pyric 0.0.1 → 0.1.0-alpha.10

package/dist/sandbox/admin-firestore/local-handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-handle.d.ts","sourceRoot":"","sources":["../../../src/sandbox/admin-firestore/local-handle.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAGrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,cAAc,EACnB,WAAW,UAAQ,GAClB,gBAAgB,CAyDlB"}

package/dist/sandbox/admin-firestore/local-handle.js

@@ -0,0 +1,74 @@
+/**
+ * Raw local-engine `SandboxFirestore` builder — wraps the
+ * `pyric/sandbox/admin-compat` implementation for one `SandboxContext`.
+ * Used by both `get-firestore.ts` (rules-enforced) and
+ * `get-admin-firestore.ts` (rules-bypassing); the `bypassRules` flag is
+ * the only difference between the two callers.
+ */
+import { createCompatFirestore } from 'pyric/sandbox/admin-compat';
+import { isRemoteSandbox } from 'pyric/sandbox';
+import { getInternalEnv } from 'pyric/sandbox/internal';
+import { provenanceForOperationContext } from 'pyric/sandbox/internal';
+/**
+ * Build a `SandboxFirestore` that delegates each operation to a freshly
+ * constructed compat impl. Constructing the delegate per-call is cheap
+ * (no allocation cost beyond the class instance) and ensures the
+ * operation reads from whatever environment the sandbox currently
+ * exposes — `reset()` propagates without explicit cache invalidation.
+ *
+ * The handle ignores any per-op `OperationOptions` it receives and
+ * always issues operations under `ctx.auth`. To test as a different
+ * user, derive a sibling context via `sandbox.withAuth(...)` and
+ * attach a service handle to that.
+ */
+export function buildFirestoreHandle(ctx, bypassRules = false) {
+    // Invariant: remote-branded sandboxes are dispatched to the channel-backed
+    // arm by getFirestore/getAdminFirestore before this builder runs. Reaching
+    // here with a remote ctx means a dispatch bug, not a capability gap.
+    if (isRemoteSandbox(ctx.sandbox)) {
+        throw new Error('pyric/sandbox/admin-firestore: internal — a remote sandbox context ' +
+            'reached the local engine builder; remote dispatch should have ' +
+            'handled it. Please report this.');
+    }
+    const delegate = () => createCompatFirestore(getInternalEnv(ctx.sandbox), {
+        auth: ctx.auth,
+        bypassRules,
+        provenance: provenanceForOperationContext(ctx.operationContext),
+    });
+    return {
+        // ── Production-shaped surface ────────────────────────────────────
+        collection(path) {
+            return delegate().collection(path);
+        },
+        doc(path) {
+            return delegate().doc(path);
+        },
+        collectionGroup(collectionId) {
+            return delegate().collectionGroup(collectionId);
+        },
+        batch() {
+            return delegate().batch();
+        },
+        runTransaction(fn, _opts) {
+            return delegate().runTransaction(fn);
+        },
+        // ── Sandbox-only surface ─────────────────────────────────────────
+        setRules(rules) {
+            return getInternalEnv(ctx.sandbox).deployRules(rules);
+        },
+        seed(options) {
+            const env = getInternalEnv(ctx.sandbox);
+            // `LocalEnvironment.seed` rebuilds state and returns the lint of
+            // the (preserved) ruleset. Pass the current rules through so
+            // `db.seed({ documents })` doesn't accidentally clear them.
+            return env.seed({
+                rules: env.getRules(),
+                documents: options?.documents ?? {},
+            });
+        },
+        snapshot() {
+            return getInternalEnv(ctx.sandbox).snapshot();
+        },
+    };
+}
+//# sourceMappingURL=local-handle.js.map

