npm - pyric-tools - Versions diffs - 0.1.0-alpha.7 - Mend

pyric-tools 0.1.0-alpha.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1052) hide show

package/dist/serve/docs-ui/docs/pyric-auth-compat/index.html ADDED Viewed

@@ -0,0 +1,874 @@
+<!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>pyric/auth compatibility matrix · Pyric Studio</title><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_slug_.BsN3bPok.css"></head> <body>  <header class="studio__bar"> <div class="studio__bar-inner"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric Studio">Pyric</a> <nav class="studio__nav" aria-label="Studio tabs"> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/firestore"> Firestore </a><a class="studio__nav-tab" href="/__pyric/ui/auth"> Auth </a><a class="studio__nav-tab" href="/__pyric/ui/rtdb"> RTDB </a><a class="studio__nav-tab" href="/__pyric/ui/storage"> Storage </a><a class="studio__nav-tab" href="/__pyric/ui/traffic"> Traffic </a><a class="studio__nav-tab" href="/__pyric/ui/prototype"> Prototype </a><a class="studio__nav-tab" href="/__pyric/ui/settings"> Settings </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a> </nav> </div> </header> <div class="docs-shell">  <details class="docs-nav-drawer"> <summary>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <details class="docs-nav-group"> <summary>pyric-tools</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-tools/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-getting-started/"> Getting started </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-server-adoption/"> Server adoption </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-wire-claude-code/"> Wire Claude Code </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-how-to-build-a-standalone-binary/"> Build a standalone binary </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-configure-auth-providers-and-domains/"> Configure auth providers </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-discover-a-schema-from-firestore/"> Infer a schema </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-promote-sandbox-state-to-a-fixture/"> Promote sandbox state </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-serve-persistence-and-multi-tab/"> Persistence &amp; multi-tab </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-use-the-vite-plugin/"> Use the Vite plugin </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-verify-against-a-captured-session/"> Verify rules against prod </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-reference-cli/"> pyric CLI reference </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-reference-verify/"> Verify API </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Bridge </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-bridge/"> pyric-tools/bridge </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric-tools / deploy</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-tutorials-01-deploy-a-cloud-function/"> Deploy a Cloud Function </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-build-projectscope-from-firebase-auth/"> Scope from Firebase Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-build-projectscope-from-service-account/"> Scope from service account </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-bundle-and-deploy-a-function/"> Bundle &amp; deploy a function </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-firestore-indexes/"> Deploy Firestore indexes </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-firestore-rules/"> Deploy Firestore rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-hosting-rewrites/"> Deploy Hosting rewrites </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-realtime-database-rules/"> Deploy RTDB rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-to-a-preview-channel/"> Deploy to a preview channel </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-handle-errors-and-outcomes/"> Handle errors and outcomes </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-provision-a-firestore-database/"> Provision a database </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-register-tools-with-an-agent/"> Register deploy tools </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-cli-agent-io/"> pyric deploy agent I/O </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-error-codes/"> Error codes by operation </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-firestore-namespace/"> firestore namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-functions-namespace/"> functions namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-hosting-config/"> firebase.json hosting config </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-hosting-namespace/"> hosting namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-rtdb-namespace/"> rtdb namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-scope-and-outcome/"> Scope and Outcome </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-tool-factories/"> Tool factories </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-primitives-vs-orchestrators/"> Primitives vs. orchestrators </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-token-caching/"> Token caching and memoizeTtl </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-why-no-firebase-cli/"> Why no Firebase CLI </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric / firestore</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-tutorials-01-write-a-sandbox-demo/"> Sandbox-backed demo </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-tutorials-02-swap-to-prod-backend/"> Swap to prod backend </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-build-queries/"> Build queries </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-migrate-from-firebase-firestore/"> Migrate from Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-pick-a-backend/"> Pick a backend </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-run-a-transaction/"> Run a transaction </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-use-onsnapshot/"> Use onSnapshot </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-use-sandbox-ops/"> Use sandbox-only ops </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-feature-matrix/"> Feature matrix </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-getfirestore/"> getFirestore overloads </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-query-constraints/"> Query constraints </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-sandbox-ops/"> Sandbox-only operations </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-tool-factories/"> Tool factories </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-rules-tooling-is-separate/"> Rules tooling is separate </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-target-symbol-opacity/"> TARGET_SYMBOL opacity </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-two-backends-one-surface/"> Two backends, one surface </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric / rules</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-rules/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-tutorials-01-lint-your-first-rules-file/"> Lint your first rules file </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-tutorials-02-write-a-test-suite-for-your-rules/"> Write a rules test suite </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-how-to-compare-rulesets-for-weakening/"> Compare rulesets </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-inspect-rules-via-the-ast/"> Inspect rules via the AST </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-lint-rules-source/"> Lint a rules source </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-pin-request-time/"> Pin request.time </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-register-tools-with-an-agent/"> Register rules tools </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-resolve-module-imports/"> Resolve 2+modules imports </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-simulate-rules-locally/"> Simulate rules locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-test-rules-against-firebase/"> Test rules against Firebase </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-ast/"> AST </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-errors/"> Errors </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-lint-rules/"> Lint rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-simulator-context/"> Simulator context </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-stdlib-modules/"> Standard library modules </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-test-case-schema/"> TestCase schema </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-validator-findings/"> Validator findings </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-value-wrappers/"> Value wrappers </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-explanation-agent-failure-modes/"> Agent failure modes </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-lint-vs-validate-vs-simulate-vs-test/"> Lint vs validate vs test </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-runtime-budget-and-shared-gates/"> Runtime budget and gates </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-sentinel-expression-engine/"> Sentinel expression engine </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-simulator-vs-rules-test-api/"> Simulator vs Rules Test API </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-the-2-plus-modules-extension/"> The 2+modules extension </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-value-wrappers-design/"> Value wrapper design </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric / sandbox</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-01-your-first-sandbox-session/"> Your first sandbox session </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-02-use-the-sandbox-in-a-test-harness/"> Sandbox in a test harness </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-03-build-a-traffic-monitor/"> Traffic monitor </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-multiple-isolated-sandboxes/"> Run isolated sandboxes </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-observe-events/"> Observe sandbox events </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-pick-an-adapter/"> Pick an adapter </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-replay-events/"> Replay events </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-reset-between-tests/"> Reset between tests </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-seed-data-and-rules/"> Seed data and rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-switch-users/"> Switch users </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-use-admin-reads/"> Use admin reads </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-divergences/"> Divergence </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-error-codes/"> SandboxError codes </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-internal-protocol/"> The /internal protocol </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-sandbox-and-context/"> Sandbox and context </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-sandbox-event/"> SandboxEvent </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-snapshot-and-admin/"> Snapshot and admin reads </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-every-op-is-a-request/"> Every operation is a request </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-identity-is-a-context/"> Identity is a context </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-internal-adapter-protocol/"> The /internal protocol </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-listener-re-evaluation/"> Listener re-evaluation </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-local-backend-vs-firestore-offline/"> Local backend vs. offline </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-why-adapters-are-siblings/"> Why adapters are siblings </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric / storage</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-storage/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-tutorials-01-upload-and-download/"> Upload and download </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-how-to-enforce-rules/"> Enforce Storage rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-list-and-delete/"> List and delete objects </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-round-trip-metadata/"> Round-trip metadata </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-switch-backends/"> Switch backends </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-test-rule-expressions/"> Test rule expressions </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-error-codes/"> Error codes </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-rules-subset/"> Storage rules subset </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-storage-options/"> StorageOptions </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-explanation-implementation-scope/"> Implementation scope </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-explanation-session-archive-use-case/"> The session-archive driver </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-explanation-why-indexeddb/"> Why IndexedDB </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" open> <summary>pyric / auth</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-auth/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-auth-reference-api/"> API reference </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-feature-matrix/"> Feature matrix </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-sandbox-test-driver/"> Sandbox test driver </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-auth-compat/" aria-current="page"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric / database</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-database/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-tutorials-01-author-rtdb-rules-with-constraints/"> Author RTDB rules </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-reference-rules-tooling/"> RTDB rules tooling </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-explanation-rules-authoring-and-deploy-are-separate/"> Authoring vs. deploy </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric-admin / firestore</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-tutorials-01-first-admin-session/"> First admin session </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-run-a-transaction/"> Run a transaction </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-seed-and-set-rules/"> Seed and set rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-translate-denials/"> Translate denials </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-use-onsnapshot/"> Use onSnapshot </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-write-a-batch/"> Write a batch </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-onsnapshot/"> onSnapshot overloads </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-re-exported-types/"> Re-exported types </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-sandbox-firestore/"> SandboxFirestore surface </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-error-translation/"> Error translation </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-per-call-delegate/"> Per-call delegate </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-why-mirror-admin-shape/"> Why mirror the admin SDK </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>@pyric/ui</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ui/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Primitives </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-primitives-badge/"> &lt;Badge&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-confirmdialog/"> &lt;ConfirmDialog&gt; + useConfirm </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-copybutton/"> &lt;CopyButton&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-jsonview/"> &lt;JsonView&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-segmentedcontrol/"> &lt;SegmentedControl&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-toast/"> &lt;ToastProvider&gt; + useToast </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-virtuallist/"> &lt;VirtualList&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Firestore </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-firestore-collectionlist/"> &lt;CollectionList&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-deletewithconfirm/"> &lt;DeleteWithConfirm&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documenteditor/"> &lt;DocumentEditor&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documentlist/"> &lt;DocumentList&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documentpreview/"> &lt;DocumentPreview&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-querybuilder/"> &lt;QueryBuilder&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-referencepicker/"> &lt;ReferencePicker&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Storage </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-storage-deleteselectionwithconfirm/"> &lt;DeleteSelectionWithConfirm&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-objectbrowser/"> &lt;ObjectBrowser&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-objectinspector/"> &lt;ObjectInspector&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-pathbreadcrumb/"> &lt;PathBreadcrumb&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage/"> @pyric/ui/storage </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-uploaddropzone/"> &lt;UploadDropzone&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-rules-aware-affordances/"> Rules-aware affordances </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-usestoragerulesgate/"> useStorageRulesGate </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Traffic </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-traffic/"> @pyric/ui/traffic </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-ruleheatmap/"> &lt;RuleHeatmap&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficdetail/"> &lt;TrafficDetail&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficlog/"> TrafficLog components </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficstats/"> &lt;TrafficStats&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Auth </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-auth-authsigninhelper/"> AuthSignInHelper </a> </li><li> <a href="/__pyric/ui/docs/ui-auth-authusers/"> Auth users admin </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <details class="docs-nav-group" id="nav-group-pyric-tools"> <summary>pyric-tools</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-tools/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-getting-started/"> Getting started </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-server-adoption/"> Server adoption </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-wire-claude-code/"> Wire Claude Code </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-how-to-build-a-standalone-binary/"> Build a standalone binary </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-configure-auth-providers-and-domains/"> Configure auth providers </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-discover-a-schema-from-firestore/"> Infer a schema </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-promote-sandbox-state-to-a-fixture/"> Promote sandbox state </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-serve-persistence-and-multi-tab/"> Persistence &amp; multi-tab </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-use-the-vite-plugin/"> Use the Vite plugin </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-verify-against-a-captured-session/"> Verify rules against prod </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-reference-cli/"> pyric CLI reference </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-reference-verify/"> Verify API </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-bridge"> Bridge </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-bridge/"> pyric-tools/bridge </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-tools-deploy"> <summary>pyric-tools / deploy</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-deploy-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-tutorials-01-deploy-a-cloud-function/"> Deploy a Cloud Function </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-deploy-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-build-projectscope-from-firebase-auth/"> Scope from Firebase Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-build-projectscope-from-service-account/"> Scope from service account </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-bundle-and-deploy-a-function/"> Bundle &amp; deploy a function </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-firestore-indexes/"> Deploy Firestore indexes </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-firestore-rules/"> Deploy Firestore rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-hosting-rewrites/"> Deploy Hosting rewrites </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-realtime-database-rules/"> Deploy RTDB rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-to-a-preview-channel/"> Deploy to a preview channel </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-handle-errors-and-outcomes/"> Handle errors and outcomes </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-provision-a-firestore-database/"> Provision a database </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-register-tools-with-an-agent/"> Register deploy tools </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-deploy-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-cli-agent-io/"> pyric deploy agent I/O </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-error-codes/"> Error