pyric 0.0.1 → 0.1.0-alpha.7

package/dist/sandbox/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAChD,IAAI,CAAC;AAET;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;CAG7B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAExB,kBAAkB,GAClB,mBAAmB,GACnB,WAAW,GACX,gBAAgB,GAChB,qBAAqB,GACrB,SAAS,GACT,aAAa,GAEb,eAAe,GACf,YAAY,GACZ,kBAAkB,CAAC;AAEvB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa;IAC5B,wHAAwH;IACxH,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,2DAA2D;IAC3D,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;QACxD,IAAI,EAAE,MAAM,CAAC;QACb;;;;;;;WAOG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACrC,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAElB,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,aAAa;gBACtE,OAAO,EAAE,mBAAmB;CAyBzC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,QAAQ,IAAI,OAAO,CAAC;IAEpB;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAE7B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,EAAE;QACR;;;;WAIG;QACH,UAAU,IAAI,MAAM,GAAG,IAAI,CAAC;QAE5B;;;;;;WAMG;QACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAE3B;;;;;;;;;WASG;QACH,IAAI,IAAI,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;QAErC;;;;;;;;;WASG;QACH,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;KAC7C,CAAC;CACH;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B;;yDAEqD;IACrD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAE1C;;;;;OAKG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,IAAI,CAAA;KAAE,EAAE,CAAC;IAEjF;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE/D;;;;;;OAMG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;GAQG;AACH;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;QACxD,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACrC,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EACF;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC7B;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;QACxD,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACrC,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,YAAY;IAC3B,qBAAqB;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB,mEAAmE;IACnE,EAAE,EAAE,MAAM,CAAC;IACX,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAC;IACX,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB;;;+BAG2B;IAC3B,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,aAAa,CAAC;IACzC;oFACgF;IAChF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;yDAKqD;IACrD,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,CAAC;IACF,yEAAyE;IACzE,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACrC,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,iEAAiE;IACjE,aAAa,CAAC,EAAE;QACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACrC,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF;0EACsE;IACtE,WAAW,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC1D;;;;;;;mCAO+B;IAC/B,aAAa,CAAC,EAAE,OAAO,uBAAuB,EAAE,iBAAiB,CAAC;IAClE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,GAAG,OAAO,CAAC;IACtD,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;wEACoE;IACpE,SAAS,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IACpC;8DAC0D;IAC1D,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C;;gEAE4D;IAC5D,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB;;;;iDAI6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IACpC;;;;;;kCAM8B;IAC9B,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,iBAAiB,GAAG,WAAW,GAAG,YAAY,GAAG,aAAa,GAAG,QAAQ,CAAC;KACjF,CAAC,CAAC;IACH;;;4CAGwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;wCAKoC;IACpC,WAAW,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD;;wCAEoC;IACpC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EACF;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC7B;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;KACrE,CAAC;IACF;gDAC4C;IAC5C,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EACF;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC7B;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,IAAI,EAAE,SAAS,CAAC;IAChB,gEAAgE;IAChE,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EACF;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC7B;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,IAAI,EAAE,SAAS,CAAC;IAChB,4CAA4C;IAC5C,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,mBAAmB,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACrC;;;;;;;;OAQG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;gEAE4D;IAC5D,IAAI,EAAE,SAAS,CAAC;IAChB;;mBAEe;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;2DACuD;IACvD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;wCAGoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,OAAO,GAAG,gBAAgB,CAAC;IACtE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IACpC,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IACpC,MAAM,CAAC,EAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACpD,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,OAAO,CAAC;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,+CAA+C;AAC/C,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;;;GAaG;AACH;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;AAErE;yEACyE;AACzE,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,YAAY,GAAG,CACvB,YAAY,GACZ,iBAAiB,GACjB,qBAAqB,GACrB,uBAAuB,GACvB,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,qBAAqB,GACrB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,CAC3B,GACC,eAAe,CAAC;AAElB;;;;;;;;;GASG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,cAAc,CAAC;IAE1C;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAEvD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,iBAAiB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAEnE;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,IAAI,YAAY,EAAE,CAAC;IAE1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B;;;;;;;;;;;OAWG;IACH,KAAK,IAAI,IAAI,CAAC;IAEd;;;;;;OAMG;IACH,OAAO,IAAI,IAAI,CAAC;IAEhB;;;;OAIG;IACH,QAAQ,IAAI,eAAe,CAAC;IAE5B;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;IAE1C;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,EAAE,SAAS,CAAC;IAEvB;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,aAAa,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC;IAEpD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,iBAAiB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE;;;;;;;OAOG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;;;;OAMG;IACH,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAAC;CACjF;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,cAAc,CAAC;CAC3C"}

package/dist/sandbox/types.js

@@ -0,0 +1,46 @@
+/**
+ * Public type surface for `pyric/sandbox`.
