pyric 0.0.1 → 0.1.0-alpha.7

package/dist/storage/admin/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/storage/admin/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAClE,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,MAAM,WAAW,GAAG,+CAA+C,CAAC;AACpE,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAC5D,MAAM,OAAO,GAAG,2CAA2C,CAAC;AAE5D,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAEzD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAE/B;IACA;IACA;IAHlB,YACkB,MAAc,EACd,IAAY,EACZ,MAA0B,EAC1C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAoB;QAI1C,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAeD,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACpE,OAAO;YACL,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,GAAW,EAAE,IAAkB;IACxE,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QACzB,GAAG,IAAI;QACP,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;SACzB;KACF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAC3D,CAAC;AAMD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,SAAiB;IAEjB,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB,WAAW,EACX,GAAG,gBAAgB,aAAa,kBAAkB,CAAC,SAAS,CAAC,aAAa,eAAe,EAAE,CAC5F,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAwC,CAAC;IAC7E,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,SAAiB;IAEjB,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB,WAAW,EACX,GAAG,gBAAgB,aAAa,kBAAkB,CAAC,SAAS,CAAC,aAAa,eAAe,SAAS,EAClG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAC7C,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAChC,CAAC,CAAC,MAAM,EACR,CAAC,CAAC,IAAI,EACN,MAAM,EACN,oBAAoB,eAAe,KAAK,CAAC,CAAC,MAAM,IAAI,OAAO,EAAE,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,SAAiB;IAEjB,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB,WAAW,EACX,GAAG,YAAY,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAC5D,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,EAA6C,CAAC;IACnF,OAAO,OAAO,CAAC,SAAS,EAAE,UAAU,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,SAAiB,EACjB,UAAkB;IAElB,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB,WAAW,EACX,GAAG,YAAY,aAAa,kBAAkB,CAAC,SAAS,CAAC,2BAA2B,EACpF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CACzD,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAChC,CAAC,CAAC,MAAM,EACR,CAAC,CAAC,IAAI,EACN,MAAM,EACN,4BAA4B,UAAU,KAAK,CAAC,CAAC,MAAM,IAAI,OAAO,EAAE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,SAAiB;IAEjB,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB,WAAW,EACX,GAAG,WAAW,aAAa,kBAAkB,CAAC,SAAS,CAAC,UAAU,CACnE,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAChC,CAAC,CAAC,MAAM,EACR,CAAC,CAAC,IAAI,EACN,MAAM,EACN,gBAAgB,CAAC,CAAC,MAAM,IAAI,OAAO,EAAE,CACtC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,EAA2C,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI;KAC5C,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,SAAiB,EACjB,QAAgB;IAEhB,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB,WAAW,EACX,GAAG,WAAW,aAAa,kBAAkB,CAAC,SAAS,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,cAAc,EAC9G,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAC7C,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAChC,CAAC,CAAC,MAAM,EACR,CAAC,CAAC,IAAI,EACN,MAAM,EACN,eAAe,QAAQ,KAAK,CAAC,CAAC,MAAM,IAAI,OAAO,EAAE,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAuB,CAAC;IAC1D,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,YAAY,SAAS,YAAY,QAAQ,EAAE;QAC9D,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,yEAAyE;AAEzE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,SAAiB,EACjB,MAAc,EACd,WAAmB,GAAG,SAAS,sBAAsB;IAErD,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,WAAW,EACX,GAAG,SAAS,aAAa,kBAAkB,CAAC,SAAS,CAAC,WAAW,EACjE;QACE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;KAC1F,CACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,wBAAwB,CAChC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,EACX,MAAM,EACN,kBAAkB,MAAM,CAAC,MAAM,IAAI,OAAO,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAsB,CAAC;IAEjE,MAAM,WAAW,GAAG,YAAY,SAAS,8BAA8B,QAAQ,EAAE,CAAC;IAElF,8DAA8D;IAC9D,8DAA8D;IAC9D,8DAA8D;IAC9D,0BAA0B;IAC1B,MAAM,KAAK,GAAG,MAAM,MAAM,CACxB,WAAW,EACX,GAAG,SAAS,IAAI,WAAW,EAAE,EAC7B;QACE,MAAM,EAAE,OAAO;QACf,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;KACpF,CACF,CAAC;IACF,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAEnD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,MAAM,MAAM,CAChC,WAAW,EACX,GAAG,SAAS,aAAa,kBAAkB,CAAC,SAAS,CAAC,WAAW,EACjE;YACE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;SACvE,CACF,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC3D,MAAM,IAAI,wBAAwB,CAChC,aAAa,CAAC,MAAM,EACpB,aAAa,CAAC,IAAI,EAClB,MAAM,EACN,kCAAkC,QAAQ,KAAK,aAAa,CAAC,MAAM,IAAI,OAAO,EAAE,CACjF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,wBAAwB,CAChC,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,IAAI