAM,aAAa,CAAC;aACzE;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAClC,OAAO;gBACL,EAAE;gBACF,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,qDAAqD;gBAC9D,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC9C,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,+BAA+B,CAAC;iBACpE;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,wCAAwC;YACjD,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9C,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE,CAAC;aACpE;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE;QACF,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,8BAA8B,GAAG,CAAC,MAAM,GAAG;QACpD,KAAK,EAAE;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;SACzD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAmB;IAEnB,MAAM,EAAE,GAAqB,cAAc,CAAC;IAC5C,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,oDAAoD;YAC7D,KAAK,EAAE;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aACpD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CACf,GAAG,aAAa,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,sBAAsB,EACtF,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAClD,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,oCAAoC;YAC7C,KAAK,EAAE;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aACpD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAI7C,CAAC;QACF,OAAO;YACL,EAAE;YACF,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,sCAAsC,EAAE,CAAC,UAAU,IAAI,kBAAkB,GAAG;YACrF,IAAI,EAAE;gBACJ,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,IAAI,EAAE,EAAE,CAAC,IAAI;aACd;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,4CAA4C;YACrD,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC;YAChD,KAAK,EAAE;gBACL,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,sCAAsC,CAAC;aAC3E;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAClC,OAAO;gBACL,EAAE;gBACF,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,oDAAoD;gBAC7D,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC;gBAChD,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,8BAA8B,CAAC;iBACnE;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,8CAA8C;YACvD,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC;YAChD,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC;aACtE;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE;QACF,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,gCAAgC,GAAG,CAAC,MAAM,GAAG;QACtD,KAAK,EAAE;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;SACzD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAmB,EACnB,cAAiC,4BAA4B;IAE7D,MAAM,EAAE,GAAqB,iBAAiB,CAAC;IAC/C,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,8CAA8C;YACvD,KAAK,EAAE;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aACpD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CACf,GAAG,OAAO,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAC/E;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;SACtC,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aACpD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEjD,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE;gBACF,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,OAAO,WAAW,CAAC,MAAM,mCAAmC;gBACrE,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;aAC5D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,WAAW,OAAO,CAAC,MAAM,OAAO,WAAW,CAAC,MAAM,2BAA2B;YACtF,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACtD;YACD,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE;SACxD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,YAAY,KAAK,CAAC,SAAS,oBAAoB;YACxD,KAAK,EAAE;gBACL,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,CAAC;aACxD;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAClC,OAAO;gBACL,EAAE;gBACF,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,wCAAwC;gBACjD,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,CAAC;iBACvD;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE;YACF,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,8CAA8C;YACvD,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC;aAChE;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE;QACF,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,0BAA0B,GAAG,CAAC,MAAM,GAAG;QAChD,KAAK,EAAE;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;SACzD;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,GAAgC;IAC9C,cAAc;IACd,cAAc;IACd,iBAAiB;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAmB,EACnB,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,IAAI,4BAA4B,CAAC;IAE3E,MAAM,KAAK,GAAyC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACtE,QAAQ,EAAE,EAAE,CAAC;YACX,KAAK,cAAc;gBACjB,OAAO,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,KAAK,cAAc;gBACjB,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACvC,KAAK,iBAAiB;gBACpB,OAAO,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC"}