package/dist/sandbox/admin-firestore/local-handle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-handle.js","sourceRoot":"","sources":["../../../src/sandbox/admin-firestore/local-handle.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAYnE,OAAO,EAAE,eAAe,EAAuB,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAGvE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,gEAAgE;YAChE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,GAAc,EAAE,CAC/B,qBAAqB,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QACjD,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW;QACX,UAAU,EAAE,6BAA6B,CAAC,GAAG,CAAC,gBAAgB,CAAC;KAChE,CAAC,CAAC;IAEL,OAAO;QACL,oEAAoE;QACpE,UAAU,CAAC,IAAY;YACrB,OAAO,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,GAAG,CAAC,IAAY;YACd,OAAO,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,eAAe,CAAC,YAAoB;YAClC,OAAO,QAAQ,EAAE,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QACD,KAAK;YACH,OAAO,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,cAAc,CACZ,EAAuC,EACvC,KAAwB;YAExB,OAAO,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,oEAAoE;QACpE,QAAQ,CAAC,KAAa;YACpB,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,OAAsD;YACzD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,iEAAiE;YACjE,6DAA6D;YAC7D,4DAA4D;YAC5D,OAAO,GAAG,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACrB,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QACD,QAAQ;YACN,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sandbox/admin-firestore/remote/batch.d.ts

@@ -0,0 +1,6 @@
+/** `WriteBatch` for the remote arm — buffers writes client-side and
+ *  ships them as one `batchCommit` op. */
+import type { WriteBatch } from 'pyric/sandbox/admin-compat';
+import { type RemoteArm } from './channel.js';
+export declare function makeWriteBatch(arm: RemoteArm): WriteBatch;
+//# sourceMappingURL=batch.d.ts.map

package/dist/sandbox/admin-firestore/remote/batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.d.ts","sourceRoot":"","sources":["../../../../src/sandbox/admin-firestore/remote/batch.ts"],"names":[],"mappings":"AAAA;0CAC0C;AAG1C,OAAO,KAAK,EAAqD,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAChH,OAAO,EAAS,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAIrD,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CA+BzD"}

package/dist/sandbox/admin-firestore/remote/batch.js

@@ -0,0 +1,38 @@
+/** `WriteBatch` for the remote arm — buffers writes client-side and
+ *  ships them as one `batchCommit` op. */
+import { SandboxError } from 'pyric/sandbox';
+import { armOp } from './channel.js';
+import { encodeWriteData } from './value-codec.js';
+export function makeWriteBatch(arm) {
+    const writes = [];
+    let committed = false;
+    const batch = {
+        set(ref, data) {
+            assertNotCommitted();
+            writes.push({ method: 'set', path: ref.path, data: encodeWriteData(data) });
+            return batch;
+        },
+        update(ref, data) {
+            assertNotCommitted();
+            writes.push({ method: 'update', path: ref.path, data: encodeWriteData(data) });
+            return batch;
+        },
+        delete(ref) {
+            assertNotCommitted();
+            writes.push({ method: 'delete', path: ref.path });
+            return batch;
+        },
+        async commit(_opts) {
+            assertNotCommitted();
+            committed = true;
+            await armOp(arm, { method: 'batchCommit', writes });
+        },
+    };
+    function assertNotCommitted() {
+        if (committed) {
+            throw new SandboxError('failed-precondition', 'WriteBatch has already been committed.');
+        }
+    }
+    return batch;
+}
+//# sourceMappingURL=batch.js.map

package/dist/sandbox/admin-firestore/remote/batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.js","sourceRoot":"","sources":["../../../../src/sandbox/admin-firestore/remote/batch.ts"],"names":[],"mappings":"AAAA;0CAC0C;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,KAAK,EAAkB,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGnD,MAAM,UAAU,cAAc,CAAC,GAAc;IAC3C,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,KAAK,GAAe;QACxB,GAAG,CAAC,GAAsB,EAAE,IAAkB;YAC5C,kBAAkB,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,GAAsB,EAAE,IAAkB;YAC/C,kBAAkB,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,GAAsB;YAC3B,kBAAkB,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAwB;YACnC,kBAAkB,EAAE,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;IACF,SAAS,kBAAkB;QACzB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/sandbox/admin-firestore/remote/channel.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Channel plumbing shared by every remote-arm constructor: the per-handle
+ * immutable state (channel + pinned identity lens) and the one op
+ * dispatcher every read/write/query/transaction call goes through.
+ *
+ * IDENTITY: every op and every subscription pins an EXPLICIT `actAs` lens.
+ * An ABSENT lens resolves worker-side to the browser tab's PORT SESSION —
+ * whoever happens to be signed in in the tab — which is never what a
+ * server-side handle means. `getAdminFirestore` pins `{ mode: 'admin' }`
+ * (rules bypass); `getFirestore(ctx)` pins `{ mode: 'as', uid, token? }`
+ * for a signed identity or `{ mode: 'anon' }` for `withAuth(null)`.
+ */
+import type { AuthLens, RemoteSandbox } from 'pyric/sandbox';
+/** Per-handle immutable state: the relay channel + the pinned lens. */
+export interface RemoteArm {
+    readonly sandbox: RemoteSandbox;
+    readonly lens: AuthLens;
+}
+/** Dispatch one worker op with the handle's lens pinned; wire errors
+ *  re-shape into `SandboxError`. */
+export declare function armOp(arm: RemoteArm, op: Record<string, unknown>): Promise<unknown>;
+//# sourceMappingURL=channel.d.ts.map