,EACV,MAAM,EACN,kCAAkC,QAAQ,KAAK,KAAK,CAAC,MAAM,IAAI,OAAO,EAAE,CACzE,CAAC;AACJ,CAAC;AA0BD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,OAAO,CAAC;YACN,MAAM,EAAE,CAAC,aAAa,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,uBAAuB,CAAC;YAClG,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;YAC3D,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,4BAA4B,EAAE,iBAAiB,CAAC;YACnH,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,QAAgB;IAEhB,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB,WAAW,EACX,GAAG,OAAO,MAAM,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAC3D,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAChC,CAAC,CAAC,MAAM,EACR,CAAC,CAAC,IAAI,EACN,MAAM,EACN,iBAAiB,QAAQ,KAAK,CAAC,CAAC,MAAM,IAAI,OAAO,EAAE,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,EAA2B,CAAC;IAC9D,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,QAAgB,EAChB,IAAgB;IAEhB,MAAM,CAAC,GAAG,MAAM,MAAM,CACpB,WAAW,EACX,GAAG,OAAO,MAAM,kBAAkB,CAAC,QAAQ,CAAC,cAAc,EAC1D;QACE,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;KAC/B,CACF,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAChC,CAAC,CAAC,MAAM,EACR,CAAC,CAAC,IAAI,EACN,MAAM,EACN,iBAAiB,QAAQ,KAAK,CAAC,CAAC,MAAM,IAAI,OAAO,EAAE,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAgED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,SAAiB,EACjB,UAAmC,EAAE;IAErC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,SAAS,sBAAsB,CAAC;IACxE,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAElC,wCAAwC;IACxC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvF,MAAM,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACnD,cAAc,GAAG,IAAI,CAAC;QACtB,4DAA4D;QAC5D,qEAAqE;QACrE,6EAA6E;QAC7E,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,gDAAgD;IAChD,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC1E,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,gBAAgB,CAAC;IACrC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,uBAAuB,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAClE,iBAAiB,GAAG,IAAI,CAAC;QACzB,aAAa,GAAG,UAAU,CAAC;IAC7B,CAAC;IAED,wDAAwD;IACxD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACpE,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtF,MAAM,mBAAmB,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5D,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,mCAAmC;IACnC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,WAA+B,CAAC;IACpC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzF,aAAa,GAAG,IAAI,CAAC;QACrB,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACnC,CAAC;IAED,gEAAgE;IAChE,wDAAwD;IACxD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,cAAc;QACd,iBAAiB;QACjB,UAAU,EAAE,aAAa;QACzB,aAAa;QACb,QAAQ;QACR,aAAa;QACb,WAAW;QACX,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/storage/admin/handler.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Handlers wrapping the pure-fetch `api.ts` provisioning functions
+ * with a structured outcome shape. They take a `ProjectScope`
+ * (`{ projectId, resolveToken }`) — the same credential value the
+ * `pyric-tools/deploy` factories accept — so the storage tools share the
+ * resolver contract with the rest of the control plane.
+ *
+ * Note on permissions: `resolveToken()` typically yields a Firebase
+ * Admin SDK service-account token, which is enough for the *probe*
+ * but **insufficient for service enable** (the default SA lacks
+ * `roles/serviceusage.serviceUsageAdmin`). Agents that need to flip
+ * the service on should either grant the SA that role once, or call
+ * `provisionStorage(token, projectId)` directly with a user OAuth
+ * token that carries `cloud-platform` scope.
+ *
+ * The handler maps the underlying `StorageProvisioningError`'s
+ * `reason` field to a typed error code so callers can route to
+ * actionable UX.
+ */
+import type { ProjectScope } from '../../project-scope.js';
+import { type ProvisionProgress } from './api.js';
+import type { InspectStorageResult, ProvisionStorageInput, ProvisionStorageOutcome } from './spec.js';
+export declare class InspectStorageHandler {
+    execute(scope: ProjectScope): Promise<InspectStorageResult>;
+}
+export declare class ProvisionStorageHandler {
+    execute(scope: ProjectScope, input: ProvisionStorageInput, onProgress?: ProvisionProgress): Promise<ProvisionStorageOutcome>;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/storage/admin/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/storage/admin/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAML,KAAK,iBAAiB,EACvB,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,WAAW,CAAC;AAEnB,qBAAa,qBAAqB;IAC1B,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAoBlE;AAED,qBAAa,uBAAuB;IAC5B,OAAO,CACX,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,qBAAqB,EAC5B,UAAU,CAAC,EAAE,iBAAiB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;CAmBpC"}