codes by operation </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-firestore-namespace/"> firestore namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-functions-namespace/"> functions namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-hosting-config/"> firebase.json hosting config </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-hosting-namespace/"> hosting namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-rtdb-namespace/"> rtdb namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-scope-and-outcome/"> Scope and Outcome </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-tool-factories/"> Tool factories </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-deploy-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-primitives-vs-orchestrators/"> Primitives vs. orchestrators </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-token-caching/"> Token caching and memoizeTtl </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-why-no-firebase-cli/"> Why no Firebase CLI </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-firestore"> <summary>pyric / firestore</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-firestore-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-tutorials-01-write-a-sandbox-demo/"> Sandbox-backed demo </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-tutorials-02-swap-to-prod-backend/"> Swap to prod backend </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-firestore-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-build-queries/"> Build queries </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-migrate-from-firebase-firestore/"> Migrate from Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-pick-a-backend/"> Pick a backend </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-run-a-transaction/"> Run a transaction </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-use-onsnapshot/"> Use onSnapshot </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-use-sandbox-ops/"> Use sandbox-only ops </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-firestore-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-feature-matrix/"> Feature matrix </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-getfirestore/"> getFirestore overloads </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-query-constraints/"> Query constraints </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-sandbox-ops/"> Sandbox-only operations </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-tool-factories/"> Tool factories </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-firestore-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-rules-tooling-is-separate/"> Rules tooling is separate </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-target-symbol-opacity/"> TARGET_SYMBOL opacity </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-two-backends-one-surface/"> Two backends, one surface </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-firestore-compat"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-rules"> <summary>pyric / rules</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-rules/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-rules-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-tutorials-01-lint-your-first-rules-file/"> Lint your first rules file </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-tutorials-02-write-a-test-suite-for-your-rules/"> Write a rules test suite </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-rules-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-how-to-compare-rulesets-for-weakening/"> Compare rulesets </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-inspect-rules-via-the-ast/"> Inspect rules via the AST </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-lint-rules-source/"> Lint a rules source </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-pin-request-time/"> Pin request.time </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-register-tools-with-an-agent/"> Register rules tools </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-resolve-module-imports/"> Resolve 2+modules imports </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-simulate-rules-locally/"> Simulate rules locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-test-rules-against-firebase/"> Test rules against Firebase </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-rules-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-ast/"> AST </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-errors/"> Errors </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-lint-rules/"> Lint rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-simulator-context/"> Simulator context </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-stdlib-modules/"> Standard library modules </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-test-case-schema/"> TestCase schema </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-validator-findings/"> Validator findings </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-value-wrappers/"> Value wrappers </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-rules-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-explanation-agent-failure-modes/"> Agent failure modes </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-lint-vs-validate-vs-simulate-vs-test/"> Lint vs validate vs test </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-runtime-budget-and-shared-gates/"> Runtime budget and gates </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-sentinel-expression-engine/"> Sentinel expression engine </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-simulator-vs-rules-test-api/"> Simulator vs Rules Test API </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-the-2-plus-modules-extension/"> The 2+modules extension </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-value-wrappers-design/"> Value wrapper design </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-sandbox"> <summary>pyric / sandbox</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-sandbox-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-01-your-first-sandbox-session/"> Your first sandbox session </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-02-use-the-sandbox-in-a-test-harness/"> Sandbox in a test harness </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-03-build-a-traffic-monitor/"> Traffic monitor </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-sandbox-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-multiple-isolated-sandboxes/"> Run isolated sandboxes </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-observe-events/"> Observe sandbox events </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-pick-an-adapter/"> Pick an adapter </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-replay-events/"> Replay events </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-reset-between-tests/"> Reset between tests </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-seed-data-and-rules/"> Seed data and rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-switch-users/"> Switch users </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-use-admin-reads/"> Use admin reads </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-sandbox-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-divergences/"> Divergence </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-error-codes/"> SandboxError codes </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-internal-protocol/"> The /internal protocol </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-sandbox-and-context/"> Sandbox and context </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-sandbox-event/"> SandboxEvent </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-snapshot-and-admin/"> Snapshot and admin reads </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-sandbox-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-every-op-is-a-request/"> Every operation is a request </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-identity-is-a-context/"> Identity is a context </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-internal-adapter-protocol/"> The /internal protocol </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-listener-re-evaluation/"> Listener re-evaluation </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-local-backend-vs-firestore-offline/"> Local backend vs. offline </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-why-adapters-are-siblings/"> Why adapters are siblings </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-storage"> <summary>pyric / storage</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-storage/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-storage-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-tutorials-01-upload-and-download/"> Upload and download </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-storage-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-how-to-enforce-rules/"> Enforce Storage rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-list-and-delete/"> List and delete objects </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-round-trip-metadata/"> Round-trip metadata </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-switch-backends/"> Switch backends </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-test-rule-expressions/"> Test rule expressions </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-storage-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-error-codes/"> Error codes </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-rules-subset/"> Storage rules subset </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-storage-options/"> StorageOptions </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-storage-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-explanation-implementation-scope/"> Implementation scope </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-explanation-session-archive-use-case/"> The session-archive driver </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-explanation-why-indexeddb/"> Why IndexedDB </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-storage-compat"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-auth" open> <summary>pyric / auth</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-auth/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-auth-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-auth-reference-api/"> API reference </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-feature-matrix/"> Feature matrix </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-sandbox-test-driver/"> Sandbox test driver </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-auth-compat"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-auth-compat/" aria-current="page"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-database"> <summary>pyric / database</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-database/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-database-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-tutorials-01-author-rtdb-rules-with-constraints/"> Author RTDB rules </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-database-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-reference-rules-tooling/"> RTDB rules tooling </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-database-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-explanation-rules-authoring-and-deploy-are-separate/"> Authoring vs. deploy </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-database-compat"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-admin-firestore"> <summary>pyric-admin / firestore</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-admin-firestore-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-tutorials-01-first-admin-session/"> First admin session </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-admin-firestore-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-run-a-transaction/"> Run a transaction </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-seed-and-set-rules/"> Seed and set rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-translate-denials/"> Translate denials </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-use-onsnapshot/"> Use onSnapshot </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-write-a-batch/"> Write a batch </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-admin-firestore-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-onsnapshot/"> onSnapshot overloads </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-re-exported-types/"> Re-exported types </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-sandbox-firestore/"> SandboxFirestore surface </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-admin-firestore-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-error-translation/"> Error translation </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-per-call-delegate/"> Per-call delegate </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-why-mirror-admin-shape/"> Why mirror the admin SDK </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-ui"> <summary>@pyric/ui</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ui/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-ui-primitives"> Primitives </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-primitives-badge/"> &lt;Badge&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-confirmdialog/"> &lt;ConfirmDialog&gt; + useConfirm </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-copybutton/"> &lt;CopyButton&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-jsonview/"> &lt;JsonView&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-segmentedcontrol/"> &lt;SegmentedControl&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-toast/"> &lt;ToastProvider&gt; + useToast </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-virtuallist/"> &lt;VirtualList&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-ui-firestore"> Firestore </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-firestore-collectionlist/"> &lt;CollectionList&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-deletewithconfirm/"> &lt;DeleteWithConfirm&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documenteditor/"> &lt;DocumentEditor&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documentlist/"> &lt;DocumentList&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documentpreview/"> &lt;DocumentPreview&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-querybuilder/"> &lt;QueryBuilder&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-referencepicker/"> &lt;ReferencePicker&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-ui-storage"> Storage </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-storage-deleteselectionwithconfirm/"> &lt;DeleteSelectionWithConfirm&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-objectbrowser/"> &lt;ObjectBrowser&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-objectinspector/"> &lt;ObjectInspector&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-pathbreadcrumb/"> &lt;PathBreadcrumb&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage/"> @pyric/ui/storage </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-uploaddropzone/"> &lt;UploadDropzone&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-rules-aware-affordances/"> Rules-aware affordances </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-usestoragerulesgate/"> useStorageRulesGate </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-ui-traffic"> Traffic </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-traffic/"> @pyric/ui/traffic </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-ruleheatmap/"> &lt;RuleHeatmap&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficdetail/"> &lt;TrafficDetail&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficlog/"> TrafficLog components </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficstats/"> &lt;TrafficStats&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-ui-auth"> Auth </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-auth-authsigninhelper/"> AuthSignInHelper </a> </li><li> <a href="/__pyric/ui/docs/ui-auth-authusers/"> Auth users admin </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main"> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="/__pyric/ui/docs/pyric-auth/">pyric / auth</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <a href="#nav-section-pyric-auth-compat">Compat</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">Compatibility matrix</span> </li> </ol> </nav> <article class="prose">  <!-- Generated from scripts/compat/registry/*.ts. Do not edit by hand; run bun run compat:generate. -->
+<h1 id="pyricauth-compatibility-matrix"><code>pyric/auth</code> compatibility matrix</h1>
+<p>The single readable contract for “what this shim guarantees vs the
+production <code>firebase/auth</code> SDK.”</p>
+<p>See the design rationale for the methodology (vocabulary
+of conformance / oracle / matrix; how to add rows; how the runner
+attributes failures).</p>
+<h2 id="status-legend">Status legend</h2>
+<div class="table-scroll">
+<table><thead><tr><th>Status</th><th>Meaning</th></tr></thead><tbody><tr><td>✓</td><td><strong>Conforming</strong> — sandbox matches prod, locked by a passing probe</td></tr><tr><td>⚠</td><td><strong>Diverged (documented)</strong> — intentional difference with a written reason</td></tr><tr><td>✗</td><td><strong>Bug</strong> — should match prod but doesn’t; failing probe pins it</td></tr><tr><td>—</td><td><strong>Unsupported</strong> — not implemented yet (deliberately or pending)</td></tr><tr><td>?</td><td><strong>Unverified</strong> — claim from docs that we haven’t yet observed prod-side</td></tr></tbody></table></div>
+<p>Probe references: <code>playground:&#x3C;name></code> means a fixture under
+<code>packages/playground/scripts/fixtures/&#x3C;name>.tsx</code>. <code>unit:&#x3C;file></code>
+means a Bun test in <code>packages/auth/test/&#x3C;file></code>.</p>
+<hr>
+<h2 id="getauthtarget--initializer"><code>getAuth(target)</code> — initializer</h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>1</td><td>Returns a stable <code>Auth</code> handle for repeat calls with the same target — idempotent on BOTH the sandbox target (per-sandbox WeakMap) and the prod target (per-resolved-<code>fb.Auth</code> WeakMap; previously the prod wrapper was minted fresh per call)</td><td>✓</td><td><code>unit:sandbox-anonymous.test.ts</code> (sandbox) + <code>unit:prod-getauth-memo.test.ts</code> (prod, locks AUTH-B6)</td></tr><tr><td>2</td><td><code>getAuth(sandbox)</code> dispatches to the sandbox backend</td><td>✓</td><td><code>unit:sandbox-anonymous.test.ts</code></td></tr><tr><td>3</td><td><code>getAuth(app)</code> dispatches to the production backend</td><td>?</td><td>(no prod test harness yet)</td></tr><tr><td>4</td><td><code>getAuth(undefined)</code> — wrapped in the playground preview to default to the sandbox; raw call delegates to prod which throws <code>app/no-app</code></td><td>✓ (wrap)</td><td><code>playground:firestore-bare-getfirestore</code> (mirrors the <code>getFirestore</code> wrap from #397) + oracle: <code>scripts/oracle/observations/auth-bare-getauth-no-default-app.json</code> (<code>code: 'app/no-app'</code> against blockingfun, fb-js-sdk 12.13.0 — confirms prod throw shape)</td></tr><tr><td>5</td><td><code>auth.currentUser</code> is a live getter, not a snapshot — reads through to the backend on every access</td><td>✓</td><td>implicit in <code>unit:sandbox-anonymous.test.ts</code></td></tr></tbody></table></div>
+<h2 id="signinanonymouslyauth--anonymous"><code>signInAnonymously(auth)</code> — anonymous</h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>6</td><td>Returns <code>UserCredential</code> with <code>providerId: null</code>, <code>operationType: 'signIn'</code>, and a <code>User</code> with <code>isAnonymous: true</code>, <code>email: null</code>, <code>displayName: null</code></td><td>✓</td><td><code>unit:sandbox-anonymous.test.ts</code>, <code>playground:auth-anonymous</code> (bundled) + <code>playground:auth-row-6-anon-credential-shape</code> (one-claim) + oracle: <code>scripts/oracle/observations/auth-anonymous-credential-providerid.json</code> (<code>providerId: null</code> against blockingfun, fb-js-sdk 12.13.0). Prior matrix language said <code>providerId: 'anonymous'</code>; corrected after empirical observation. Sandbox aligned to prod in the same commit.</td></tr><tr><td>7</td><td>Auto-generates a uid for fresh sign-ins (sandbox format: <code>anonymous-{N}</code>)</td><td>⚠ format</td><td><code>unit:sandbox-anonymous.test.ts</code> — prod uids are 28-char base64-ish; sandbox uses a readable counter for debuggability</td></tr><tr><td>8</td><td>If an anonymous user is already signed in, returns the SAME user (no fresh uid mint)</td><td>✓</td><td><code>unit:sandbox-anonymous.test.ts</code> (“idempotent while signed in”) — fix from #399</td></tr><tr><td>9</td><td>After <code>signOut</code>, a subsequent <code>signInAnonymously</code> mints a fresh uid</td><td>✓</td><td><code>unit:sandbox-anonymous.test.ts</code>, <code>playground:auth-anonymous</code> (bundled) + <code>playground:auth-row-9-anon-fresh-uid-after-signout</code> (one-claim)</td></tr><tr><td>10</td><td>Fires <code>onAuthStateChanged</code> exactly once per state transition (no same-value double-fire)</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code>, <code>playground:auth-anonymous</code> (bundled) + <code>playground:auth-row-10-onauthstatechanged-one-per-transition</code> (one-claim) — fix from #399 + oracle: <code>scripts/oracle/observations/auth-row-10-onauthstatechanged-one-per-transition.json</code> (against blockingfun, fb-js-sdk 12.13.0: subscribe → 1 initial null fire → <code>signInAnonymously</code> → +1 → <code>signOut</code> → +1 → <code>signInAnonymously</code> → +1. <code>eachTransitionFiredExactlyOnce: true</code> — every transition produces exactly one fire)</td></tr><tr><td>11</td><td>Writes through to <code>sandbox.currentUser</code> so rules engines see <code>request.auth.uid</code></td><td>✓</td><td><code>unit:sandbox-anonymous.test.ts</code>, <code>playground:auth-anonymous</code> (bundled) + <code>playground:auth-row-11-anon-uid-visible-to-rules</code> (one-claim)</td></tr><tr><td>12</td><td>Anonymous users persist across page reload via configured <code>Persistence</code> (prod only — sandbox has no persistence layer)</td><td>⚠</td><td>divergence: sandbox memory only; within one tab the user persists, across reload they don’t</td></tr></tbody></table></div>
