pyric 0.0.1 → 0.1.0-alpha.10

package/dist/auth/tokens.js

@@ -0,0 +1,142 @@
+/**
+ * Token-scoped operations: `signInWithCustomToken` (sign in FROM a token)
+ * and `revokeAccessToken` (revoke a provider's token), plus
+ * `validatePassword` (the project password policy).
+ */
+import { makeAuthError } from './auth-errors.js';
+import { requireSandboxTarget } from './action-codes.js';
+import { targetOf } from './target.js';
+// ─── signInWithCustomToken ────────────────────────────────────────────
+/**
+ * `signInWithCustomToken(auth, customToken)` — mirror of `firebase/auth`.
+ *
+ * In production a custom token is a JWT your BACKEND signs with a service
+ * account, asserting "this is user X, with these claims". The client
+ * exchanges it for a session. It is the standard bridge from an existing
+ * auth system into Firebase.
+ *
+ * The sandbox has no service-account key and no signature to verify, so
+ * it treats the token as what it structurally is: a claim of identity.
+ * It accepts a token in either of two shapes —
+ *
+ *   1. a JSON object `{"uid": "...", "claims": {...}}` (optionally
+ *      base64url-encoded), which is exactly the payload
+ *      `admin.auth().createCustomToken(uid, claims)` signs. This is the
+ *      shape the pyric-admin mirror mints, so the two sides compose: mint
+ *      on the admin side, redeem here.
+ *   2. a real three-part JWT, whose middle segment is decoded and read
+ *      for `uid` / `claims`. The SIGNATURE IS NOT VERIFIED — the sandbox
+ *      has no key and says so rather than pretending.
+ *
+ * Anything else throws `auth/invalid-custom-token` — ORACLE-BACKED
+ * (`auth-signinwithcustomtoken-invalid` captured exactly that code from
+ * prod for both a malformed token and the empty string).
+ *
+ * The identity is created if it does not exist (matching prod: a custom
+ * token for an unknown uid mints that account), and the credential
+ * carries `providerId: null` — custom-token sign-in is not a federated
+ * provider, the same rule anonymous sign-in follows.
+ */
+export async function signInWithCustomToken(auth, customToken) {
+    const t = targetOf(auth);
+    const target = t;
+    const payload = decodeCustomToken(customToken);
+    if (!payload) {
+        throw makeAuthError('auth/invalid-custom-token', 'The custom token format is incorrect. Please check the documentation.');
+    }
+    const existing = target.backend.findByUid(payload.uid);
+    const isNewUser = existing === undefined;
+    if (existing) {
+        // A custom token re-asserts claims on every exchange — prod merges the
+        // token's claims into the session, so a claims change on the backend
+        // takes effect at the next sign-in without touching the user record.
+        if (payload.claims) {
+            target.backend.updateUser(payload.uid, { customClaims: payload.claims });
+        }
+    }
+    else {
+        target.backend.createUser({
+            uid: payload.uid,
+            ...(payload.claims ? { customClaims: payload.claims } : {}),
+        });
+    }
+    const stored = target.backend.findByUid(payload.uid);
+    if (!stored) {
+        throw makeAuthError('auth/invalid-custom-token', 'signInWithCustomToken: could not materialize the identity.');
+    }
+    target.backend.assertSignInAllowed(stored.uid);
+    const user = target.backend.buildUserFromStored(stored);
+    await target.backend.transitionCurrentUser(user, 'custom');
+    return {
+        user,
+        providerId: null,
+        operationType: 'signIn',
+        _additionalUserInfo: { isNewUser, profile: {}, providerId: null },
+    };
+}
+/** Read `{uid, claims}` out of a custom token, or `null` if it carries
+ *  neither shape the sandbox accepts (see {@link signInWithCustomToken}). */
+function decodeCustomToken(token) {
+    if (typeof token !== 'string' || token.length === 0)
+        return null;
+    // Shape 2: a real JWT — read the payload segment. The signature is NOT
+    // checked; the sandbox has no key.
+    const parts = token.split('.');
+    const candidates = parts.length === 3 ? [parts[1]] : [token];
+    for (const candidate of candidates) {
+        const obj = tryJson(candidate) ?? tryJson(tryBase64Url(candidate));
+        if (!obj)
+            continue;
+        // `uid` is admin-SDK-speak; `sub` is the JWT standard. Accept either.
+        const uid = obj['uid'] ?? obj['sub'];
+        if (typeof uid !== 'string' || uid.length === 0)
+            continue;
+        const rawClaims = obj['claims'];
+        const claims = typeof rawClaims === 'object' && rawClaims !== null
+            ? rawClaims
+            : undefined;
+        return claims ? { uid, claims } : { uid };
+    }
+    return null;
+}
+function tryJson(s) {
+    if (s === null)
+        return null;
+    try {
+        const parsed = JSON.parse(s);
+        return typeof parsed === 'object' && parsed !== null ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function tryBase64Url(s) {
+    try {
+        const b64 = s.replace(/-/g, '+').replace(/_/g, '/');
+        return atob(b64.padEnd(Math.ceil(b64.length / 4) * 4, '='));
+    }
+    catch {
+        return null;
+    }
+}
+// ─── revokeAccessToken ────────────────────────────────────────────────
+/**
+ * `revokeAccessToken(auth, token)` — mirror of `firebase/auth`.
+ *
+ * In production this tells the IDENTITY PROVIDER (in practice: Apple) to
+ * revoke an OAuth access token — a call that leaves Firebase entirely and
+ * lands on Apple's servers. It exists because Apple requires an app that
+ * offers "Sign in with Apple" to also offer account deletion that revokes
+ * the token.
+ *
+ * There is no external IdP behind a sandbox sign-in, so there is no token
+ * out there to revoke and nothing this call could truthfully do. It is an
+ * ACCEPTED NO-OP: it resolves, so the account-deletion flow an app must
+ * ship runs end to end against the sandbox, and it changes no sandbox
+ * state, because claiming otherwise would be a lie. `diverged-documented`.
+ */
+export async function revokeAccessToken(auth, token) {
+    requireSandboxTarget(auth, 'revokeAccessToken');
+    void token;
+}
+//# sourceMappingURL=tokens.js.map