package/dist/sandbox/admin-firestore/remote/channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../../../../src/sandbox/admin-firestore/remote/channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG7D,uEAAuE;AACvE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED;oCACoC;AACpC,wBAAsB,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CASzF"}

package/dist/sandbox/admin-firestore/remote/channel.js

@@ -0,0 +1,27 @@
+/**
+ * Channel plumbing shared by every remote-arm constructor: the per-handle
+ * immutable state (channel + pinned identity lens) and the one op
+ * dispatcher every read/write/query/transaction call goes through.
+ *
+ * IDENTITY: every op and every subscription pins an EXPLICIT `actAs` lens.
+ * An ABSENT lens resolves worker-side to the browser tab's PORT SESSION —
+ * whoever happens to be signed in in the tab — which is never what a
+ * server-side handle means. `getAdminFirestore` pins `{ mode: 'admin' }`
+ * (rules bypass); `getFirestore(ctx)` pins `{ mode: 'as', uid, token? }`
+ * for a signed identity or `{ mode: 'anon' }` for `withAuth(null)`.
+ */
+import { toRemoteSandboxError } from './errors.js';
+/** Dispatch one worker op with the handle's lens pinned; wire errors
+ *  re-shape into `SandboxError`. */
+export async function armOp(arm, op) {
+    try {
+        return await arm.sandbox.channel.op({
+            ...op,
+            actAs: arm.lens,
+        });
+    }
+    catch (e) {
+        throw toRemoteSandboxError(e);
+    }
+}
+//# sourceMappingURL=channel.js.map

package/dist/sandbox/admin-firestore/remote/channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.js","sourceRoot":"","sources":["../../../../src/sandbox/admin-firestore/remote/channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAQnD;oCACoC;AACpC,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAc,EAAE,EAA2B;IACrE,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,GAAI,EAAyB;YAC7B,KAAK,EAAE,GAAG,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;AACH,CAAC"}

package/dist/sandbox/admin-firestore/remote/doc-ref.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `DocumentReference`/`CollectionReference` construction for the remote
+ * arm — thin wire-backed handles that dispatch reads/writes through
+ * `armOp` and delegate collection-shaped state to `makeQuery`.
+ */
+import type { CollectionReference, DocumentReference } from 'pyric/sandbox/admin-compat';
+import { type RemoteArm } from './channel.js';
+export declare function makeCollectionRef(arm: RemoteArm, path: string): CollectionReference;
+export declare function makeDocRef(arm: RemoteArm, path: string): DocumentReference;
+//# sourceMappingURL=doc-ref.d.ts.map

package/dist/sandbox/admin-firestore/remote/doc-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doc-ref.d.ts","sourceRoot":"","sources":["../../../../src/sandbox/admin-firestore/remote/doc-ref.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,mBAAmB,EAEnB,iBAAiB,EAIlB,MAAM,4BAA4B,CAAC;AAOpC,OAAO,EAAS,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAarD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,mBAAmB,CA0BnF;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAwC1E"}