package/dist/deploy/provider.d.ts

@@ -0,0 +1,130 @@
+/**
+ * The deploy provider contract — a small descriptor, not a framework.
+ *
+ * Each Firebase product (`functions`, `hosting`, `storage`, …) is one
+ * {@link DeployProvider}. The CLI dispatcher and the agent tool-registry both
+ * derive from the provider registry, so target identity has ONE source of truth.
+ *
+ * What the contract makes polymorphic is ONLY what dispatch actually varies on:
+ *   1. how to READ a target's config from firebase.json + flags ({@link resolveConfig});
+ *   2. how to TURN a scope into the runnable {@link ToolHandler}s ({@link tools}).
+ *
+ * Everything else is shared and stays put: token resolution rides
+ * `ProjectScope.resolveToken()`, network is global `fetch` inside the existing
+ * primitives, exit codes (0 ok / 1 usage / 2 runtime) live in the dispatcher,
+ * and the multi-step lifecycle (preflight/plan/apply) stays INSIDE each handler.
+ * This is deliberate — modeling the lifecycle as contract methods, or unifying
+ * the providers' internal outcome dialects, would be over-engineering: the tool
+ * boundary already normalizes every result to `{ ok, summary, data }`.
+ */
+import type { ToolHandler, ToolContext } from '@inbrowser/agent';
+import type { ProjectScope } from './scope.js';
+import type { FirebaseJson, FirebaseRc } from '../cli/firebase-json.js';
+/**
+ * Live progress narration emitted by a provider during a deploy. Purely
+ * additive: a handler that never calls `ctx.report` behaves exactly as before,
+ * and deleting every `report()` call leaves behavior byte-identical. Exit codes
+ * derive from the terminal {@link ToolResult}, never from these events.
+ */
+export interface DeployProgressEvent {
+    /** The {@link DeployProvider.target} this event belongs to. */
+    target: string;
+    /** Stable machine id for the step, e.g. `'enable-service' | 'settle' | 'upload' | 'release'`. */
+    step: string;
+    status: 'start' | 'progress' | 'done' | 'skip' | 'fail';
+    /** One human line, same register as `ToolResult.summary`. */
+    message: string;
+    /** 0..1 — emit ONLY when a real denominator exists. Omit for indeterminate
+     *  waits (e.g. a propagation sleep) so the UI shows a spinner, never a fake bar. */
+    pct?: number;
+    /** Optional structured payload (bucketId, versionName, …) for machine sinks. */
+    data?: unknown;
+}
+/**
+ * The target-less event a HANDLER emits. The dispatcher stamps `target` (it
+ * knows which provider is running) and forwards the full
+ * {@link DeployProgressEvent} to the board / NDJSON sink, so a handler never has
+ * to know — or hardcode — its own target name. (This is what lets a tool that is
+ * also a plain agent tool emit progress without depending on deploy concepts.)
+ */
+export type DeployStepEvent = Omit<DeployProgressEvent, 'target'>;
+/** A handler emits progress through this callback (absent on the agent path). */
+export type DeployReport = (event: DeployStepEvent) => void;
+/**
+ * Deploy-local extension of the (intentionally narrow) agent {@link ToolContext}.
+ * The agent runtime never sets `report`, so the agent path no-ops; the CLI
+ * dispatcher injects a reporter that drives the status board / NDJSON sink.
+ */
+export interface DeployToolContext extends ToolContext {
+    report?: DeployReport;
+}
+/**
+ * The environment a provider reads its config from. This is the HONEST surface:
+ * resolving config is not pure — hosting needs `.firebaserc` + the git branch,
+ * functions reads flags and ignores firebase.json — so the source carries all of
+ * it. `projectId` is already resolved (scope is resolved before config).
+ */
+export interface ConfigSource {
+    firebaseJson: FirebaseJson;
+    firebaseRc: FirebaseRc | null;
+    flags: ReadonlyMap<string, string | boolean>;
+    projectId: string;
+    cwd: string;
+    env?: Record<string, string | undefined>;
+    readFile(path: string): Promise<string>;
+    getGitBranch(): Promise<string | null>;
+}
+/**
+ * The result of resolving config: zero-or-more units to execute (PLURAL — a
+ * hosting deploy fans out over sites, a storage deploy over buckets), or a usage
+ * error. A usage error is fail-fast: the dispatcher prints it and exits 1 BEFORE
+ * any network call.
+ */
+export type ResolveResult<A> = {
+    ok: true;
+    units: A[];
+    warnings?: string[];
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * One verb of a provider. Most providers have a single default op; multi-verb
+ * providers (e.g. storage = provision; firestore = rules | indexes) expose
+ * several, selected via `deploy <target>:<op>`.
+ */
+export interface DeployOperation {
+    /** Sub-target name, dispatched as `deploy <target>:<name>`. */
+    name: string;
+    /** The op run by a bare `deploy <target>`. Exactly one should be default. */
+    default?: boolean;
+    /** The {@link ToolHandler} name this op dispatches to. */
+    toolName: string;
+    /** Marks an irreversible op; reserved for a future `--force` gate (convention
+     *  now so destructive steps never read stdin from inside a handler). */
+    destructive?: boolean;
+}
+/**
+ * A deploy target. Adding one is this descriptor plus one registry line.
+ * `A` is the per-unit argument type produced by {@link resolveConfig} and fed to
+ * the handler's `execute` — keeping the two in lockstep.
+ */
+export interface DeployProvider<A = unknown> {
+    readonly target: string;
+    /** One-liner for generated help text. */
+    readonly summary: string;
+    readonly operations: readonly DeployOperation[];
+    /** The OAuth scope this target needs. Drives the login scope-upgrade preflight:
+     *  a logged-in user lacking it is prompted to re-authorize before dispatch. */
+    readonly requiredScope: string;
+    /** The Google APIs this target needs enabled on the project. The deploy
+     *  preflight ensures these are enabled (auto-enable when the caller has
+     *  permission; otherwise print a console link and fail fast) before any
+     *  mutation. See design rationale */
+    readonly requiredApis: readonly string[];
+    /** The provider's runnable tools for a scope — the existing factory, unchanged. */
+    tools(scope: ProjectScope): ToolHandler<A>[];
+    /** Read this op's config from firebase.json + flags into execute args (plural). */
+    resolveConfig(op: string, src: ConfigSource): Promise<ResolveResult<A>>;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/deploy/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/deploy/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACxD,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB;wFACoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;AAElE,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;AAE5D;;;;GAIG;AACH,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,IACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB;4EACwE;IACxE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,OAAO;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD;mFAC+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;yCAGqC;IACrC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,mFAAmF;IACnF,KAAK,CAAC,KAAK,EAAE,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,mFAAmF;IACnF,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;CACzE"}