package/dist/auth/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,yEAAyE;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAU,EACV,WAAmB;IAEnB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,CAAC;IACjB,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,aAAa,CACjB,2BAA2B,EAC3B,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YACxB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,aAAa,CAAC,2BAA2B,EAAE,4DAA4D,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,QAAQ;QACvB,mBAAmB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;KAClE,CAAC;AACJ,CAAC;AAED;6EAC6E;AAC7E,SAAS,iBAAiB,CACxB,KAAa;IAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjE,uEAAuE;IACvE,mCAAmC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEvE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,sEAAsE;QACtE,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,MAAM,GACV,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;YACjD,CAAC,CAAE,SAAqC;YACxC,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,CAAgB;IAC/B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAU,EAAE,KAAa;IAC/D,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAChD,KAAK,KAAK,CAAC;AACb,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,283 @@
+/**
+ * Public types for `pyric/auth`. Sandbox-owned shapes that mirror
+ * `firebase/auth`'s modular surface at the type level, so canonical
+ * consumer imports keep the same source shape when package resolution
+ * selects the sandbox.
+ *
+ * Where the upstream SDK exposes deeper fields than the sandbox can
+ * guarantee (provider data internals, multi-factor extensions, etc.),
+ * the pyric type is a *subset* of the Firebase type.
+ */
+import type { Target } from './target.js';
+import type { FirebaseApp } from '../app/types.js';
+/** Branded handle for {@link Auth}. Set on every handle returned by
+ *  {@link getAuth}; consumers don't read it. Exposed only so the
+ *  dispatch helpers in this package can recover routing without a
+ *  WeakMap lookup. */
+export declare const TARGET_SYMBOL: unique symbol;
+/**
+ * Result of `getIdTokenResult()`. Mirrors the `firebase/auth` shape.
+ *
+ * On the sandbox backend `token` is an opaque sandbox-issued string
+ * with a recognizable prefix (`sandbox-id-token-`) — NOT a JWT and
+ * NOT cryptographically signed. `claims` echoes the user's
+ * `customClaims` (from `sandbox.seedUsers`) plus a small set of
+ * synthesized standard claims (`sub`, `aud`, `iss`). Expiration is
+ * set far in the future since the sandbox has no refresh story.
+ */
+export interface IdTokenResult {
+    /** Opaque sandbox token string: `sandbox-id-token-<uid>-<hash>`. */
+    token: string;
+    /** Custom + standard claims. Same map seen by the rules engine as
+     *  `request.auth.token.*`. */
+    claims: Record<string, unknown>;
+    /** ISO string. Sandbox: far-future. */
+    expirationTime: string;
+    /** ISO string. */
+    issuedAtTime: string;
+    /** ISO string — when the user last *signed in* (not when the token
+     *  was last refreshed). */
+    authTime: string;
+    /**
+     * Provider of the current sign-in session — `'password'`,
+     * `'anonymous'`, `'google.com'`, etc., or `null` when unknown.
+     * Mirrors `firebase/auth`'s `IdTokenResult.signInProvider`; the
+     * sandbox synthesizes the same `firebase.sign_in_provider` claim.
+     *
+     * Optional (`?`) for now: external `User` implementations built
+     * before this field existed (the playground's helper-minted users,
+     * until Track B's lockstep swap lands) omit it. The sandbox backend
+     * always populates it. Tighten to required once all `User` minting
+     * is backend-owned.
+     */
+    signInProvider?: string | null;
+}
+/**
+ * Per-provider profile info — mirror of `firebase/auth`'s `UserInfo`.
+ * Each entry in {@link User.providerData} describes one linked provider.
+ */
+export interface UserInfo {
+    /** Display name from this provider, or `null`. */
+    readonly displayName: string | null;
+    /** Email from this provider, or `null`. */
+    readonly email: string | null;
+    /** E.164 phone number from this provider, or `null`. */
+    readonly phoneNumber: string | null;