package/dist/sandbox/admin-firestore/remote/doc-ref.js

@@ -0,0 +1,88 @@
+/**
+ * `DocumentReference`/`CollectionReference` construction for the remote
+ * arm — thin wire-backed handles that dispatch reads/writes through
+ * `armOp` and delegate collection-shaped state to `makeQuery`.
+ */
+import { isCollectionPath, lastSegment, parentCollectionPath, } from '../../firestore/admin-compat/paths.js';
+import { generateAutoId } from '../../firestore/auto-id.js';
+import { armOp } from './channel.js';
+import { invalidArgument } from './errors.js';
+import { encodeWriteData } from './value-codec.js';
+import { makeDocumentSnapshot } from './snapshots.js';
+import { makeQuery } from './query.js';
+import { chainableOnSnapshot, REMOTE_SNAPSHOT_REGISTRAR, registerRemoteListener, } from './listeners.js';
+export function makeCollectionRef(arm, path) {
+    const base = makeQuery(arm, {
+        source: { __ref: 'collection', path },
+        filters: [],
+        orders: [],
+        limitFromEnd: false,
+    });
+    const coll = Object.assign(Object.create(Object.getPrototypeOf(base)), base, {
+        id: lastSegment(path),
+        path,
+        doc(id) {
+            const finalId = id ?? generateAutoId();
+            return makeDocRef(arm, `${path}/${finalId}`);
+        },
+        async add(data, _opts) {
+            // The worker mints the id (`addDoc`), so creation is one round-trip
+            // and the id is authoritative from the shared sandbox.
+            const res = (await armOp(arm, {
+                method: 'addDoc',
+                collectionPath: path,
+                data: encodeWriteData(data),
+            }));
+            return makeDocRef(arm, res.path);
+        },
+    });
+    return coll;
+}
+export function makeDocRef(arm, path) {
+    const ref = {
+        id: lastSegment(path),
+        path,
+        get parent() {
+            return makeCollectionRef(arm, parentCollectionPath(path));
+        },
+        collection(name) {
+            const sub = `${path}/${name}`;
+            if (!isCollectionPath(sub)) {
+                throw invalidArgument(`collection path must have an odd number of segments: ${sub}`);
+            }
+            return makeCollectionRef(arm, sub);
+        },
+        async get(_opts) {
+            const wire = (await armOp(arm, { method: 'getDoc', path }));
+            return makeDocumentSnapshot(ref, wire);
+        },
+        async set(data, options) {
+            await armOp(arm, {
+                method: 'setDoc',
+                path,
+                data: encodeWriteData(data),
+                ...(setOptionsForWire(options) ? { options: setOptionsForWire(options) } : {}),
+            });
+        },
+        async update(data, _opts) {
+            await armOp(arm, { method: 'updateDoc', path, data: encodeWriteData(data) });
+        },
+        async delete(_opts) {
+            await armOp(arm, { method: 'deleteDoc', path });
+        },
+        [REMOTE_SNAPSHOT_REGISTRAR]: (options, onNext, onError) => registerRemoteListener(arm, { __ref: 'doc', path }, options, onNext, onError),
+        onSnapshot: chainableOnSnapshot,
+    };
+    return ref;
+}
+function setOptionsForWire(options) {
+    if (!options)
+        return undefined;
+    const wire = {};
+    if (options.merge !== undefined)
+        wire.merge = options.merge;
+    if (options.mergeFields !== undefined)
+        wire.mergeFields = [...options.mergeFields];
+    return wire.merge !== undefined || wire.mergeFields !== undefined ? wire : undefined;
+}
+//# sourceMappingURL=doc-ref.js.map