+<h2 id="signinwithemailandpasswordauth-email-password--password"><code>signInWithEmailAndPassword(auth, email, password)</code> — password</h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>13</td><td>Returns <code>UserCredential</code> with <code>providerId: null</code> (NOT <code>'password'</code> — only OAuth/phone responses carry a providerId; upstream <code>providerIdForResponse</code> returns null for email/password), <code>operationType: 'signIn'</code>, and a <code>User</code> with the stored uid + email</td><td>✓</td><td><code>unit:sandbox-email-password.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-createUser-operationType.json</code> (<code>providerId: null</code> against blockingfun, fb-js-sdk 12.13.0). Prior matrix language said <code>providerId: 'password'</code>; corrected after the oracle contradicted it (AUTH-B2).</td></tr><tr><td>14</td><td>Throws <code>auth/user-not-found</code> when the email isn’t seeded / hasn’t been created</td><td>✓</td><td><code>unit:sandbox-email-password.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-user-not-found-error-code.json</code> (<code>code: 'auth/user-not-found'</code> against blockingfun, fb-js-sdk 12.13.0; matches sandbox)</td></tr><tr><td>15</td><td>Throws <code>auth/wrong-password</code> when the password doesn’t match</td><td>✓</td><td><code>unit:sandbox-email-password.test.ts</code>, <code>playground:auth-email-password</code> (bundled) + <code>playground:auth-row-15-wrong-password-rejects</code> (one-claim) + oracle: <code>scripts/oracle/observations/auth-wrong-password-error-code.json</code> (<code>code: 'auth/wrong-password'</code> against blockingfun, fb-js-sdk 12.13.0; matches sandbox)</td></tr><tr><td>15a</td><td>An EMPTY password throws <code>auth/missing-password</code> (message “A non-empty password must be provided”), fired before the user-DB lookup so it can’t be used to enumerate seeded emails. Upstream maps the <code>MISSING_PASSWORD</code> server error (<code>core/errors.ts:92,282,563</code>). ⚠ best-known semantics — message text not yet captured against a live project (STOP-flagged for an oracle pass; the <code>.code</code> is the load-bearing part).</td><td>⚠</td><td><code>unit:sandbox-cluster-b9-b12.test.ts</code> (locks AUTH-B11)</td></tr><tr><td>16</td><td>Re-signing in after <code>signOut</code> returns the <strong>same</strong> uid (passwords persist within the sandbox lifetime)</td><td>✓</td><td><code>playground:auth-email-password</code> (bundled) + <code>playground:auth-row-16-resignin-same-uid</code> (one-claim)</td></tr><tr><td>17</td><td>Fires <code>onAuthStateChanged</code> with the new user once</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-17-signin-email-password-fires-once.json</code> (against blockingfun, fb-js-sdk 12.13.0: createUser → signOut → subscribe (1 initial null fire) → <code>signInWithEmailAndPassword</code> → <code>firesForSignIn: 1</code> with the signed-in uid, <code>lastFireUidMatches: true</code>)</td></tr><tr><td>18</td><td>Email validation (RFC 5322ish) — rejects empty, missing <code>@</code>, missing local-part, missing domain with <code>auth/invalid-email</code>. Runs on both <code>signInWithEmailAndPassword</code> and <code>createUserWithEmailAndPassword</code> before any user-DB lookup, so consumers shipping malformed input see the same error sandbox vs prod.</td><td>✓</td><td><code>unit:sandbox-email-password.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-18-invalid-email-error-code.json</code> (<code>code: 'auth/invalid-email'</code>, message <code>Firebase: Error (auth/invalid-email).</code> against blockingfun, fb-js-sdk 12.13.0)</td></tr><tr><td>19</td><td>Password strength requirements — rejects passwords shorter than 6 chars with <code>auth/weak-password</code> on <code>createUserWithEmailAndPassword</code>. Strength is NOT enforced on <code>signInWithEmailAndPassword</code> so previously-seeded weak passwords still let the user in (matches prod’s separation of registration vs sign-in).</td><td>✓</td><td><code>unit:sandbox-email-password.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-19-weak-password-error-code.json</code> (<code>code: 'auth/weak-password'</code>, message <code>Firebase: Password should be at least 6 characters (auth/weak-password).</code> against blockingfun, fb-js-sdk 12.13.0; matrix language “≥6 chars per prod default” empirically confirmed)</td></tr><tr><td>69</td><td>Disabled accounts (<code>sandbox.updateUser(…, {disabled: true})</code>) reject sign-in with <code>auth/user-disabled</code> and prod’s documented message (<code>The user account has been disabled by an administrator.</code>). Sandbox checks disabled BEFORE the password compare (anti-probing); the exact prod ordering of disabled-vs-wrong-password needs an oracle capture</td><td>✓ code / ? ordering</td><td><code>unit:sandbox-user-admin.test.ts</code> (“disabled users”)</td></tr></tbody></table></div>
+<h2 id="createuserwithemailandpasswordauth-email-password--register"><code>createUserWithEmailAndPassword(auth, email, password)</code> — register</h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>20</td><td>Creates a new user, signs them in automatically (currentUser becomes the new user)</td><td>✓</td><td><code>playground:auth-email-password</code> (bundled) + <code>playground:auth-row-20-create-user-auto-signs-in</code> (one-claim), <code>unit:sandbox-email-password.test.ts</code></td></tr><tr><td>21</td><td>Returns <code>UserCredential</code> with <code>operationType: 'signIn'</code> (NOT <code>'register'</code> — matches prod)</td><td>✓</td><td><code>unit:sandbox-email-password.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-createUser-operationType.json</code> (<code>operationType: 'signIn'</code> against blockingfun, fb-js-sdk 12.13.0; matches sandbox)</td></tr><tr><td>22</td><td>Throws <code>auth/email-already-in-use</code> when the email is already registered</td><td>✓</td><td><code>unit:sandbox-email-password.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-email-already-in-use-error-code.json</code> (<code>code: 'auth/email-already-in-use'</code> against blockingfun, fb-js-sdk 12.13.0; matches sandbox)</td></tr><tr><td>23</td><td>The created user has <code>isAnonymous: false</code>, <code>email: &#x3C;input></code>, <code>displayName: null</code></td><td>✓</td><td><code>unit:sandbox-email-password.test.ts</code> + <code>playground:auth-row-23-create-user-shape</code> (one-claim)</td></tr><tr><td>24</td><td>Fires <code>onAuthStateChanged</code> with the new user once</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-24-createuser-fires-once.json</code> (against blockingfun, fb-js-sdk 12.13.0: subscribe (1 initial null fire) → <code>createUserWithEmailAndPassword</code> → <code>firesForCreate: 1</code> with the newly-created uid, <code>lastFireUidMatches: true</code>)</td></tr></tbody></table></div>
+<h2 id="signoutauth"><code>signOut(auth)</code></h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>25</td><td>Sets <code>currentUser</code> to <code>null</code> synchronously after resolution</td><td>✓</td><td><code>playground:auth-anonymous</code> (bundled) + <code>playground:auth-row-25-signout-currentuser-null</code> (one-claim), <code>unit:sandbox-anonymous.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-25-signout-currentuser-null-sync.json</code> (<code>currentUserIsNullSync: true</code> against blockingfun, fb-js-sdk 12.13.0 — <code>auth.currentUser</code> read in the synchronous continuation immediately after <code>await signOut(auth)</code> is already <code>null</code>, with no microtask/macrotask required to settle)</td></tr><tr><td>26</td><td>Fires <code>onAuthStateChanged</code> with <code>null</code> exactly once</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code>, <code>playground:auth-anonymous</code> (bundled) + <code>playground:auth-row-26-signout-fires-null-once</code> (one-claim) + oracle: <code>scripts/oracle/observations/auth-row-26-signout-fires-null-once.json</code> (against blockingfun, fb-js-sdk 12.13.0: subscribe (1 initial null fire) → <code>signInAnonymously</code> → <code>signOut</code> → <code>firesForSignOut: 1</code> with <code>lastFireUidWasNull: true</code>)</td></tr><tr><td>27</td><td>Idempotent — <code>signOut</code> on already-signed-out user is a no-op (no listener fire)</td><td>✓</td><td><code>playground:auth-signout-idempotent</code> + oracle-confirmed: <code>scripts/oracle/observations/auth-signout-idempotent.json</code> (<code>threw: false, redundantSignOutFiredListener: false</code> against blockingfun)</td></tr><tr><td>28</td><td>Clears the active session’s persistence in prod; sandbox has no persistence</td><td>⚠</td><td>divergence: same memory-only constraint as the anonymous persistence row</td></tr></tbody></table></div>