+    /** Profile photo URL from this provider, or `null`. */
+    readonly photoURL: string | null;
+    /** Provider id (e.g. `'password'`, `'google.com'`). */
+    readonly providerId: string;
+    /** The user's id as known to this provider. */
+    readonly uid: string;
+}
+/**
+ * The signed-in user. Subset of `firebase/auth`'s `User` interface
+ * containing the fields the sandbox can synthesize faithfully.
+ *
+ * The heavier `User` surface the sandbox does NOT model (`metadata`,
+ * `refreshToken`, `tenantId`, `reload()`, `delete()`, `toJSON()`) is
+ * intentionally not synthesized; its absence remains visible in the public
+ * type census rather than being hidden behind placeholder values.
+ */
+export interface User {
+    /** Firebase UID — globally unique per project. Sandbox: minted by
+     *  `signInAnonymously` or supplied via `seedUsers`. */
+    readonly uid: string;
+    /** Email address, or `null` for anonymous users / providers that
+     *  didn't supply one. */
+    readonly email: string | null;
+    /** Whether the email has been verified. Sandbox: `false` unless the
+     *  seeded/mock user set it (no verification flow). Optional on the
+     *  type so host helpers that synthesize a partial `User` aren't forced
+     *  to specify it; the sandbox backend always populates it. */
+    readonly emailVerified?: boolean;
+    /** Display name, or `null` if none. */
+    readonly displayName: string | null;
+    /** Profile photo URL, or `null`. Optional on the type (see
+     *  {@link emailVerified}); always populated by the sandbox backend. */
+    readonly photoURL?: string | null;
+    /** E.164 phone number, or `null`. Optional on the type; always
+     *  populated by the sandbox backend. */
+    readonly phoneNumber?: string | null;
+    /** True iff this user signed in via `signInAnonymously`. */
+    readonly isAnonymous: boolean;
+    /** The aggregate provider id (`'firebase'` for a real `User`;
+     *  per-provider ids live in {@link providerData}). Optional on the
+     *  type; always populated by the sandbox backend. */
+    readonly providerId?: string;
+    /** One {@link UserInfo} per linked provider. Sandbox synthesizes a
+     *  single entry from the user's own fields for non-anonymous users;
+     *  empty for anonymous. Optional on the type; always populated by the
+     *  sandbox backend. */
+    readonly providerData?: UserInfo[];
+    /**
+     * Get the user's ID token, refreshing it if needed.
+     *
+     * Sandbox: returns the cached opaque token; with
+     * `forceRefresh: true` mints a fresh token, caches it, and fires
+     * `onIdTokenChanged` listeners (matches prod — oracle:
+     * `packages/conformance/observations/auth/auth-getidtoken-force-refresh.json`
+     * and `…/auth-onidtokenchanged-force-refresh.json`).
+     */
+    getIdToken(forceRefresh?: boolean): Promise<string>;
+    /** Get the full ID token + claims. See {@link IdTokenResult}. */
+    getIdTokenResult(forceRefresh?: boolean): Promise<IdTokenResult>;
+}
+/**
+ * Result of every sign-in method. Mirrors `firebase/auth`.
+ *
+ * `operationType` discriminates what produced it: `'signIn'` for a fresh
+ * sign-in (including `createUserWithEmailAndPassword` — oracle-pinned),
+ * `'link'` for `linkWith*`, `'reauthenticate'` for `reauthenticateWith*`.
+ */
+export interface UserCredential {
+    user: User;
+    providerId: string | null;
+    operationType: 'signIn' | 'reauthenticate' | 'link';
+    /**
+     * What `getAdditionalUserInfo(cred)` returns. Carried on the credential
+     * rather than derived, because `isNewUser` is a fact only the flow that
+     * MINTED the credential knows: `createUserWithEmailAndPassword` created
+     * the identity, `signInWithEmailAndPassword` did not, and nothing about
+     * the finished credential can tell them apart after the fact.
+     *
+     * Underscore-prefixed and optional: it is not part of the shape a host
+     * or a test fixture has to synthesize (a credential without it degrades
+     * honestly — see `getAdditionalUserInfo`).
+     */
+    _additionalUserInfo?: {
+        readonly isNewUser: boolean;
+        readonly profile: Record<string, unknown> | null;
+        readonly providerId: string | null;