package/dist/sandbox/admin-firestore/remote/doc-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doc-ref.js","sourceRoot":"","sources":["../../../../src/sandbox/admin-firestore/remote/doc-ref.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,oBAAoB,GACrB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAkB,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,GAEvB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,UAAU,iBAAiB,CAAC,GAAc,EAAE,IAAY;IAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE;QAC1B,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE;QACrC,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,MAAM,IAAI,GAAwB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE;QAChG,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC;QACrB,IAAI;QACJ,GAAG,CAAC,EAAW;YACb,MAAM,OAAO,GAAG,EAAE,IAAI,cAAc,EAAE,CAAC;YACvC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAkB,EAAE,KAAwB;YACpD,oEAAoE;YACpE,uDAAuD;YACvD,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,cAAc,EAAE,IAAI;gBACpB,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;aAC5B,CAAC,CAAiC,CAAC;YACpC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAc,EAAE,IAAY;IACrD,MAAM,GAAG,GAGL;QACF,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC;QACrB,IAAI;QACJ,IAAI,MAAM;YACR,OAAO,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,UAAU,CAAC,IAAY;YACrB,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,eAAe,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAwB;YAChC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAgB,CAAC;YAC3E,OAAO,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAkB,EAAE,OAAoB;YAChD,MAAM,KAAK,CAAC,GAAG,EAAE;gBACf,MAAM,EAAE,QAAQ;gBAChB,IAAI;gBACJ,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;gBAC3B,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAkB,EAAE,KAAwB;YACvD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAwB;YACnC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,CAAC,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CACxD,sBAAsB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QAC/E,UAAU,EAAE,mBAAmB;KAChC,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAoB;IAEpB,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,IAAI,GAAgD,EAAE,CAAC;IAC7D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5D,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC"}

package/dist/sandbox/admin-firestore/remote/errors.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Wire-error translation for the remote arm — mirrors the shape the
+ * local arm's `../error-translation.ts` produces so callers see one
+ * `SandboxError` regardless of which arm ran the operation.
+ */
+import { SandboxError } from 'pyric/sandbox';
+/**
+ * Wire errors arrive as `Error & { code, denialContext? }` (the channel
+ * reconstructs them from the protocol's `SerializedError`). Re-shape them
+ * into the SAME `SandboxError` the local arm throws, re-attaching the
+ * structured `denialContext` when the worker carried one — so
+ * `err instanceof SandboxError && err.code === 'permission-denied'` and
+ * `err.denialContext` work identically on both arms.
+ */
+export declare function toRemoteSandboxError(err: unknown): unknown;
+export declare function invalidArgument(message: string): SandboxError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/sandbox/admin-firestore/remote/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/sandbox/admin-firestore/remote/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,YAAY,EAGb,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAa1D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE7D"}

package/dist/sandbox/admin-firestore/remote/errors.js

@@ -0,0 +1,32 @@
+/**
+ * Wire-error translation for the remote arm — mirrors the shape the
+ * local arm's `../error-translation.ts` produces so callers see one
+ * `SandboxError` regardless of which arm ran the operation.
+ */
+import { SandboxError, } from 'pyric/sandbox';
+/**
+ * Wire errors arrive as `Error & { code, denialContext? }` (the channel
+ * reconstructs them from the protocol's `SerializedError`). Re-shape them
+ * into the SAME `SandboxError` the local arm throws, re-attaching the
+ * structured `denialContext` when the worker carried one — so
+ * `err instanceof SandboxError && err.code === 'permission-denied'` and
+ * `err.denialContext` work identically on both arms.
+ */
+export function toRemoteSandboxError(err) {
+    if (err instanceof SandboxError)
+        return err;
+    if (err !== null && typeof err === 'object') {
+        const e = err;
+        if (typeof e.code === 'string' && typeof e.message === 'string') {
+            const denialContext = e.denialContext !== null && typeof e.denialContext === 'object'
+                ? e.denialContext
+                : undefined;
+            return new SandboxError(e.code, e.message, denialContext);
+        }
+    }
+    return err;
+}
+export function invalidArgument(message) {
+    return new SandboxError('invalid-argument', message);
+}
+//# sourceMappingURL=errors.js.map

package/dist/sandbox/admin-firestore/remote/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../src/sandbox/admin-firestore/remote/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,YAAY,GAGb,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,GAAG,YAAY,YAAY;QAAE,OAAO,GAAG,CAAC;IAC5C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,GAAqE,CAAC;QAChF,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,aAAa,GACjB,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;gBAC7D,CAAC,CAAE,CAAC,CAAC,aAA+B;gBACpC,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,IAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,IAAI,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC"}