package/dist/storage/admin/handler.js

@@ -0,0 +1,82 @@
+import { getDefaultLocation, getStorageServiceState, listFirebaseBuckets, provisionStorage, StorageProvisioningError, } from './api.js';
+export class InspectStorageHandler {
+    async execute(scope) {
+        const token = await scope.resolveToken();
+        const [serviceState, defaultLocation] = await Promise.all([
+            getStorageServiceState(token, scope.projectId),
+            getDefaultLocation(token, scope.projectId),
+        ]);
+        let buckets = [];
+        if (serviceState === 'enabled') {
+            try {
+                const list = await listFirebaseBuckets(token, scope.projectId);
+                buckets = list.map((b) => ({ name: b.name, bucketId: b.bucketId }));
+            }
+            catch {
+                // If the service is enabled but listing fails (rare), report
+                // empty buckets rather than throwing — the caller already has
+                // useful signal from `serviceState` and `defaultLocation`.
+                buckets = [];
+            }
+        }
+        return { serviceState, defaultLocation, buckets };
+    }
+}
+export class ProvisionStorageHandler {
+    async execute(scope, input, onProgress) {
+        const token = await scope.resolveToken();
+        try {
+            const result = await provisionStorage(token, scope.projectId, { ...input, onProgress });
+            return { success: true, ...result };
+        }
+        catch (e) {
+            if (e instanceof StorageProvisioningError) {
+                return { success: false, error: mapError(e) };
+            }
+            return {
+                success: false,
+                error: {
+                    code: 'UNKNOWN',
+                    message: e instanceof Error ? e.message : String(e),
+                    recoverable: false,
+                },
+            };
+        }
+    }
+}
+function mapError(e) {
+    // Map the Google API reason codes to our typed error codes so the
+    // caller doesn't have to string-match.
+    const reason = e.reason ?? '';
+    const msg = e.message;
+    if (reason === 'AUTH_PERMISSION_DENIED' || /serviceusage\.services\.enable/.test(msg)) {
+        return {
+            code: 'PERMISSION_DENIED',
+            message: `${msg} — the caller's identity needs roles/serviceusage.serviceUsageAdmin (or roles/owner). The default Firebase Admin SDK service account does NOT have this.`,
+            recoverable: false,
+        };
+    }
+    if (reason === 'SERVICE_DISABLED' ||
+        /SERVICE_DISABLED/.test(msg) ||
+        // Google APIs return this prose form (with no `reason` on the thrown error)
+        // when the API is disabled on the project, e.g. `getProject: 403 Firebase
+        // Management API has not been used in project ... before or it is disabled`.
+        // Classify it recoverable so the deploy preflight's auto-enable handles it.
+        /has not been used in project .* before or it is disabled/.test(msg)) {
+        return { code: 'SERVICE_DISABLED', message: msg, recoverable: true };
+    }
+    if (/defaultLocation:finalize/.test(msg)) {
+        return { code: 'LOCATION_FINALIZE_FAILED', message: msg, recoverable: false };
+    }
+    if (/addFirebase/.test(msg)) {
+        return { code: 'BUCKET_CREATE_FAILED', message: msg, recoverable: false };
+    }
+    if (/createRuleset|updateRelease/.test(msg)) {
+        return { code: 'RULES_DEPLOY_FAILED', message: msg, recoverable: true };
+    }
+    if (/setBucketCors|getBucketCors/.test(msg)) {
+        return { code: 'CORS_UPDATE_FAILED', message: msg, recoverable: false };
+    }
+    return { code: 'UNKNOWN', message: msg, recoverable: false };
+}
+//# sourceMappingURL=handler.js.map