+        readonly username?: string | null;
+    };
+}
+/**
+ * What a popup/redirect sign-in flow needs to know about the request.
+ * Mirrors the params `firebase/auth` hands its emulator widget
+ * (`providerId`, `authType`, `scopes`, `customParameters` — see
+ * upstream `core/util/handler.ts`), so a resolver implementation has
+ * the same inputs the real flow does.
+ */
+export interface AuthFlowRequest {
+    /** e.g. `'google.com'`, `'github.com'`, or a generic `OAuthProvider` id. */
+    providerId: string;
+    /** Why the popup/redirect opened. v0 only drives `'signIn'`; the
+     *  others exist for parity with reauth/link flows. */
+    authType: 'signIn' | 'reauth' | 'link';
+    /** OAuth scopes the provider requested (`addScope`). Sandbox-opaque. */
+    scopes?: string[];
+    /** Provider custom parameters (`setCustomParameters`). Sandbox-opaque. */
+    customParameters?: Record<string, unknown>;
+}
+/**
+ * Pluggable popup/redirect resolver — pyric's analog of
+ * `firebase/auth`'s `PopupRedirectResolver`. The SDK stays UI-free and
+ * delegates the *experience* to whatever implements this: a playground
+ * modal, a headless test fixture, a CLI prompt. One resolver serves all
+ * three flows.
+ *
+ * Configured the same three ways the upstream resolver is: passed
+ * per-call to `signInWithPopup` / `signInWithRedirect`, injected once
+ * via `sandbox.setAuthFlowResolver` (the analog of browser `getAuth`
+ * wiring `browserPopupRedirectResolver`), or installed implicitly as a
+ * one-shot by `sandbox.mockSignInResult`.
+ *
+ * Implementations reject with `auth/popup-closed-by-user` when the user
+ * dismisses the experience — matches `firebase/auth`.
+ */
+export interface AuthFlowResolver {
+    /** Resolve a `signInWithPopup` flow to a credential. */
+    openPopup(req: AuthFlowRequest): Promise<UserCredential>;
+    /** Resolve a `signInWithRedirect` flow. In a real browser the redirect
+     *  navigates away and the credential surfaces on return; the sandbox has
+     *  no navigation, so this resolves inline to the credential and the SDK
+     *  stashes it for the next `getRedirectResult`. */
+    openRedirect(req: AuthFlowRequest): Promise<UserCredential>;
+}
+/**
+ * Observer shape accepted by `onAuthStateChanged` / `onIdTokenChanged`.
+ * Mirrors `firebase/auth`'s `NextOrObserver<User | null>`.
+ */
+export type AuthObserver = ((user: User | null) => void) | {
+    next?: (user: User | null) => void;
+    error?: (err: Error) => void;
+    complete?: () => void;
+};
+/** Returned by `onAuthStateChanged` / `onIdTokenChanged`. */
+export type Unsubscribe = () => void;
+/**
+ * Hidden brand stamped non-enumerably on every sandbox {@link User} object
+ * so the top-level `updateProfile(user, …)` free function can reach the
+ * owning sandbox WITHOUT an `auth` handle in scope (matching
+ * `firebase/auth`'s `updateProfile(user, profile)` signature, which takes
+ * only the user). Consumers never read it.
+ */
+export declare const USER_INTERNAL: unique symbol;
+/**
+ * Sandbox operation contract carried on a {@link User} via
+ * {@link USER_INTERNAL}. The owning backend stamps an implementation that
+ * mutates the stored record and the in-memory user in place.
+ */
+export interface UserInternal {
+    updateProfile(profile: {
+        displayName?: string | null;
+        photoURL?: string | null;
+    }): Promise<void>;
+    /** Backend for the top-level `deleteUser(user)` — removes the account
+     *  from the store and signs the user out if they are current. */
+    delete(): Promise<void>;
+    /** Backend for the top-level `updateEmail(user, newEmail)` — mutates the
+     *  stored record's email (and this user in place). */
+    updateEmail(newEmail: string): Promise<void>;
+    /** Backend for the top-level `updatePassword(user, newPassword)` — sets
+     *  the stored password (verified on the next sign-in). */
+    updatePassword(newPassword: string): Promise<void>;
+    /** Backend for the top-level `reload(user)` — re-reads the stored record
+     *  into this user object in place. */
+    reload(): Promise<void>;
+    /**
+     * The sandbox target this user came from — the same brand
+     * {@link Auth} carries, recovered from the USER alone.