+<h2 id="onauthstatechangedauth-observer"><code>onAuthStateChanged(auth, observer)</code></h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>29</td><td>Fires immediately on subscribe with the current value (microtask-deferred)</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-29-onauthstatechanged-initial-fire-timing.json</code> (<code>firedSynchronously: 0, firedAfterMicrotask: 1</code> against blockingfun, fb-js-sdk 12.13.0 — initial fire does NOT arrive in the synchronous tick of <code>onAuthStateChanged(...)</code>; it lands after the first microtask flush)</td></tr><tr><td>30</td><td>Fires on every subsequent identity change</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code>, <code>playground:auth-anonymous</code> + oracle: <code>scripts/oracle/observations/auth-row-30-onauthstatechanged-fires-on-every-transition.json</code> (against blockingfun, fb-js-sdk 12.13.0: subscribe → <code>signIn</code> → <code>signOut</code> → <code>signIn</code> → <code>signOut</code>, each of the 4 transitions produced exactly 1 fire; <code>eachTransitionFiredExactlyOnce: true</code>)</td></tr><tr><td>30a</td><td>Dedups by uid: a same-uid update (profile-shape change, or a same-uid re-sign-in) does NOT re-fire <code>onAuthStateChanged</code> — only an actual uid change does. Mirrors upstream <code>notifyAuthListeners</code>’s <code>lastNotifiedUid</code> gate (<code>auth_impl.ts:718-723</code>). (<code>onIdTokenChanged</code> still fires on those same-uid updates — see row 38a.)</td><td>✓</td><td><code>unit:sandbox-uid-dedup.test.ts</code> (locks AUTH-B7 / B8)</td></tr><tr><td>31</td><td><strong>No duplicate fire</strong> when subscribe is followed by a synchronous <code>setCurrentUser</code> — dedup ensures observer sees the new value once, not twice. Sandbox-only concern: prod has no synchronous state-change API, so the dedup window can’t be exercised against the cloud SDK; subscribe-then-async-signIn naturally fires twice (initial + new value) because the microtask between them flushes the initial fire</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code> (regression test from #399), <code>playground:auth-anonymous</code> + oracle baseline: <code>scripts/oracle/observations/auth-row-31-onauthstatechanged-no-dup-on-sync-transition.json</code> (against blockingfun, fb-js-sdk 12.13.0: subscribe + async <code>signInAnonymously</code> in the same tick produces <code>totalFires: 2</code> — <code>{uid: null, ts: 0}</code> then <code>{uid: &#x3C;user>, ts: ~400ms}</code>. Confirms prod cannot exhibit the same-tick race; the dedup behavior remains a sandbox-only property)</td></tr><tr><td>32</td><td>Returned <code>Unsubscribe</code> removes the observer; subsequent state changes do NOT fire it</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code>, <code>playground:auth-listener-unsub</code> (bundled) + <code>playground:auth-row-32-unsubscribe-stops-fires</code> (one-claim) + oracle: <code>scripts/oracle/observations/auth-row-32-unsubscribe-stops-fires.json</code> (against blockingfun, fb-js-sdk 12.13.0: subscribe → 1 fire on <code>signInAnonymously</code> → call <code>unsub()</code> → <code>signOut</code> + <code>signInAnonymously</code> + <code>signOut</code> produce zero further fires; <code>postUnsubFires: 0, unsubscribeStoppedFires: true</code>)</td></tr><tr><td>33</td><td>Multiple subscribers all fire on each change</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-33-multiple-subscribers-all-fire.json</code> (against blockingfun, fb-js-sdk 12.13.0: two subscribers registered back-to-back each see 1 initial null fire, +1 on <code>signInAnonymously</code>, +1 on <code>signOut</code>; <code>bothFiredOnSignIn: true, bothFiredOnSignOut: true</code>)</td></tr><tr><td>33a</td><td>Registry is array-backed (matches upstream <code>util/subscribe.ts</code>): the SAME observer fn registered N times produces N independent registrations that each fire, and one <code>Unsubscribe</code> removes exactly one registration. A resubscribe of a previously-unsubscribed fn fires its initial value again. (Per-registration initial-fire bookkeeping, not a shared per-observer dedup.)</td><td>✓</td><td><code>unit:sandbox-listener-registry.test.ts</code> (locks AUTH-B3 + AUTH-B4)</td></tr><tr><td>34</td><td>Unsubscribing during emission does not skip remaining subscribers (snapshotted iteration)</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code></td></tr><tr><td>35</td><td>A throwing observer doesn’t block other observers from firing</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-35-throwing-observer-doesnt-block-others.json</code> (<code>secondObserverContinuedFiring: true</code> against blockingfun, fb-js-sdk 12.13.0 — observer #1 throws on every call, observer #2 still counts the initial fire AND the post-sign-in fire)</td></tr><tr><td>36</td><td>Observer object form (<code>{next, error, complete}</code>) works alongside the function form</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-36-observer-object-form-works.json</code> (against blockingfun, fb-js-sdk 12.13.0: one observer as <code>NextFn</code>, another as <code>{next, error, complete}</code>. Both forms see 1 initial null fire, +1 on <code>signInAnonymously</code>, +1 on <code>signOut</code>; <code>bothFormsFiredOnSignIn: true, bothFormsFiredOnSignOut: true</code>)</td></tr><tr><td>37</td><td>Setting the same user twice does NOT double-fire (structural-equality no-op). Sandbox-internal <code>setCurrentUser</code> claim; the prod analog is <code>signInAnonymously</code> called twice in a row (per fix #399, the second call returns the same user).</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-37-same-user-no-double-fire.json</code> (against blockingfun, fb-js-sdk 12.13.0: first <code>signInAnonymously</code> fires the listener once; second call returns the same uid (<code>sameUserAcrossCalls: true</code>) and does NOT produce a fresh fire (<code>secondSignInProducedFire: false</code>). Prod also recognizes the same-user no-op)</td></tr></tbody></table></div>
+<h2 id="onidtokenchangedauth-observer"><code>onIdTokenChanged(auth, observer)</code></h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>38</td><td>Fires on user change (sandbox shares the auth-state path)</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-38-onidtokenchanged-fires-on-user-change.json</code> (against blockingfun, fb-js-sdk 12.13.0: subscribe → 1 initial fire (null) → <code>signInAnonymously</code> → +1 (user₁) → <code>signOut</code> → +1 (null) → <code>signInAnonymously</code> → +1 (user₂ with fresh uid). Every identity transition produces exactly one fire, matching <code>onAuthStateChanged</code>)</td></tr><tr><td>38a</td><td>Fires on EVERY sign-in, including a same-uid re-sign-in (no <code>signOut</code> first) — which mints a fresh token, so a subsequent <code>getIdToken()</code> returns a new string. Mirrors upstream <code>notifyAuthListeners</code>, which calls <code>idTokenSubscription.next</code> on every identity update (<code>auth_impl.ts:716</code>). <code>onAuthStateChanged</code> stays silent on the same-uid case (row 30a).</td><td>✓</td><td><code>unit:sandbox-uid-dedup.test.ts</code> (locks AUTH-B8)</td></tr><tr><td>39</td><td>Fires on token refresh (<code>getIdToken(true)</code>)</td><td>✓</td><td><code>unit:sandbox-token-refresh.test.ts</code> — was ⚠ (documented divergence); aligned to prod in commit on branch <code>claude/close-auth-token-refresh</code> — sandbox now mints a fresh token on forceRefresh and fires <code>onIdTokenChanged</code> (NOT <code>onAuthStateChanged</code>, since identity is unchanged). Oracle: <code>scripts/oracle/observations/auth-onidtokenchanged-force-refresh.json</code> defines the target shape (<code>refreshFiredListener: true</code> against blockingfun; subscribe → null fire → <code>signInAnonymously</code> → +1 → <code>getIdToken(true)</code> → +1 for a total of 3 fires).</td></tr><tr><td>40</td><td>Initial-fire semantics match <code>onAuthStateChanged</code></td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code> + oracle: <code>scripts/oracle/observations/auth-row-40-onidtokenchanged-matches-onauthstatechanged-initial-fire.json</code> (against blockingfun, fb-js-sdk 12.13.0: subscribing both listeners in the same tick yields <code>sync: {auth: 0, idToken: 0}</code> → <code>microtask: {auth: 1, idToken: 1}</code> → no further fires. Both listeners share the microtask-deferred initial-fire timing)</td></tr></tbody></table></div>
+<h2 id="setpersistenceauth-persistence"><code>setPersistence(auth, persistence)</code></h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>41</td><td>Accepts <code>inMemoryPersistence</code> / <code>browserSessionPersistence</code> / <code>browserLocalPersistence</code> markers without throwing</td><td>✓</td><td><code>unit:types.test.ts</code></td></tr><tr><td>42</td><td>Returns <code>Promise&#x3C;void></code></td><td>✓</td><td><code>unit:types.test.ts</code></td></tr><tr><td>43</td><td>Actually changes where the auth state is persisted</td><td>⚠</td><td>divergence: sandbox is a no-op. Prod respects the marker.</td></tr><tr><td>43a</td><td>An unrecognized persistence marker (not one of the three) is rejected with <code>auth/argument-error</code> on the prod backend, rather than silently coerced to LOCAL</td><td>✓</td><td><code>unit:sandbox-cluster-b9-b12.test.ts</code> (locks AUTH-B12)</td></tr></tbody></table></div>
+<h2 id="signinwithpopupauth-provider--signinwithcredentialauth-credential"><code>signInWithPopup(auth, provider)</code> / <code>signInWithCredential(auth, credential)</code></h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>44</td><td>Returns the pre-staged <code>UserCredential</code> registered via <code>sandbox.mockSignInResult(auth, …)</code></td><td>✓</td><td><code>unit:sandbox-providers.test.ts</code></td></tr><tr><td>45</td><td>Throws <code>auth/no-mock-configured</code> when no mock is pre-staged</td><td>✓</td><td><code>unit:sandbox-providers.test.ts</code></td></tr><tr><td>46</td><td>Mock is consumed after one read (subsequent call without a fresh stage throws again)</td><td>✓</td><td><code>unit:sandbox-providers.test.ts</code></td></tr><tr><td>47</td><td>After successful sign-in, <code>currentUser</code> becomes the mock’s <code>user</code>, listeners fire</td><td>✓</td><td><code>unit:sandbox-providers.test.ts</code></td></tr><tr><td>47a</td><td>The credential’s rich <code>User</code> (email / displayName / isAnonymous) survives the transition — popup/redirect/credential/<code>setUser</code> do NOT clobber it down to the bare <code>AuthState</code>; <code>cred.user === auth.currentUser</code> (reference identity, matches upstream <code>_updateCurrentUser(userCredential.user)</code>)</td><td>✓</td><td><code>unit:sandbox-user-identity.test.ts</code> (locks AUTH-B1)</td></tr><tr><td>48</td><td>Opens a popup window in prod</td><td>⚠</td><td>divergence: sandbox skips the popup; mock pre-stage replaces the popup result</td></tr><tr><td>49</td><td>Cancels with <code>auth/popup-closed-by-user</code> when the user dismisses the popup (prod)</td><td>—</td><td>not modeled — would require the host to expose a “cancel” affordance on the mock</td></tr><tr><td>70</td><td>Provider-flow sign-ins (popup / redirect / credential) record the flow’s <code>providerId</code> on the identity in the user DB (upsert for unknown uids; append-if-missing for known ones) and reject disabled accounts with <code>auth/user-disabled</code> before any state change</td><td>✓</td><td><code>unit:sandbox-user-admin.test.ts</code> (“provider tracking”, “disabled users”) — provider recording is sandbox bookkeeping for <code>listIdentities</code>/<code>listUsers</code>; prod’s auto-link semantics are narrower (same-email Google auto-link only) and not modeled</td></tr></tbody></table></div>