+ *
+ * Kept service-agnostic on purpose: `/app` is the host the rest of the
+ * library plugs into. Service modules (`/firestore`, future `/storage`,
+ * `/auth`, `/database`) depend on these types; they don't ship from
+ * here. See design rationale for the dependency-direction
+ * argument.
+ */
+/**
+ * Sandbox-layer error. Catch with `instanceof SandboxError` and switch
+ * on `code`. `denialContext` is populated for `permission-denied` only
+ * (and only after Slice 4 wires it through).
+ *
+ * Two construction forms are supported:
+ *   - Positional: `new SandboxError(code, message, denialContext?)` —
+ *     the original signature, kept for backward compatibility with
+ *     existing internal call sites.
+ *   - Options bag: `new SandboxError({ code, message, remediation? })` —
+ *     used when attaching remediation guidance.
+ */
+export class SandboxError extends Error {
+    code;
+    denialContext;
+    remediation;
+    constructor(codeOrOptions, message, denialContext) {
+        const isOptions = typeof codeOrOptions === 'object';
+        const code = isOptions ? codeOrOptions.code : codeOrOptions;
+        const baseMessage = isOptions ? codeOrOptions.message : message;
+        const ctx = isOptions ? codeOrOptions.denialContext : denialContext;
+        const remediation = isOptions ? codeOrOptions.remediation : undefined;
+        const fullMessage = remediation !== undefined
+            ? `${baseMessage}\n\nRemediation:\n${remediation}`
+            : baseMessage;
+        super(fullMessage);
+        this.name = 'SandboxError';
+        this.code = code;
+        if (ctx !== undefined) {
+            this.denialContext = ctx;
+        }
+        if (remediation !== undefined) {
+            this.remediation = remediation;
+        }
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/sandbox/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiIH;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmB;IACvB,aAAa,CAAiB;IAC9B,WAAW,CAAU;IAI9B,YACE,aAAqD,EACrD,OAAgB,EAChB,aAA6B;QAE7B,MAAM,SAAS,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC;QACpD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAC5D,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAE,OAAkB,CAAC;QAC5E,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;QACpE,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,WAAW,GACf,WAAW,KAAK,SAAS;YACvB,CAAC,CAAC,GAAG,WAAW,qBAAqB,WAAW,EAAE;YAClD,CAAC,CAAC,WAAW,CAAC;QAClB,KAAK,CAAC,WAAW,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;QAC3B,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QACjC,CAAC;IACH,CAAC;CACF"}

package/dist/storage/admin/api.d.ts

@@ -0,0 +1,206 @@
+/**
+ * Pure-fetch client for the Firebase Storage provisioning APIs.
+ * Takes an OAuth access token directly — works equally from a Node
+ * agent runtime or a browser. Used by:
+ *
+ *   - `ProvisionStorageHandler` server-side via the agent SDK
+ *   - Consumers like the multi-tenant playground via direct import
+ *
+ * The caller is responsible for token scope. `firebase` scope is
+ * enough for the `:addFirebase` + `defaultLocation:finalize` calls,
+ * but **NOT** for enabling the underlying `firebasestorage.googleapis.com`
+ * service (which is the first-time gate). Service-enable requires
+ * `cloud-platform` scope OR a service account with
+ * `roles/serviceusage.serviceUsageAdmin`. Each function below
+ * documents which scope it needs.