+     *
+     * Needed because a whole family of `firebase/auth` APIs takes a `User`
+     * and NO `Auth` handle (`sendEmailVerification(user)`,
+     * `linkWithCredential(user, cred)`, `unlink(user, id)`,
+     * `reauthenticateWithCredential(user, cred)`, …). Those functions still
+     * have to reach the sandbox that owns the user, and the user object is
+     * the only thing they are given. The routing information therefore rides
+     * on the user.
+     */
+    target: Target;
+}
+/**
+ * Opaque marker for `setPersistence`. The sandbox records the selected
+ * session storage mode from the `type` field.
+ *
+ * `'COOKIE'` is upstream's fourth type (`browserCookiePersistence`, for
+ * SSR) — the union matches `firebase/auth`'s `Persistence.type` exactly.
+ */
+export interface Persistence {
+    readonly type: 'SESSION' | 'LOCAL' | 'NONE' | 'COOKIE';
+}
+/**
+ * Hidden brand on every {@link Auth} handle. Carries its owning sandbox
+ * target. Consumers don't read it.
+ */
+export interface Auth {
+    readonly app?: FirebaseApp;
+    /** Currently signed-in user, or `null`. Snapshot value — read
+     *  through `onAuthStateChanged` for live updates. */
+    readonly currentUser: User | null;
+    /** Sign the current user out. Method form of the free `signOut(auth)`
+     *  function — `firebase/auth`'s `Auth` exposes both, so consumer code
+     *  written as `auth.signOut()` works unchanged (AUTH-GAP). */
+    signOut(): Promise<void>;
+    /** Internal — identifies the owning sandbox backend. */
+    readonly [TARGET_SYMBOL]: Target;
+}
+/** Auth handle returned by Firebase-shaped app overloads. */
+export type AppAuth = Auth & {
+    readonly app: FirebaseApp;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD;;;sBAGsB;AACtB,eAAO,MAAM,aAAa,EAAE,OAAO,MAAoC,CAAC;AAExE;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd;kCAC8B;IAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,uCAAuC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB;+BAC2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,kDAAkD;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,IAAI;IACnB;2DACuD;IACvD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;6BACyB;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;kEAG8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,uCAAuC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;2EACuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;4CACwC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;yDAEqD;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;2BAGuB;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC;IAEnC;;;;;;;;OAQG;IACH,UAAU,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,iEAAiE;IACjE,gBAAgB,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAClE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,QAAQ,GAAG,gBAAgB,GAAG,MAAM,CAAC;IACpD;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE;QACpB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACjD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB;0DACsD;IACtD,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACvC,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzD;;;uDAGmD;IACnD,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7D;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GACpB,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,GAC7B;IACA,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IACnC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEJ,6DAA6D;AAC7D,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,EAAE,OAAO,MAAsC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,OAAO,EAAE;QACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;qEACiE;IACjE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;0DACsD;IACtD,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C;8DAC0D;IAC1D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD;0CACsC;IACtC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;CACxD;AAED;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;IAC3B;yDACqD;IACrD,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IAClC;;kEAE8D;IAC9D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,6DAA6D;AAC7D,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC"}