package/dist/deploy/provider.js

@@ -0,0 +1,21 @@
+/**
+ * The deploy provider contract — a small descriptor, not a framework.
+ *
+ * Each Firebase product (`functions`, `hosting`, `storage`, …) is one
+ * {@link DeployProvider}. The CLI dispatcher and the agent tool-registry both
+ * derive from the provider registry, so target identity has ONE source of truth.
+ *
+ * What the contract makes polymorphic is ONLY what dispatch actually varies on:
+ *   1. how to READ a target's config from firebase.json + flags ({@link resolveConfig});
+ *   2. how to TURN a scope into the runnable {@link ToolHandler}s ({@link tools}).
+ *
+ * Everything else is shared and stays put: token resolution rides
+ * `ProjectScope.resolveToken()`, network is global `fetch` inside the existing
+ * primitives, exit codes (0 ok / 1 usage / 2 runtime) live in the dispatcher,
+ * and the multi-step lifecycle (preflight/plan/apply) stays INSIDE each handler.
+ * This is deliberate — modeling the lifecycle as contract methods, or unifying
+ * the providers' internal outcome dialects, would be over-engineering: the tool
+ * boundary already normalizes every result to `{ ok, summary, data }`.
+ */
+export {};
+//# sourceMappingURL=provider.js.map

package/dist/deploy/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/deploy/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG"}

package/dist/deploy/providers/database.d.ts

@@ -0,0 +1,8 @@
+import type { DeployProvider } from '../provider.js';
+interface DatabaseRulesArgs {
+    rulesJson: unknown;
+    databaseUrl?: string;
+}
+export declare const databaseRulesProvider: DeployProvider<DatabaseRulesArgs>;
+export {};
+//# sourceMappingURL=database.d.ts.map

package/dist/deploy/providers/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../../src/deploy/providers/database.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,gBAAgB,CAAC;AAGpE,UAAU,iBAAiB;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAOD,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,iBAAiB,CA6BnE,CAAC"}

package/dist/deploy/providers/database.js

@@ -0,0 +1,37 @@
+import { resolve as resolvePath } from 'node:path';
+import { createRtdbDeployTools } from '../tools.js';
+import { SCOPES } from '../../credentials/core/scopes.js';
+function stringFlag(flags, name) {
+    const value = flags.get(name);
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+export const databaseRulesProvider = {
+    target: 'database',
+    summary: 'Deploy Realtime Database security rules',
+    operations: [{ name: 'deploy', default: true, toolName: 'rtdb_deploy_rules' }],
+    requiredScope: SCOPES.firebaseDatabase,
+    requiredApis: ['firebasedatabase.googleapis.com'],
+    tools: (scope) => createRtdbDeployTools({ scope }),
+    async resolveConfig(_op, src) {
+        const rulesPath = src.firebaseJson.database?.rules;
+        if (!rulesPath)
+            return { ok: false, message: 'firebase.json has no `database.rules` path.' };
+        const raw = await src.readFile(resolvePath(src.cwd, rulesPath));
+        let rulesJson;
+        try {
+            rulesJson = JSON.parse(raw);
+        }
+        catch (e) {
+            return { ok: false, message: `failed to parse ${rulesPath}: ${e instanceof Error ? e.message : String(e)}` };
+        }
+        const databaseUrl = stringFlag(src.flags, 'database-url') ??
+            stringFlag(src.flags, 'databaseUrl') ??
+            src.env?.FIREBASE_DATABASE_URL ??
+            src.firebaseJson.database?.url;
+        return {
+            ok: true,
+            units: [{ rulesJson, ...(databaseUrl ? { databaseUrl } : {}) }],
+        };
+    },
+};
+//# sourceMappingURL=database.js.map