+ *
+ * Endpoints under play:
+ *   - serviceusage.googleapis.com/v1/projects/{p}/services/{s}:enable
+ *   - firebase.googleapis.com/v1beta1/projects/{p}/defaultLocation:finalize
+ *   - firebasestorage.googleapis.com/v1beta/projects/{p}/buckets
+ *   - firebasestorage.googleapis.com/v1beta/projects/{p}/buckets/{b}:addFirebase
+ *   - firebaserules.googleapis.com/v1/projects/{p}/releases/firebase.storage
+ */
+export declare class StorageProvisioningError extends Error {
+    readonly status: number;
+    readonly body: string;
+    readonly reason: string | undefined;
+    constructor(status: number, body: string, reason: string | undefined, message: string);
+}
+export type ServiceEnableState = 'enabled' | 'disabled' | 'unknown';
+/**
+ * Probe whether the `firebasestorage.googleapis.com` service is
+ * enabled on the project. Cheap, uses Service Usage `GET`. Requires
+ * `serviceusage.services.get` permission (the default Firebase Admin
+ * SDK SA has this; user OAuth tokens with `firebase` scope do not).
+ *
+ * Returns `'unknown'` on permission failures so callers can downgrade
+ * to "try the operation; observe SERVICE_DISABLED" rather than block.
+ */
+export declare function getStorageServiceState(accessToken: string, projectId: string): Promise<ServiceEnableState>;
+/**
+ * Enable `firebasestorage.googleapis.com` on the project. Requires
+ * `serviceusage.services.enable` IAM permission — included in
+ * `roles/owner`, `roles/editor` (deprecated), or
+ * `roles/serviceusage.serviceUsageAdmin`. The default Firebase Admin
+ * SDK service account does NOT have this; the caller's token must
+ * either be a user-OAuth with `cloud-platform` scope or a SA with
+ * the elevated role.
+ *
+ * Long-running operation under the hood; the response carries an
+ * operation name. We don't poll — the response 200 is enough signal
+ * for our purposes, and a brief settle delay handles propagation.
+ */
+export declare function enableStorageService(accessToken: string, projectId: string): Promise<void>;
+/**
+ * Read the project's current default GCP resources location. Returns
+ * null when the project hasn't been finalized yet — e.g. brand-new
+ * Firebase projects with no resources. `firebase` scope is sufficient.
+ */
+export declare function getDefaultLocation(accessToken: string, projectId: string): Promise<string | null>;
+/**
+ * Set the project's default GCP resources location. IRREVERSIBLE —
+ * once set, the location cannot be changed. Skip-if-set is the
+ * caller's job; this function unconditionally calls `:finalize`.
+ *
+ * Per observed behavior, `:finalize` 404s on projects that already
+ * have resources provisioned (RTDB, Hosting) without a default
+ * location. The error path surfaces that to the caller.
+ */
+export declare function finalizeDefaultLocation(accessToken: string, projectId: string, locationId: string): Promise<void>;
+export interface FirebaseStorageBucket {
+    name: string;
+    bucketId: string;
+    reconciling?: boolean;
+}
+/**
+ * List Firebase-linked Storage buckets on the project. Returns an
+ * empty list when none exist yet. Throws when the underlying service
+ * is disabled — callers should check `getStorageServiceState` first
+ * if they want to distinguish.
+ */
+export declare function listFirebaseBuckets(accessToken: string, projectId: string): Promise<FirebaseStorageBucket[]>;
+/**
+ * Link a Cloud Storage bucket to Firebase Storage. Idempotent — if
+ * the bucket is already Firebase-linked, the API returns 200 with
+ * the existing record. The bucket must already exist as a GCS
+ * resource; for the default Firebase bucket name
+ * (`{projectId}.firebasestorage.app`), Firebase auto-creates it on
+ * first `:addFirebase` call.
+ */
+export declare function addFirebaseToBucket(accessToken: string, projectId: string, bucketId: string): Promise<FirebaseStorageBucket>;
+/**
+ * Deploy a Storage rules source for a specific bucket. Firebase
+ * Storage uses **per-bucket** release names —
+ * `projects/{p}/releases/firebase.storage/{bucketId}` — for actual
+ * rule application. The project-wide `firebase.storage` release
+ * exists as a legacy alias but isn't bound to any bucket in modern
+ * projects; deploying to it leaves the bucket's deny-all rule
+ * unchanged.
+ *
+ * Defaults `bucketId` to `{projectId}.firebasestorage.app` (the
+ * Firebase default bucket name). Pass an override when targeting a
+ * non-default bucket.
+ */
+export declare function deployStorageRules(accessToken: string, projectId: string, source: string, bucketId?: string): Promise<{
+    rulesetName: string;
+}>;
+/**
+ * A single CORS rule entry, mirroring the GCS bucket CORS schema.