package/dist/auth/types.js

@@ -0,0 +1,24 @@
+/**
+ * Public types for `pyric/auth`. Sandbox-owned shapes that mirror
+ * `firebase/auth`'s modular surface at the type level, so canonical
+ * consumer imports keep the same source shape when package resolution
+ * selects the sandbox.
+ *
+ * Where the upstream SDK exposes deeper fields than the sandbox can
+ * guarantee (provider data internals, multi-factor extensions, etc.),
+ * the pyric type is a *subset* of the Firebase type.
+ */
+/** Branded handle for {@link Auth}. Set on every handle returned by
+ *  {@link getAuth}; consumers don't read it. Exposed only so the
+ *  dispatch helpers in this package can recover routing without a
+ *  WeakMap lookup. */
+export const TARGET_SYMBOL = Symbol('pyric/auth/target');
+/**
+ * Hidden brand stamped non-enumerably on every sandbox {@link User} object
+ * so the top-level `updateProfile(user, …)` free function can reach the
+ * owning sandbox WITHOUT an `auth` handle in scope (matching
+ * `firebase/auth`'s `updateProfile(user, profile)` signature, which takes
+ * only the user). Consumers never read it.
+ */
+export const USER_INTERNAL = Symbol('pyric.user.internal');
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH;;;sBAGsB;AACtB,MAAM,CAAC,MAAM,aAAa,GAAkB,MAAM,CAAC,mBAAmB,CAAC,CAAC;AA4MxE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAkB,MAAM,CAAC,qBAAqB,CAAC,CAAC"}