package/dist/sandbox/admin-firestore/remote/listeners.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Remote-arm `onSnapshot` plumbing: the hidden registrar hook every
+ * remote ref/query exposes, the chainable `.onSnapshot(...)` shim that
+ * late-binds to the free `onSnapshot` function, and the worker
+ * subscription that adapts wire snap frames into Web-SDK-shaped live
+ * snapshots.
+ */
+import type { RemoteArm } from './channel.js';
+import type { WireTarget } from './wire-types.js';
+/**
+ * Hidden hook the free `onSnapshot(ref, …)` in `../listeners.ts`
+ * dispatches on: every remote ref/query exposes a registrar under this
+ * symbol that takes the NORMALIZED argument set and returns the
+ * unsubscribe. `Symbol.for` is unnecessary here (single module graph
+ * inside `pyric`), but a plain unique symbol keeps it invisible to
+ * consumer code.
+ */
+export declare const REMOTE_SNAPSHOT_REGISTRAR: unique symbol;
+export type RemoteSnapshotRegistrar = (options: {
+    includeMetadataChanges?: boolean;
+}, onNext: ((snapshot: unknown) => void) | undefined, onError: ((error: unknown) => void) | undefined) => () => void;
+/** Is this ref one of the remote arm's (carries the registrar hook)? */
+export declare function getRemoteSnapshotRegistrar(ref: unknown): RemoteSnapshotRegistrar | undefined;
+/**
+ * Late-bound reference to the free `onSnapshot` from `../listeners.ts`,
+ * backing the chainable `ref.onSnapshot(...)` method on remote refs
+ * (parity with the local arm's Proxy-synthesized shim). Registered at
+ * module init from `../listeners.ts` — a static import back would be a
+ * cycle at runtime.
+ */
+type FreeOnSnapshot = (ref: unknown, ...args: unknown[]) => () => void;
+export declare function registerRemoteOnSnapshotImpl(fn: FreeOnSnapshot): void;
+export declare function chainableOnSnapshot(this: unknown, ...args: unknown[]): () => void;
+/** Register a worker subscription for a resolved target and adapt snap
+ *  frames into the Web-SDK-shaped live snapshots the local `onSnapshot`
+ *  delivers. Wire `__error` snaps (establishment AND mid-stream, e.g. a
+ *  rules redeploy turning the read into a denial) surface through
+ *  `onError` as `SandboxError`s with `denialContext` when carried. */
+export declare function registerRemoteListener(arm: RemoteArm, target: WireTarget, options: {
+    includeMetadataChanges?: boolean;
+}, onNext: ((snapshot: unknown) => void) | undefined, onError: ((error: unknown) => void) | undefined): () => void;
+export {};
+//# sourceMappingURL=listeners.d.ts.map

package/dist/sandbox/admin-firestore/remote/listeners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listeners.d.ts","sourceRoot":"","sources":["../../../../src/sandbox/admin-firestore/remote/listeners.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAA8B,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE9E;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,EAAE,OAAO,MAE9C,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,CACpC,OAAO,EAAE;IAAE,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7C,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,EACjD,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,KAC5C,MAAM,IAAI,CAAC;AAEhB,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,SAAS,CAI5F;AAED;;;;;;GAMG;AACH,KAAK,cAAc,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,MAAM,IAAI,CAAC;AAGvE,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI,CAErE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAQjF;AAED;;;;sEAIsE;AACtE,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7C,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,EACjD,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,GAC9C,MAAM,IAAI,CAkDZ"}