+ * See https://cloud.google.com/storage/docs/cross-origin#cors-elements.
+ */
+export interface CorsRule {
+    origin: string[];
+    method: string[];
+    responseHeader?: string[];
+    maxAgeSeconds?: number;
+}
+/**
+ * Default rule for a browser playground hosted on Firebase Hosting.
+ * Allows GET/POST/PUT/DELETE/HEAD/OPTIONS from the Hosting origin
+ * + common localhost dev ports, with response headers needed by the
+ * Firebase Storage Web SDK.
+ */
+export declare function defaultPlaygroundCors(hostingOrigin: string): CorsRule[];
+/** Read the current CORS configuration for a bucket. */
+export declare function getBucketCors(accessToken: string, bucketId: string): Promise<CorsRule[]>;
+/**
+ * Replace the bucket's CORS configuration. Pass an empty array to
+ * clear all rules. The GCS API replaces (not merges) the cors field
+ * on PATCH.
+ */
+export declare function setBucketCors(accessToken: string, bucketId: string, cors: CorsRule[]): Promise<void>;
+/**
+ * Step-boundary progress narration for {@link provisionStorage}. Lets a caller
+ * (the deploy CLI's status board) narrate the multi-second flow — most
+ * importantly the post-enable settle wait, which is otherwise a frozen terminal.
+ */
+export type ProvisionProgress = (event: {
+    step: string;
+    status: 'start' | 'done' | 'skip' | 'progress';
+    message: string;
+    pct?: number;
+}) => void;
+export interface ProvisionStorageOptions {
+    /**
+     * Default GCP resources location to use if the project hasn't been
+     * finalized yet. Ignored when the location is already set.
+     * Default: `'us-central'`.
+     */
+    locationId?: string;
+    /**
+     * Override the default Firebase Storage bucket ID. Defaults to
+     * `{projectId}.firebasestorage.app` — the bucket Firebase Console
+     * creates automatically.
+     */
+    bucketId?: string;
+    /**
+     * Storage rules source to deploy after the bucket is linked. When
+     * omitted, no rules are deployed (the project keeps whatever rules
+     * were last released — possibly the default deny-all).
+     */
+    rules?: string;
+    /**
+     * CORS rules to apply to the bucket after it's linked. Required
+     * for browser-side reads/writes from a non-Firebase origin —
+     * buckets created via the Cloud Console (vs Firebase Console)
+     * often ship with no CORS configuration, which manifests as
+     * `No 'Access-Control-Allow-Origin' header` on the first
+     * `XMLHttpRequest` from a hosted page.
+     *
+     * Pass `defaultPlaygroundCors(origin)` for a sensible starter
+     * config, or a custom array. Omit to leave the bucket's CORS
+     * alone.
+     */
+    cors?: CorsRule[];
+    /** Optional progress callback, invoked at each provisioning step boundary. */
+    onProgress?: ProvisionProgress;
+}
+export interface ProvisionStorageResult {
+    ok: true;
+    serviceEnabled: boolean;
+    locationFinalized: boolean;
+    locationId: string | null;
+    bucketCreated: boolean;
+    bucketId: string;
+    rulesDeployed: boolean;
+    rulesetName?: string;
+    corsApplied: boolean;
+}
+/**
+ * End-to-end Storage enablement + provisioning. Each step is
+ * idempotent (probe before mutating); the result reports what was
+ * actually done.
+ *
+ * Permission requirements (caller's token):
+ *   - `roles/serviceusage.serviceUsageAdmin` (or Owner) — to enable
+ *     the service when it's disabled
+ *   - `cloud-platform` OAuth scope (or `firebase` if service already
+ *     enabled)
+ *
+ * The handler throws `StorageProvisioningError` with the
+ * underlying `reason` (e.g. `AUTH_PERMISSION_DENIED`,
+ * `SERVICE_DISABLED`) so the caller can route to actionable UX.