package/dist/auth/user-lifecycle.d.ts

@@ -0,0 +1,17 @@
+import { type Auth, type AuthObserver, type IdTokenResult, type Unsubscribe, type User } from './types.js';
+export declare function onAuthStateChanged(auth: Auth, observer: AuthObserver): Unsubscribe;
+export declare function onIdTokenChanged(auth: Auth, observer: AuthObserver): Unsubscribe;
+export declare function beforeAuthStateChanged(auth: Auth, callback: (user: User | null) => void | Promise<void>, onAbort?: () => void): Unsubscribe;
+export declare function getIdToken(user: User, forceRefresh?: boolean): Promise<string>;
+export declare function getIdTokenResult(user: User, forceRefresh?: boolean): Promise<IdTokenResult>;
+export declare function updateProfile(user: User, profile: {
+    displayName?: string | null;
+    photoURL?: string | null;
+}): Promise<void>;
+export declare function deleteUser(user: User): Promise<void>;
+export declare function updateEmail(user: User, newEmail: string): Promise<void>;
+export declare function updatePassword(user: User, newPassword: string): Promise<void>;
+export declare function reload(user: User): Promise<void>;
+export declare function updateCurrentUser(auth: Auth, user: User | null): Promise<void>;
+export declare function useDeviceLanguage(auth: Auth): void;
+//# sourceMappingURL=user-lifecycle.d.ts.map

package/dist/auth/user-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-lifecycle.d.ts","sourceRoot":"","sources":["../../src/auth/user-lifecycle.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,IAAI,EACT,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,IAAI,EAEV,MAAM,YAAY,CAAC;AAEpB,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,GAAG,WAAW,CAQlF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,GAAG,WAAW,CAQhF;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EACrD,OAAO,CAAC,EAAE,MAAM,IAAI,GACnB,WAAW,CAEb;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpF;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,IAAI,EACV,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACjE,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpF;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAElD"}

package/dist/auth/user-lifecycle.js

@@ -0,0 +1,60 @@
+/** Auth observers, token accessors, and user lifecycle operations. */
+import { makeAuthError } from './sandbox-backend.js';
+import { targetOf } from './target.js';
+import { USER_INTERNAL, } from './types.js';
+export function onAuthStateChanged(auth, observer) {
+    const target = targetOf(auth);
+    const unsubscribe = target.backend.subscribe('auth-state', observer);
+    const release = target.own?.(unsubscribe);
+    return () => {
+        release?.();
+        unsubscribe();
+    };
+}
+export function onIdTokenChanged(auth, observer) {
+    const target = targetOf(auth);
+    const unsubscribe = target.backend.subscribe('id-token', observer);
+    const release = target.own?.(unsubscribe);
+    return () => {
+        release?.();
+        unsubscribe();
+    };
+}
+export function beforeAuthStateChanged(auth, callback, onAbort) {
+    return targetOf(auth).backend.beforeAuthStateChanged(callback, onAbort);
+}
+export async function getIdToken(user, forceRefresh) {
+    return user.getIdToken(forceRefresh);
+}
+export async function getIdTokenResult(user, forceRefresh) {
+    return user.getIdTokenResult(forceRefresh);
+}
+export async function updateProfile(user, profile) {
+    return userInternal(user, 'updateProfile').updateProfile(profile);
+}
+export async function deleteUser(user) {
+    return userInternal(user, 'deleteUser').delete();
+}
+export async function updateEmail(user, newEmail) {
+    return userInternal(user, 'updateEmail').updateEmail(newEmail);
+}
+export async function updatePassword(user, newPassword) {
+    return userInternal(user, 'updatePassword').updatePassword(newPassword);
+}
+export async function reload(user) {
+    return userInternal(user, 'reload').reload();
+}
+export async function updateCurrentUser(auth, user) {
+    targetOf(auth).backend.setCurrentUser(user);
+}
+export function useDeviceLanguage(auth) {
+    void auth;
+}
+function userInternal(user, name) {
+    const internal = user[USER_INTERNAL];
+    if (!internal) {
+        throw makeAuthError('auth/invalid-user-token', `${name}: unrecognized user — was it produced by a pyric/auth sign-in?`);
+    }
+    return internal;
+}
+//# sourceMappingURL=user-lifecycle.js.map