+<h2 id="signinwithredirect--getredirectresult--resolver-seam"><code>signInWithRedirect</code> / <code>getRedirectResult</code> / resolver seam</h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>49a</td><td><code>signInWithRedirect(auth, provider, resolver?)</code> resolves the flow (per-call resolver → injected → one-shot mock → <code>auth/argument-error</code>), signs the user in, and stashes the credential for one <code>getRedirectResult</code></td><td>✓</td><td><code>unit:sandbox-resolver.test.ts</code></td></tr><tr><td>49b</td><td><code>getRedirectResult(auth)</code> returns the stashed credential once, then <code>null</code> (one-shot, matches prod)</td><td>✓</td><td><code>unit:sandbox-resolver.test.ts</code></td></tr><tr><td>49c</td><td><code>sandbox.setAuthFlowResolver(auth, resolver | null)</code> installs / clears the popup/redirect resolver (the analog of browser <code>getAuth</code> wiring <code>browserPopupRedirectResolver</code>)</td><td>✓</td><td><code>unit:sandbox-resolver.test.ts</code></td></tr><tr><td>49d</td><td><code>sandbox.listIdentities(auth)</code> snapshots every seeded/created identity for a host account-picker (sandbox-only — no <code>firebase/auth</code> equivalent)</td><td>✓</td><td><code>unit:sandbox-resolver.test.ts</code></td></tr></tbody></table></div>
+<h2 id="auth-surface--error-shape"><code>Auth</code> surface + error shape</h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>49e</td><td><code>auth.signOut()</code> method form works alongside the free <code>signOut(auth)</code> function (<code>firebase/auth</code>’s <code>Auth</code> exposes both) (AUTH-GAP)</td><td>✓</td><td><code>unit:auth-gap-surface.test.ts</code></td></tr><tr><td>49f</td><td>Sandbox auth errors are real <code>FirebaseError</code> instances (<code>err instanceof FirebaseError</code>) carrying the prod message wrapper <code>Firebase: &#x3C;message> (&#x3C;auth/...>).</code> — e.g. <code>Firebase: Error (auth/invalid-email).</code>, matching the oracle (AUTH-GAP)</td><td>✓</td><td><code>unit:auth-gap-surface.test.ts</code></td></tr></tbody></table></div>
+<h2 id="provider-classes-googleauthprovider-emailauthprovider-etc">Provider classes (<code>GoogleAuthProvider</code>, <code>EmailAuthProvider</code>, etc.)</h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>50</td><td>Exports the same constructor signatures as <code>firebase/auth</code> for each provider</td><td>✓</td><td>type-only smoke in <code>unit:types.test.ts</code></td></tr><tr><td>51</td><td><code>Provider.credential(...)</code> static factories produce <code>AuthCredential</code>-shaped objects</td><td>✓</td><td><code>unit:sandbox-providers.test.ts</code></td></tr><tr><td>52</td><td><code>GoogleAuthProvider.providerId === 'google.com'</code> (and per-provider analogs)</td><td>✓</td><td><code>unit:sandbox-providers.test.ts</code></td></tr><tr><td>53</td><td>Custom scopes / params / language code</td><td>—</td><td>sandbox ignores; prod forwards</td></tr></tbody></table></div>
+<h2 id="user-methods"><code>User</code> methods</h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>54</td><td><code>user.getIdToken()</code> returns a stable opaque token in sandbox (<code>sandbox-id-token-…</code>)</td><td>✓</td><td><code>unit:sandbox-anonymous.test.ts</code></td></tr><tr><td>55</td><td><code>user.getIdToken(true)</code> (forceRefresh) returns a NEW token; subsequent <code>getIdToken(false)</code> returns the cached new token</td><td>✓</td><td><code>unit:sandbox-token-refresh.test.ts</code> — was ⚠ (documented divergence); aligned to prod in commit on branch <code>claude/close-auth-token-refresh</code> — sandbox now mints a fresh token on forceRefresh and fires <code>onIdTokenChanged</code>. Oracle: <code>scripts/oracle/observations/auth-getidtoken-force-refresh.json</code> defines the target shape (<code>forceRefreshReturnedDifferentString: true</code>, <code>token1EqualsToken2: true</code> against blockingfun — the refreshed token is cached, so a subsequent non-forced read returns it, not yet another fresh one). Sandbox tokens stay <code>sandbox-id-token-&#x3C;uid>-&#x3C;hash></code> strings; prod’s are real JWTs.</td></tr><tr><td>56</td><td><code>user.getIdTokenResult()</code> returns claims</td><td>✓</td><td><code>unit:sandbox-providers.test.ts</code> (custom-claims path)</td></tr><tr><td>57</td><td><code>user.uid</code>, <code>user.email</code>, <code>user.displayName</code>, <code>user.isAnonymous</code> reflect the source</td><td>✓</td><td><code>playground:auth-anonymous</code>, <code>playground:auth-email-password</code></td></tr><tr><td>58</td><td><code>user.emailVerified</code> — present on every sandbox-minted <code>User</code> (default <code>false</code>; sandbox has no verification flow). Prod passes the real value through (no longer stripped). The admin record (<code>sandbox.listUsers</code>) carries it too</td><td>✓</td><td><code>unit:auth-gap-surface.test.ts</code> (locks AUTH-GAP)</td></tr><tr><td>58a</td><td><code>user.photoURL</code> / <code>user.phoneNumber</code> — present (sandbox default <code>null</code>; prod passes through, no longer stripped)</td><td>✓</td><td><code>unit:auth-gap-surface.test.ts</code></td></tr><tr><td>58b</td><td><code>user.providerId</code> (aggregate, <code>'firebase'</code>) + <code>user.providerData: UserInfo[]</code> — sandbox synthesizes one provider entry for non-anonymous users, empty for anonymous; prod passes the real array through (no longer stripped). The admin record carries the emulator-shaped <code>providerUserInfo</code></td><td>✓</td><td><code>unit:auth-gap-surface.test.ts</code></td></tr><tr><td>59</td><td><code>user.metadata.creationTime</code> / <code>lastSignInTime</code></td><td>—</td><td>client <code>User.metadata</code> not exposed (AUTH-GAP); the admin record carries <code>createdAt</code>/<code>lastLoginAt</code> (ISO)</td></tr><tr><td>68</td><td><code>IdTokenResult.signInProvider</code> reflects the session’s provider per flow (<code>'anonymous'</code> / <code>'password'</code> / <code>'google.com'</code> / …); claims include the reserved <code>firebase.sign_in_provider</code> (custom claims can’t shadow it)</td><td>✓</td><td><code>unit:sandbox-user-admin.test.ts</code> (“IdTokenResult.signInProvider”) — prod shape is documented SDK behavior; no oracle capture yet</td></tr><tr><td>75</td><td>Custom-claims changes (<code>sandbox.updateUser</code> / re-seed) reach an active session on the next FORCED token refresh, not immediately — claims are read live from the user DB at mint time (prod’s refresh-propagation story; AUTH-B10)</td><td>✓</td><td><code>unit:sandbox-user-admin.test.ts</code>, <code>unit:sandbox-cluster-b9-b12.test.ts</code></td></tr><tr><td>61</td><td><code>user.reload()</code> / <code>user.delete()</code> / <code>user.toJSON()</code> / <code>user.refreshToken</code> / <code>user.tenantId</code></td><td>—</td><td>not modeled by the sandbox; documented in the deny-list rather than synthesized (AUTH-GAP)</td></tr><tr><td>62</td><td><code>updateProfile(user, {displayName, photoURL})</code></td><td>—</td><td>not implemented</td></tr></tbody></table></div>
+<h2 id="sandbox-sandbox-only-test-driver"><code>sandbox.*</code> (sandbox-only test driver)</h2>
+<div class="table-scroll">
+<table><thead><tr><th>#</th><th>Behavior</th><th>Status</th><th>Probe</th></tr></thead><tbody><tr><td>63</td><td><code>sandbox.seedUsers(auth, [{uid, email, password, displayName?, customClaims?, providerId?}])</code> seeds the user DB; <code>providerId</code> defaults to <code>'password'</code></td><td>✓</td><td><code>unit:sandbox-test-driver.test.ts</code>, <code>unit:sandbox-user-admin.test.ts</code></td></tr><tr><td>63a</td><td>Re-seeding an existing uid OVERWRITES it: a new email drops the stale email→record mapping (the old email no longer signs in), and re-seeded <code>customClaims</code> are LIVE — a held <code>User</code>’s <code>getIdToken(true)</code> reflects the new claims rather than the claims frozen at mint time</td><td>✓</td><td><code>unit:sandbox-cluster-b9-b12.test.ts</code> (locks AUTH-B9 + AUTH-B10)</td></tr><tr><td>64</td><td><code>sandbox.setUser(auth, user)</code> / <code>sandbox.setUser(auth, null)</code> directly switches identity. Bypasses the <code>disabled</code> check and does NOT bump <code>lastLoginAt</code> (not a real sign-in)</td><td>✓</td><td><code>unit:sandbox-test-driver.test.ts</code></td></tr><tr><td>65</td><td><code>sandbox.mockSignInResult(auth, {providerId, user, …})</code> pre-stages a popup/credential result</td><td>✓</td><td><code>unit:sandbox-providers.test.ts</code></td></tr><tr><td>66</td><td>All <code>sandbox.*</code> methods throw <code>failed-precondition</code> on prod-backed handles</td><td>✓</td><td><code>unit:sandbox-test-driver.test.ts</code>, <code>unit:sandbox-user-admin.test.ts</code></td></tr><tr><td>67</td><td><code>sandbox.reset()</code> (host-side, via <code>Sandbox.reset()</code>) clears auth state and fires sign-out</td><td>✓</td><td><code>unit:sandbox-listeners.test.ts</code></td></tr><tr><td>71</td><td><code>sandbox.listIdentities(auth)</code> returns the REAL provider per identity — <code>providerId</code> primary label (<code>'anonymous'</code> for anonymous users) + emulator-shaped <code>providerUserInfo</code> array; anonymous users included</td><td>✓</td><td><code>unit:sandbox-user-admin.test.ts</code> (“provider tracking”) — fixes the pre-epic mislabeling (<code>'password'</code>/<code>'anonymous'</code> only)</td></tr><tr><td>72</td><td><code>sandbox.createSignInCredential(auth, {providerId, uid | spec})</code> mints backend-owned credentials for host-driven flows: <code>{uid}</code> picks an existing identity (<code>auth/user-not-found</code> for unknown uids); <code>{spec}</code> upserts (same-email reuse; default uid <code>'&#x3C;providerId>:&#x3C;email>'</code>; no password). Tokens route through the backend token cache</td><td>✓</td><td><code>unit:sandbox-user-admin.test.ts</code> (“sandbox.createSignInCredential”)</td></tr><tr><td>73</td><td>User-admin CRUD: <code>sandbox.listUsers</code> / <code>createUser</code> (no sign-in; <code>auth/uid-already-exists</code>, <code>auth/email-already-in-use</code>, <code>auth/invalid-email</code>, <code>auth/weak-password</code>) / <code>updateUser</code> (displayName incl. null-clear, email re-key, password + provider link, customClaims wholesale replace, disabled, emailVerified) / <code>deleteUser</code> / <code>clearUsers</code>. Deletion/clear/disable do NOT terminate active sessions (prod parity). Record shape: <code>{uid, email, displayName, phoneNumber, photoUrl, customClaims, providerUserInfo, isAnonymous, disabled, emailVerified, createdAt, lastLoginAt}</code> with ISO timestamps</td><td>✓</td><td><code>unit:sandbox-user-admin.test.ts</code> (CRUD describes)</td></tr><tr><td>74</td><td><code>sandbox.subscribeUsers(auth, cb)</code> fires a coarse no-payload callback on every user-DB mutation (seed/create/update/delete/clear, provider links, lastLoginAt bumps); no initial fire; throwing listeners isolated; unsubscribe stops fires</td><td>✓</td><td><code>unit:sandbox-user-admin.test.ts</code> (“sandbox.subscribeUsers”)</td></tr></tbody></table></div>
+<h2 id="deny-list-intentionally-not-shimmed">Deny-list (intentionally NOT shimmed)</h2>
+<p>These exist in <code>firebase/auth</code> but the sandbox refuses to import/use
+them. The agent’s writeApp prompt and the deploy bundle’s metafile
+gate enforce the deny-list at build time.</p>
+<div class="table-scroll">