+ */
+export declare function provisionStorage(accessToken: string, projectId: string, options?: ProvisionStorageOptions): Promise<ProvisionStorageResult>;
+//# sourceMappingURL=api.d.ts.map

package/dist/storage/admin/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/storage/admin/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAUH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aACZ,MAAM,EAAE,MAAM,GAAG,SAAS;gBAF1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1C,OAAO,EAAE,MAAM;CAKlB;AA2CD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAEpE;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC,CAU7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAef;AAID;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAef;AAID,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAmBlC;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,qBAAqB,CAAC,CAoBhC;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,MAA2C,GACpD,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAoElC;AAeD;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,EAAE,CAOvE;AAED,wDAAwD;AACxD,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,EAAE,CAAC,CAgBrB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,QAAQ,EAAE,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAID;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,KAAK,IAAI,CAAC;AAEX,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;IAClB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,IAAI,CAAC;IACT,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAsEjC"}

package/dist/storage/admin/api.js

@@ -0,0 +1,349 @@
+/**
+ * Pure-fetch client for the Firebase Storage provisioning APIs.
+ * Takes an OAuth access token directly — works equally from a Node
+ * agent runtime or a browser. Used by:
+ *
+ *   - `ProvisionStorageHandler` server-side via the agent SDK
+ *   - Consumers like the multi-tenant playground via direct import
+ *
+ * The caller is responsible for token scope. `firebase` scope is
+ * enough for the `:addFirebase` + `defaultLocation:finalize` calls,
+ * but **NOT** for enabling the underlying `firebasestorage.googleapis.com`
+ * service (which is the first-time gate). Service-enable requires
+ * `cloud-platform` scope OR a service account with
+ * `roles/serviceusage.serviceUsageAdmin`. Each function below
+ * documents which scope it needs.
+ *
+ * Endpoints under play:
+ *   - serviceusage.googleapis.com/v1/projects/{p}/services/{s}:enable
+ *   - firebase.googleapis.com/v1beta1/projects/{p}/defaultLocation:finalize
+ *   - firebasestorage.googleapis.com/v1beta/projects/{p}/buckets
+ *   - firebasestorage.googleapis.com/v1beta/projects/{p}/buckets/{b}:addFirebase
+ *   - firebaserules.googleapis.com/v1/projects/{p}/releases/firebase.storage
+ */
+const SERVICEUSAGE_API = 'https://serviceusage.googleapis.com/v1';
+const FIREBASE_API = 'https://firebase.googleapis.com/v1beta1';
+const STORAGE_API = 'https://firebasestorage.googleapis.com/v1beta';
+const RULES_API = 'https://firebaserules.googleapis.com/v1';
+const GCS_API = 'https://storage.googleapis.com/storage/v1';
+const STORAGE_SERVICE = 'firebasestorage.googleapis.com';
+export class StorageProvisioningError extends Error {
+    status;
+    body;
+    reason;
+    constructor(status, body, reason, message) {
+        super(message);
+        this.status = status;
+        this.body = body;
+        this.reason = reason;
+        this.name = 'StorageProvisioningError';
+    }
+}
+function parseError(body) {
+    try {
+        const parsed = JSON.parse(body);
+        const reason = parsed.error?.details?.find((d) => d.reason)?.reason;
+        return {
+            reason,
+            message: parsed.error?.message ?? body.slice(0, 400),
+        };
+    }
+    catch {
+        return { reason: undefined, message: body.slice(0, 400) };
+    }
+}
+async function bearer(accessToken, url, init) {
+    const r = await fetch(url, {
+        ...init,
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            ...(init?.body ? { 'Content-Type': 'application/json' } : {}),
+            ...(init?.headers ?? {}),
+        },
+    });
+    const body = r.ok ? '' : await r.text().catch(() => '');
+    return { status: r.status, ok: r.ok, body, response: r };
+}
+/**
+ * Probe whether the `firebasestorage.googleapis.com` service is
+ * enabled on the project. Cheap, uses Service Usage `GET`. Requires
+ * `serviceusage.services.get` permission (the default Firebase Admin
+ * SDK SA has this; user OAuth tokens with `firebase` scope do not).
+ *
+ * Returns `'unknown'` on permission failures so callers can downgrade
+ * to "try the operation; observe SERVICE_DISABLED" rather than block.
+ */
+export async function getStorageServiceState(accessToken, projectId) {
+    const r = await bearer(accessToken, `${SERVICEUSAGE_API}/projects/${encodeURIComponent(projectId)}/services/${STORAGE_SERVICE}`);
+    if (!r.ok)
+        return 'unknown';
+    const parsed = await r.response.json();
+    if (parsed.state === 'ENABLED')
+        return 'enabled';
+    if (parsed.state === 'DISABLED')
+        return 'disabled';
+    return 'unknown';
+}
+/**
+ * Enable `firebasestorage.googleapis.com` on the project. Requires
+ * `serviceusage.services.enable` IAM permission — included in
+ * `roles/owner`, `roles/editor` (deprecated), or
+ * `roles/serviceusage.serviceUsageAdmin`. The default Firebase Admin
+ * SDK service account does NOT have this; the caller's token must
+ * either be a user-OAuth with `cloud-platform` scope or a SA with
+ * the elevated role.