package/dist/sandbox/admin-firestore/remote/listeners.js

@@ -0,0 +1,89 @@
+/**
+ * Remote-arm `onSnapshot` plumbing: the hidden registrar hook every
+ * remote ref/query exposes, the chainable `.onSnapshot(...)` shim that
+ * late-binds to the free `onSnapshot` function, and the worker
+ * subscription that adapts wire snap frames into Web-SDK-shaped live
+ * snapshots.
+ */
+import { SandboxError } from 'pyric/sandbox';
+import { buildDocumentSnapshot, buildQuerySnapshot, } from '../../firestore/snapshot-listeners.js';
+import { toRemoteSandboxError } from './errors.js';
+import { decodeInternal } from './value-codec.js';
+/**
+ * Hidden hook the free `onSnapshot(ref, …)` in `../listeners.ts`
+ * dispatches on: every remote ref/query exposes a registrar under this
+ * symbol that takes the NORMALIZED argument set and returns the
+ * unsubscribe. `Symbol.for` is unnecessary here (single module graph
+ * inside `pyric`), but a plain unique symbol keeps it invisible to
+ * consumer code.
+ */
+export const REMOTE_SNAPSHOT_REGISTRAR = Symbol('pyric/sandbox/admin-firestore/remoteSnapshotRegistrar');
+/** Is this ref one of the remote arm's (carries the registrar hook)? */
+export function getRemoteSnapshotRegistrar(ref) {
+    if (ref === null || typeof ref !== 'object')
+        return undefined;
+    const registrar = ref[REMOTE_SNAPSHOT_REGISTRAR];
+    return typeof registrar === 'function' ? registrar : undefined;
+}
+let freeOnSnapshot = null;
+export function registerRemoteOnSnapshotImpl(fn) {
+    freeOnSnapshot = fn;
+}
+export function chainableOnSnapshot(...args) {
+    if (freeOnSnapshot === null) {
+        throw new SandboxError('failed-precondition', 'remote Firestore: onSnapshot is not wired yet — import pyric-admin/firestore (or pyric/sandbox/admin-firestore) before subscribing.');
+    }
+    return freeOnSnapshot(this, ...args);
+}
+/** Register a worker subscription for a resolved target and adapt snap
+ *  frames into the Web-SDK-shaped live snapshots the local `onSnapshot`
+ *  delivers. Wire `__error` snaps (establishment AND mid-stream, e.g. a
+ *  rules redeploy turning the read into a denial) surface through
+ *  `onError` as `SandboxError`s with `denialContext` when carried. */
+export function registerRemoteListener(arm, target, options, onNext, onError) {
+    const excludesMetadataChanges = options.includeMetadataChanges !== true;
+    // Previous query rows, kept so `docChanges()` diffs across fires the
+    // same way the local listener path does.
+    let prevDocs;
+    let detach;
+    try {
+        detach = arm.sandbox.channel.subscribe({ target, actAs: arm.lens }, (value) => {
+            if (!onNext)
+                return;
+            const snap = value;
+            if (Array.isArray(snap.docs)) {
+                // Query fire. `buildQuerySnapshot` translates the internal-form
+                // data to compat shapes itself, so decode WITHOUT translation.
+                const docList = snap.docs.map((row) => ({
+                    path: row.path ?? row.id,
+                    data: row.data ? decodeInternal(row.data) : {},
+                }));
+                const queryPath = target.__ref === 'query'
+                    ? (target.source.__ref === 'group' ? target.source.collectionId : target.source.path)
+                    : target.__ref === 'group'
+                        ? target.collectionId
+                        : target.path;
+                const querySnap = buildQuerySnapshot({ path: queryPath }, docList, { excludesMetadataChanges }, prevDocs);
+                prevDocs = docList;
+                onNext(querySnap);
+            }
+            else if (typeof snap.id === 'string') {
+                // Doc fire.
+                const path = snap.path ?? snap.id;
+                const data = snap.exists && snap.data ? decodeInternal(snap.data) : null;
+                onNext(buildDocumentSnapshot(path, data));
+            }
+        }, (err) => {
+            const translated = toRemoteSandboxError(err);
+            if (onError)
+                onError(translated);
+            else
+                console.error('pyric remote Firestore: uncaught onSnapshot error:', translated);
+        });
+    }
+    catch (e) {
+        throw toRemoteSandboxError(e);
+    }
+    return detach;
+}
+//# sourceMappingURL=listeners.js.map