package/dist/auth/user-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-lifecycle.js","sourceRoot":"","sources":["../../src/auth/user-lifecycle.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,aAAa,GAOd,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,kBAAkB,CAAC,IAAU,EAAE,QAAsB;IACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,GAAG,EAAE;QACV,OAAO,EAAE,EAAE,CAAC;QACZ,WAAW,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAU,EAAE,QAAsB;IACjE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,GAAG,EAAE;QACV,OAAO,EAAE,EAAE,CAAC;QACZ,WAAW,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAAU,EACV,QAAqD,EACrD,OAAoB;IAEpB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAU,EAAE,YAAsB;IACjE,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAU,EACV,YAAsB;IAEtB,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAU,EACV,OAAkE;IAElE,OAAO,YAAY,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAU;IACzC,OAAO,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,QAAgB;IAC5D,OAAO,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE,WAAmB;IAClE,OAAO,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAU;IACrC,OAAO,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAU,EAAE,IAAiB;IACnE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAU;IAC1C,KAAK,IAAI,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,IAAU,EAAE,IAAY;IAC5C,MAAM,QAAQ,GAAI,IAA2C,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,aAAa,CACjB,yBAAyB,EACzB,GAAG,IAAI,gEAAgE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/database/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `pyric/database` — sandbox-only mirror of `firebase/database`.
+ *
+ * Production selection happens before this module loads: canonical
+ * `firebase/database` imports either remain Firebase or are swapped to this
+ * package by the Vite/import-map or Node register boundary.
+ */
+export * from './modular.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/database/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/database/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,cAAc,CAAC"}

package/dist/database/index.js

@@ -0,0 +1,9 @@
+/**
+ * `pyric/database` — sandbox-only mirror of `firebase/database`.
+ *
+ * Production selection happens before this module loads: canonical
+ * `firebase/database` imports either remain Firebase or are swapped to this
+ * package by the Vite/import-map or Node register boundary.
+ */
+export * from './modular.js';
+//# sourceMappingURL=index.js.map

package/dist/database/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/database/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,cAAc,CAAC"}

package/dist/database/listener-registry.d.ts

@@ -0,0 +1,16 @@
+/** Per-service listener registration identity for Firebase-compatible `off()`. */
+export interface ListenerRegistration {
+    unsubscribe(): void;
+}
+export declare class ListenerRegistry {
+    private readonly byTarget;
+    private readonly callbackIds;
+    private nextCallbackId;
+    add(target: object, path: string, event: string, callback: object, registration: ListenerRegistration): void;
+    removeExact(target: object, path: string, event: string, callback: object, registration: ListenerRegistration): void;
+    takeFirst(target: object, path: string, event: string, callback: object): ListenerRegistration | undefined;
+    takeMatching(target: object, path: string, event?: string): ListenerRegistration[];
+    private mapFor;
+    private key;
+}
+//# sourceMappingURL=listener-registry.d.ts.map

package/dist/database/listener-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listener-registry.d.ts","sourceRoot":"","sources":["../../src/database/listener-registry.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,MAAM,WAAW,oBAAoB;IACnC,WAAW,IAAI,IAAI,CAAC;CACrB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8D;IACvF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAC7D,OAAO,CAAC,cAAc,CAAK;IAE3B,GAAG,CACD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,oBAAoB,GACjC,IAAI;IAQP,WAAW,CACT,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,oBAAoB,GACjC,IAAI;IAUP,SAAS,CACP,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,oBAAoB,GAAG,SAAS;IASnC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,oBAAoB,EAAE;IAgBlF,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,GAAG;CAQZ"}