+ *
+ * Long-running operation under the hood; the response carries an
+ * operation name. We don't poll — the response 200 is enough signal
+ * for our purposes, and a brief settle delay handles propagation.
+ */
+export async function enableStorageService(accessToken, projectId) {
+    const r = await bearer(accessToken, `${SERVICEUSAGE_API}/projects/${encodeURIComponent(projectId)}/services/${STORAGE_SERVICE}:enable`, { method: 'POST', body: JSON.stringify({}) });
+    if (!r.ok) {
+        const { reason, message } = parseError(r.body);
+        throw new StorageProvisioningError(r.status, r.body, reason, `Failed to enable ${STORAGE_SERVICE}: ${r.status} ${message}`);
+    }
+}
+// ─── Default location ─────────────────────────────────────────────────
+/**
+ * Read the project's current default GCP resources location. Returns
+ * null when the project hasn't been finalized yet — e.g. brand-new
+ * Firebase projects with no resources. `firebase` scope is sufficient.
+ */
+export async function getDefaultLocation(accessToken, projectId) {
+    const r = await bearer(accessToken, `${FIREBASE_API}/projects/${encodeURIComponent(projectId)}`);
+    if (!r.ok) {
+        const { message } = parseError(r.body);
+        throw new StorageProvisioningError(r.status, r.body, undefined, `getProject: ${r.status} ${message}`);
+    }
+    const project = await r.response.json();
+    return project.resources?.locationId ?? null;
+}
+/**
+ * Set the project's default GCP resources location. IRREVERSIBLE —
+ * once set, the location cannot be changed. Skip-if-set is the
+ * caller's job; this function unconditionally calls `:finalize`.
+ *
+ * Per observed behavior, `:finalize` 404s on projects that already
+ * have resources provisioned (RTDB, Hosting) without a default
+ * location. The error path surfaces that to the caller.
+ */
+export async function finalizeDefaultLocation(accessToken, projectId, locationId) {
+    const r = await bearer(accessToken, `${FIREBASE_API}/projects/${encodeURIComponent(projectId)}/defaultLocation:finalize`, { method: 'POST', body: JSON.stringify({ locationId }) });
+    if (!r.ok) {
+        const { reason, message } = parseError(r.body);
+        throw new StorageProvisioningError(r.status, r.body, reason, `defaultLocation:finalize ${locationId}: ${r.status} ${message}`);
+    }
+}
+/**
+ * List Firebase-linked Storage buckets on the project. Returns an
+ * empty list when none exist yet. Throws when the underlying service
+ * is disabled — callers should check `getStorageServiceState` first
+ * if they want to distinguish.
+ */
+export async function listFirebaseBuckets(accessToken, projectId) {
+    const r = await bearer(accessToken, `${STORAGE_API}/projects/${encodeURIComponent(projectId)}/buckets`);
+    if (!r.ok) {
+        const { reason, message } = parseError(r.body);
+        throw new StorageProvisioningError(r.status, r.body, reason, `listBuckets: ${r.status} ${message}`);
+    }
+    const body = await r.response.json();
+    return (body.buckets ?? []).map((b) => ({
+        name: b.name,
+        bucketId: b.name.split('/').pop() ?? b.name,
+    }));
+}
+/**
+ * Link a Cloud Storage bucket to Firebase Storage. Idempotent — if
+ * the bucket is already Firebase-linked, the API returns 200 with
+ * the existing record. The bucket must already exist as a GCS
+ * resource; for the default Firebase bucket name
+ * (`{projectId}.firebasestorage.app`), Firebase auto-creates it on
+ * first `:addFirebase` call.