package/dist/sandbox/admin-firestore/remote/listeners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listeners.js","sourceRoot":"","sources":["../../../../src/sandbox/admin-firestore/remote/listeners.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EACL,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIlD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAkB,MAAM,CAC5D,uDAAuD,CACxD,CAAC;AAQF,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,GAAY;IACrD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,SAAS,GAAI,GAAiD,CAAC,yBAAyB,CAAC,CAAC;IAChG,OAAO,OAAO,SAAS,KAAK,UAAU,CAAC,CAAC,CAAE,SAAqC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9F,CAAC;AAUD,IAAI,cAAc,GAA0B,IAAI,CAAC;AAEjD,MAAM,UAAU,4BAA4B,CAAC,EAAkB;IAC7D,cAAc,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAgB,GAAG,IAAe;IACnE,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CACpB,qBAAqB,EACrB,qIAAqI,CACtI,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;sEAIsE;AACtE,MAAM,UAAU,sBAAsB,CACpC,GAAc,EACd,MAAkB,EAClB,OAA6C,EAC7C,MAAiD,EACjD,OAA+C;IAE/C,MAAM,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,KAAK,IAAI,CAAC;IACxE,qEAAqE;IACrE,yCAAyC;IACzC,IAAI,QAAiE,CAAC;IAEtE,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CACpC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAC3B,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,IAAI,GAAG,KAAsD,CAAC;YACpE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,gEAAgE;gBAChE,+DAA+D;gBAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACtC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE;oBACxB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;iBAC/C,CAAC,CAAC,CAAC;gBACJ,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,KAAK,OAAO;oBACxC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACrF,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO;wBACxB,CAAC,CAAC,MAAM,CAAC,YAAY;wBACrB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClB,MAAM,SAAS,GAAG,kBAAkB,CAClC,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,OAAO,EACP,EAAE,uBAAuB,EAAE,EAC3B,QAAQ,CACT,CAAC;gBACF,QAAQ,GAAG,OAAO,CAAC;gBACnB,MAAM,CAAC,SAAS,CAAC,CAAC;YACpB,CAAC;iBAAM,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACvC,YAAY;gBACZ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzE,MAAM,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,OAAO;gBAAE,OAAO,CAAC,UAAU,CAAC,CAAC;;gBAC5B,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,UAAU,CAAC,CAAC;QACvF,CAAC,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/sandbox/admin-firestore/remote/query.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Chainable `Query` for the remote arm — accumulates `where`/`orderBy`/
+ * cursor/`limit` state immutably (mirroring the local arm's `QueryImpl`)
+ * and flattens it into the wire's constraint list on execution.
+ *
+ * KNOWN CURSOR LIMITS: the wire has no document-key cursor, so snapshot
+ * cursors require explicit non-`__name__` orderBy fields and lose the
+ * implicit `__name__` tie-break — see {@link cursorValuesFromSnapshot}.
+ */
+import type { OrderDirection, Query } from 'pyric/sandbox/admin-compat';
+import { type RemoteArm } from './channel.js';
+import type { WireFilter, WireTarget } from './wire-types.js';
+/** Immutable query state accumulated by the chainable constraint calls.
+ *  Cursors REPLACE on repeat (matching the local arm / production). */
+export interface QueryState {
+    readonly source: {
+        __ref: 'collection';
+        path: string;
+    } | {
+        __ref: 'group';
+        collectionId: string;
+    };
+    readonly filters: readonly WireFilter[];
+    readonly orders: readonly {
+        field: string;
+        direction: OrderDirection;
+    }[];
+    readonly limitCount?: number;
+    readonly limitFromEnd: boolean;
+    readonly start?: {
+        values: readonly unknown[];
+        inclusive: boolean;
+    };
+    readonly end?: {
+        values: readonly unknown[];
+        inclusive: boolean;
+    };
+}
+export declare function queryStateOf(value: unknown): QueryState | undefined;
+/** Flatten the accumulated state into the wire's constraint list. */
+export declare function buildDescriptor(state: QueryState): WireTarget;
+export declare function makeQuery(arm: RemoteArm, state: QueryState): Query;
+/** Client-side runtime checks matching the local arm's execution-time
+ *  contract, so the failure surfaces with the same code + guidance
+ *  instead of a worker round-trip. */
+export declare function validateExecutable(state: QueryState): void;
+//# sourceMappingURL=query.d.ts.map

package/dist/sandbox/admin-firestore/remote/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../../src/sandbox/admin-firestore/remote/query.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAMV,cAAc,EACd,KAAK,EAGN,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAS,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,KAAK,EAAkB,UAAU,EAAiB,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7F;uEACuE;AACvE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAClG,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,cAAc,CAAA;KAAE,EAAE,CAAC;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CACnE;AAMD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAGnE;AAqBD,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CA0B7D;AAwDD,wBAAgB,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,GAAG,KAAK,CA8ElE;AAED;;sCAEsC;AACtC,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAI1D"}