+<table><thead><tr><th>Name</th><th>Reason</th></tr></thead><tbody><tr><td><code>linkWithCredential</code> / <code>linkWithPopup</code> / <code>linkWithRedirect</code></td><td>v0 scope — account linking is non-trivial state</td></tr><tr><td><code>unlink</code></td><td>Same as above</td></tr><tr><td><code>reauthenticateWithCredential</code> / <code>reauthenticateWithPopup</code> / <code>reauthenticateWithRedirect</code></td><td>v0 scope</td></tr><tr><td><code>updateEmail</code> / <code>updatePassword</code></td><td>Mutates auth state in ways the sandbox doesn’t model</td></tr><tr><td><code>verifyBeforeUpdateEmail</code> / <code>sendEmailVerification</code> / <code>applyActionCode</code> / <code>checkActionCode</code> / <code>confirmPasswordReset</code> / <code>sendPasswordResetEmail</code> / <code>verifyPasswordResetCode</code></td><td>Email-link flows require an SMTP path; deliberately out of scope</td></tr><tr><td><code>multiFactor(user)</code> / MFA APIs</td><td>Not modeled</td></tr><tr><td><code>useDeviceLanguage</code> / <code>setLanguageCode</code></td><td>i18n surface; not in v0</td></tr><tr><td><code>beforeAuthStateChanged</code></td><td>Blocking middleware; sandbox uses synchronous fan-out and has no equivalent yet</td></tr><tr><td><code>User.reload()</code> / <code>User.delete()</code> / <code>User.toJSON()</code></td><td>Account-lifecycle / serialization the sandbox doesn’t model — documented (not synthesized) per AUTH-GAP; the cheap profile fields (<code>photoURL</code>/<code>emailVerified</code>/<code>phoneNumber</code>/<code>providerData</code>/<code>providerId</code>) ARE present</td></tr><tr><td><code>User.metadata</code> / <code>User.refreshToken</code> / <code>User.tenantId</code></td><td>Not tracked by the sandbox; documented per AUTH-GAP</td></tr><tr><td>Positional listener <code>error</code> / <code>complete</code> args on <code>onAuthStateChanged</code> / <code>onIdTokenChanged</code></td><td>Sandbox observers never error/complete (synchronous in-memory fan-out); pass the <code>{ next, error, complete }</code> observer object if you need those handlers. The prod backend forwards all three.</td></tr></tbody></table></div>
+<hr>
+<h2 id="visible-gaps-to-address-next">Visible gaps to address next</h2>
+<p>Rows currently marked <strong>?</strong> (need explicit probes):</p>
+<ul>
+<li>#3 <code>getAuth(app)</code> prod-backend dispatch — landing once the
+empirical oracle harness (<code>scripts/oracle/run.ts</code>) captures the
+observation against a real Firebase project. Harness is in
+place; needs the <code>PYRIC_ORACLE_FIREBASE_CONFIG</code> env var pointed
+at a dedicated oracle project before observations can be
+committed. See <code>scripts/oracle/README.md</code> for project setup.</li>
+<li>#69 (ordering only) — disabled-vs-wrong-password precedence on
+<code>signInWithEmailAndPassword</code>. Sandbox checks disabled BEFORE the
+password compare (anti-probing best-known semantics); needs an
+oracle capture against a disabled prod account to lock the order.</li>
+<li>#68 (prod side) — <code>IdTokenResult.signInProvider</code> values per flow are
+documented SDK behavior but not yet oracle-captured.</li>
+</ul>
+<p>Rows <strong>locked by the empirical oracle harness</strong> (committed observations under <code>scripts/oracle/observations/</code>, captured against the <code>blockingfun</code> project):</p>
+<ul>
+<li>#10 <code>onAuthStateChanged</code> exactly-one-per-transition — oracle confirmed signIn → signOut → signIn each produced exactly 1 fire (in addition to the initial null fire on subscribe); sandbox matches.</li>
+<li>#14 <code>signInWithEmailAndPassword</code> user-not-found — oracle confirmed prod still emits <code>auth/user-not-found</code> (not the newer <code>auth/invalid-credential</code>); sandbox matches.</li>
+<li>#17 <code>signInWithEmailAndPassword</code> fires once with the new user — oracle confirmed <code>firesForSignIn: 1</code> with the signed-in uid against prod; sandbox matches.</li>
+<li>#18 <code>auth/invalid-email</code> format-validation — oracle confirmed <code>createUserWithEmailAndPassword(auth, 'not-an-email', …)</code> throws <code>auth/invalid-email</code> against prod; sandbox now matches (validation lives in <code>sandbox-backend.ts</code> and runs before user-DB lookup on both <code>signIn</code> and <code>createUser</code> paths).</li>
+<li>#19 <code>auth/weak-password</code> strength-validation — oracle confirmed prod rejects 3-char passwords with <code>auth/weak-password</code> and message <code>Password should be at least 6 characters</code>; sandbox now matches the same 6-char threshold (validated on <code>createUser</code> only — <code>signIn</code> lets in previously-seeded weak passwords, mirroring prod).</li>
+<li>#24 <code>createUserWithEmailAndPassword</code> fires once with the new user — oracle confirmed <code>firesForCreate: 1</code> with the newly-created uid against prod; sandbox matches.</li>
+<li>#26 <code>signOut</code> fires null exactly once — oracle confirmed the signOut transition produced exactly 1 fire with <code>uid === null</code>; sandbox matches.</li>
+<li>#30 <code>onAuthStateChanged</code> on every subsequent identity change — oracle confirmed signIn → signOut → signIn → signOut all 4 fired exactly once; sandbox matches.</li>
+<li>#32 <code>Unsubscribe</code> removes the observer — oracle confirmed post-unsubscribe signOut+signIn+signOut produced zero further fires; sandbox matches.</li>
+<li>#33 multiple subscribers all fire — oracle confirmed two listeners registered back-to-back both fire on each transition; sandbox matches.</li>
+<li>#36 observer object form (<code>{next, error, complete}</code>) — oracle confirmed prod accepts both forms; both fire on every transition; sandbox matches.</li>
+<li>#21 <code>createUserWithEmailAndPassword</code> <code>operationType</code> — oracle confirmed prod returns <code>'signIn'</code> (NOT <code>'register'</code>); sandbox matches.</li>
+<li>#22 <code>createUserWithEmailAndPassword</code> duplicate email — oracle confirmed prod emits <code>auth/email-already-in-use</code>; sandbox matches.</li>
+<li>#25 <code>signOut</code> synchronous-null — oracle confirmed prod sets <code>auth.currentUser</code> to <code>null</code> in the synchronous continuation immediately after <code>await signOut(auth)</code> resolves; sandbox matches.</li>
+<li>#27 <code>signOut</code> idempotent — oracle confirmed prod is a no-op, no listener fire on the redundant call.</li>
+<li>#29 <code>onAuthStateChanged</code> initial-fire timing — oracle confirmed prod fires the initial value on the microtask after subscribe, not synchronously; sandbox matches.</li>
+<li>#31 <code>onAuthStateChanged</code> no-dup on sync transition — oracle baseline: prod has no synchronous state-change API, so the dedup case is sandbox-only. Async subscribe + signIn produces two natural fires (initial null, then user).</li>
+<li>#35 <code>onAuthStateChanged</code> throwing-observer isolation — oracle confirmed a throwing observer does not block subsequent observers; sandbox matches.</li>
+<li>#37 <code>onAuthStateChanged</code> same-user no-double-fire — oracle confirmed calling <code>signInAnonymously</code> twice in a row returns the same uid and the second call does NOT produce a fresh listener fire; sandbox matches.</li>
+<li>#38 <code>onIdTokenChanged</code> user-change fires — oracle confirmed every signIn/signOut transition produces exactly one fire; sandbox matches.</li>
+<li>#39 <code>onIdTokenChanged</code> on forced refresh — oracle confirmed prod fires the listener after <code>getIdToken(true)</code>; sandbox matches (divergence closed on branch <code>claude/close-auth-token-refresh</code>).</li>
+<li>#40 <code>onIdTokenChanged</code> initial-fire parity with <code>onAuthStateChanged</code> — oracle confirmed both listeners share the microtask-deferred initial-fire timing; sandbox matches.</li>
+<li>#55 <code>getIdToken(forceRefresh)</code> — oracle confirmed prod returns a different token string after a forced refresh and a subsequent non-forced read returns the cached new token; sandbox matches (divergence closed on branch <code>claude/close-auth-token-refresh</code>).</li>
+</ul>
+<p>Rows currently marked <strong>—</strong> that we might want to fill (rough priority):</p>
+<ol>
+<li>#20-23 <code>updateProfile</code> — common app pattern, agent code often calls it</li>
+<li>#57 <code>user.emailVerified</code> — used by gating logic in real apps</li>
+<li>#58-61 <code>user.metadata</code> / <code>reload</code> / <code>delete</code> — full User shape parity</li>
+</ol>
+<p>Rows currently marked <strong>⚠</strong> that we might want to upgrade to <strong>✓</strong>
+(by aligning the sandbox to prod or by formally documenting the
+divergence in <code>feature-matrix.md</code>):</p>
+<ul>
+<li>#7 anonymous uid format</li>
+<li>#12, #28 persistence story</li>
+<li>#43 setPersistence respect</li>
+<li>#48 popup window</li>
+</ul>  </article> </main> <aside class="doc-toc" aria-label="On this page"> <h2 class="doc-toc-heading">On this page</h2> <ul> <li data-depth="2"> <a href="#status-legend">Status legend</a> </li><li data-depth="2"> <a href="#getauthtarget--initializer">getAuth(target) — initializer</a> </li><li data-depth="2"> <a href="#signinanonymouslyauth--anonymous">signInAnonymously(auth) — anonymous</a> </li><li data-depth="2"> <a href="#signinwithemailandpasswordauth-email-password--password">signInWithEmailAndPassword(auth, email, password) — password</a> </li><li data-depth="2"> <a href="#createuserwithemailandpasswordauth-email-password--register">createUserWithEmailAndPassword(auth, email, password) — register</a> </li><li data-depth="2"> <a href="#signoutauth">signOut(auth)</a> </li><li data-depth="2"> <a href="#onauthstatechangedauth-observer">onAuthStateChanged(auth, observer)</a> </li><li data-depth="2"> <a href="#onidtokenchangedauth-observer">onIdTokenChanged(auth, observer)</a> </li><li data-depth="2"> <a href="#setpersistenceauth-persistence">setPersistence(auth, persistence)</a> </li><li data-depth="2"> <a href="#signinwithpopupauth-provider--signinwithcredentialauth-credential">signInWithPopup(auth, provider) / signInWithCredential(auth, credential)</a> </li><li data-depth="2"> <a href="#signinwithredirect--getredirectresult--resolver-seam">signInWithRedirect / getRedirectResult / resolver seam</a> </li><li data-depth="2"> <a href="#auth-surface--error-shape">Auth surface + error shape</a> </li><li data-depth="2"> <a href="#provider-classes-googleauthprovider-emailauthprovider-etc">Provider classes (GoogleAuthProvider, EmailAuthProvider, etc.)</a> </li><li data-depth="2"> <a href="#user-methods">User methods</a> </li><li data-depth="2"> <a href="#sandbox-sandbox-only-test-driver">sandbox.* (sandbox-only test driver)</a> </li><li data-depth="2"> <a href="#deny-list-intentionally-not-shimmed">Deny-list (intentionally NOT shimmed)</a> </li><li data-depth="2"> <a href="#visible-gaps-to-address-next">Visible gaps to address next</a> </li> </ul> </aside> </div> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> </body> </html>