+ */
+export async function addFirebaseToBucket(accessToken, projectId, bucketId) {
+    const r = await bearer(accessToken, `${STORAGE_API}/projects/${encodeURIComponent(projectId)}/buckets/${encodeURIComponent(bucketId)}:addFirebase`, { method: 'POST', body: JSON.stringify({}) });
+    if (!r.ok) {
+        const { reason, message } = parseError(r.body);
+        throw new StorageProvisioningError(r.status, r.body, reason, `addFirebase ${bucketId}: ${r.status} ${message}`);
+    }
+    const body = await r.response.json();
+    return {
+        name: body.name ?? `projects/${projectId}/buckets/${bucketId}`,
+        bucketId,
+    };
+}
+// ─── Storage rules helpers ────────────────────────────────────────────
+/**
+ * Deploy a Storage rules source for a specific bucket. Firebase
+ * Storage uses **per-bucket** release names —
+ * `projects/{p}/releases/firebase.storage/{bucketId}` — for actual
+ * rule application. The project-wide `firebase.storage` release
+ * exists as a legacy alias but isn't bound to any bucket in modern
+ * projects; deploying to it leaves the bucket's deny-all rule
+ * unchanged.
+ *
+ * Defaults `bucketId` to `{projectId}.firebasestorage.app` (the
+ * Firebase default bucket name). Pass an override when targeting a
+ * non-default bucket.
+ */
+export async function deployStorageRules(accessToken, projectId, source, bucketId = `${projectId}.firebasestorage.app`) {
+    const headers = { 'Content-Type': 'application/json' };
+    const create = await bearer(accessToken, `${RULES_API}/projects/${encodeURIComponent(projectId)}/rulesets`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ source: { files: [{ name: 'storage.rules', content: source }] } }),
+    });
+    if (!create.ok) {
+        const { reason, message } = parseError(create.body);
+        throw new StorageProvisioningError(create.status, create.body, reason, `createRuleset: ${create.status} ${message}`);
+    }
+    const created = await create.response.json();
+    const releaseName = `projects/${projectId}/releases/firebase.storage/${bucketId}`;
+    // PATCH updates an existing release; if no release exists yet
+    // (project just had Storage enabled, no rules ever deployed),
+    // PATCH 404s. Fall back to POST `releases.create` to mint the
+    // release the first time.
+    const patch = await bearer(accessToken, `${RULES_API}/${releaseName}`, {
+        method: 'PATCH',
+        headers,
+        body: JSON.stringify({ release: { name: releaseName, rulesetName: created.name } }),
+    });
+    if (patch.ok)
+        return { rulesetName: created.name };
+    if (patch.status === 404) {
+        const createRelease = await bearer(accessToken, `${RULES_API}/projects/${encodeURIComponent(projectId)}/releases`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ name: releaseName, rulesetName: created.name }),
+        });
+        if (!createRelease.ok) {
+            const { reason, message } = parseError(createRelease.body);
+            throw new StorageProvisioningError(createRelease.status, createRelease.body, reason, `createRelease firebase.storage/${bucketId}: ${createRelease.status} ${message}`);
+        }
+        return { rulesetName: created.name };
+    }
+    const { reason, message } = parseError(patch.body);
+    throw new StorageProvisioningError(patch.status, patch.body, reason, `updateRelease firebase.storage/${bucketId}: ${patch.status} ${message}`);
+}
+/**
+ * Default rule for a browser playground hosted on Firebase Hosting.
+ * Allows GET/POST/PUT/DELETE/HEAD/OPTIONS from the Hosting origin
+ * + common localhost dev ports, with response headers needed by the
+ * Firebase Storage Web SDK.
+ */
+export function defaultPlaygroundCors(hostingOrigin) {
+    return [{
+            origin: [hostingOrigin, 'http://localhost:5173', 'http://localhost:3000', 'http://localhost:4173'],
+            method: ['GET', 'POST', 'PUT', 'DELETE', 'HEAD', 'OPTIONS'],
+            responseHeader: ['Content-Type', 'Authorization', 'x-goog-meta-*', 'x-firebase-storage-version', 'x-goog-upload-*'],
+            maxAgeSeconds: 3600,
+        }];
+}
+/** Read the current CORS configuration for a bucket. */
+export async function getBucketCors(accessToken, bucketId) {
+    const r = await bearer(accessToken, `${GCS_API}/b/${encodeURIComponent(bucketId)}?fields=cors`);
+    if (!r.ok) {
+        const { reason, message } = parseError(r.body);
+        throw new StorageProvisioningError(r.status, r.body, reason, `getBucketCors ${bucketId}: ${r.status} ${message}`);
+    }
+    const body = await r.response.json();
+    return body.cors ?? [];
+}
+/**
+ * Replace the bucket's CORS configuration. Pass an empty array to
+ * clear all rules. The GCS API replaces (not merges) the cors field
+ * on PATCH.
+ */
+export async function setBucketCors(accessToken, bucketId, cors) {
+    const r = await bearer(accessToken, `${GCS_API}/b/${encodeURIComponent(bucketId)}?fields=cors`, {
+        method: 'PATCH',
+        body: JSON.stringify({ cors }),
+    });
+    if (!r.ok) {
+        const { reason, message } = parseError(r.body);
+        throw new StorageProvisioningError(r.status, r.body, reason, `setBucketCors ${bucketId}: ${r.status} ${message}`);
+    }
+}
+/**
+ * End-to-end Storage enablement + provisioning. Each step is
+ * idempotent (probe before mutating); the result reports what was
+ * actually done.
+ *
+ * Permission requirements (caller's token):
+ *   - `roles/serviceusage.serviceUsageAdmin` (or Owner) — to enable
+ *     the service when it's disabled
+ *   - `cloud-platform` OAuth scope (or `firebase` if service already
+ *     enabled)
+ *
+ * The handler throws `StorageProvisioningError` with the
+ * underlying `reason` (e.g. `AUTH_PERMISSION_DENIED`,
+ * `SERVICE_DISABLED`) so the caller can route to actionable UX.
+ */
+export async function provisionStorage(accessToken, projectId, options = {}) {
+    const locationId = options.locationId ?? 'us-central';
+    const bucketId = options.bucketId ?? `${projectId}.firebasestorage.app`;
+    const report = options.onProgress;
+    // Step 1: enable the service if needed.
+    let serviceEnabled = false;
+    const state = await getStorageServiceState(accessToken, projectId);
+    if (state !== 'enabled') {
+        report?.({ step: 'enable-service', status: 'start', message: 'enabling Storage API' });
+        await enableStorageService(accessToken, projectId);
+        serviceEnabled = true;
+        // Brief settle — service-enable is async; immediate buckets
+        // calls otherwise still 403 with SERVICE_DISABLED for a few seconds.
+        // The progress frame here is what keeps the terminal alive through the wait.
+        report?.({ step: 'settle', status: 'start', message: 'waiting for service propagation' });
+        await new Promise((r) => setTimeout(r, 5000));
+    }
+    else {
+        report?.({ step: 'enable-service', status: 'skip', message: 'Storage API already enabled' });
+    }
+    // Step 2: finalize default location if missing.
+    const existingLocation = await getDefaultLocation(accessToken, projectId);
+    let locationFinalized = false;
+    let finalLocation = existingLocation;
+    if (!existingLocation) {
+        await finalizeDefaultLocation(accessToken, projectId, locationId);
+        locationFinalized = true;
+        finalLocation = locationId;
+    }
+    // Step 3: ensure the default Firebase bucket is linked.
+    const existing = await listFirebaseBuckets(accessToken, projectId);
+    const alreadyLinked = existing.some((b) => b.bucketId === bucketId);
+    let bucketCreated = false;
+    if (!alreadyLinked) {
+        report?.({ step: 'bucket', status: 'start', message: `creating bucket ${bucketId}` });
+        await addFirebaseToBucket(accessToken, projectId, bucketId);
+        bucketCreated = true;
+    }
+    // Step 4: optionally deploy rules.
+    let rulesDeployed = false;
+    let rulesetName;
+    if (options.rules) {
+        report?.({ step: 'rules', status: 'start', message: 'deploying Storage rules' });
+        const result = await deployStorageRules(accessToken, projectId, options.rules, bucketId);
+        rulesDeployed = true;
+        rulesetName = result.rulesetName;
+    }
+    // Step 5: optionally apply CORS. Idempotent — caller passes the
+    // desired final state and we PATCH the bucket to match.
+    let corsApplied = false;
+    if (options.cors) {
+        await setBucketCors(accessToken, bucketId, options.cors);
+        corsApplied = true;
+    }
+    return {
+        ok: true,
+        serviceEnabled,
+        locationFinalized,
+        locationId: finalLocation,
+        bucketCreated,
+        bucketId,
+        rulesDeployed,
+        rulesetName,
+        corsApplied,
+    };
+}
+//# sourceMappingURL=api.js.map