package/dist/storage/admin/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/storage/admin/handler.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,GAEzB,MAAM,UAAU,CAAC;AAQlB,MAAM,OAAO,qBAAqB;IAChC,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxD,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC;YAC9C,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC;SAC3C,CAAC,CAAC;QACH,IAAI,OAAO,GAAoC,EAAE,CAAC;QAClD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC/D,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;gBAC7D,8DAA8D;gBAC9D,2DAA2D;gBAC3D,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,uBAAuB;IAClC,KAAK,CAAC,OAAO,CACX,KAAmB,EACnB,KAA4B,EAC5B,UAA8B;QAE9B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,wBAAwB,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;oBACnD,WAAW,EAAE,KAAK;iBACnB;aACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,CAA2B;IAK3C,kEAAkE;IAClE,uCAAuC;IACvC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC;IAEtB,IAAI,MAAM,KAAK,wBAAwB,IAAI,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,GAAG,GAAG,0JAA0J;YACzK,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IACD,IACE,MAAM,KAAK,kBAAkB;QAC7B,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC5B,4EAA4E;QAC5E,0EAA0E;QAC1E,6EAA6E;QAC7E,4EAA4E;QAC5E,0DAA0D,CAAC,IAAI,CAAC,GAAG,CAAC,EACpE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC"}

package/dist/storage/admin/spec.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Shapes for the Storage provisioning + status tools.
+ *
+ * Types only — the agent-tool parameter schemas live inline in
+ * `tools.ts` as JSON Schema (the `ToolHandler` contract).
+ */
+export interface ProvisionStorageInput {
+    /**
+     * Default GCP resources location to use when the project has not
+     * been finalized yet. IRREVERSIBLE once set. Common values:
+     * `us-central`, `nam5`, `eur3`. Default: `us-central`.
+     */
+    locationId?: string;
+    /**
+     * Override the default Firebase Storage bucket ID. Defaults to
+     * `{projectId}.firebasestorage.app`.
+     */
+    bucketId?: string;
+    /**
+     * Storage rules source to deploy after the bucket is linked.
+     * Optional; when omitted, whatever rules are currently released
+     * (possibly the deny-all default) stay in place.
+     */
+    rules?: string;
+    /**
+     * CORS rules to apply to the bucket. Required for browser-side
+     * reads/writes from a non-Firebase origin. Omit to leave existing
+     * CORS untouched.
+     */
+    cors?: Array<{
+        origin: string[];
+        method: string[];
+        responseHeader?: string[];
+        maxAgeSeconds?: number;
+    }>;
+}
+export type ProvisionStorageErrorCode = 'PERMISSION_DENIED' | 'SERVICE_DISABLED' | 'LOCATION_FINALIZE_FAILED' | 'BUCKET_CREATE_FAILED' | 'RULES_DEPLOY_FAILED' | 'CORS_UPDATE_FAILED' | 'UNKNOWN';
+export type ProvisionStorageOutcome = {
+    success: true;
+    serviceEnabled: boolean;
+    locationFinalized: boolean;
+    locationId: string | null;
+    bucketCreated: boolean;
+    bucketId: string;
+    rulesDeployed: boolean;
+    rulesetName?: string;
+    corsApplied: boolean;
+} | {
+    success: false;
+    error: {
+        code: ProvisionStorageErrorCode;
+        message: string;
+        recoverable: boolean;
+    };
+};
+export interface InspectStorageResult {
+    serviceState: 'enabled' | 'disabled' | 'unknown';
+    defaultLocation: string | null;
+    buckets: Array<{
+        name: string;
+        bucketId: string;
+    }>;
+}
+//# sourceMappingURL=spec.d.ts.map

package/dist/storage/admin/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/storage/admin/spec.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,IAAI,CAAC,EAAE,KAAK,CAAC;QACX,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;CACJ;AAED,MAAM,MAAM,yBAAyB,GACjC,mBAAmB,GACnB,kBAAkB,GAClB,0BAA0B,GAC1B,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,SAAS,CAAC;AAEd,MAAM,MAAM,uBAAuB,GAC/B;IACE,OAAO,EAAE,IAAI,CAAC;IACd,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB,GACD;IACE,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE;QACL,IAAI,EAAE,yBAAyB,CAAC;QAChC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC;CACH,CAAC;AAEN,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IACjD,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD"}

package/dist/storage/admin/spec.js

@@ -0,0 +1,8 @@
+/**
+ * Shapes for the Storage provisioning + status tools.
+ *
+ * Types only — the agent-tool parameter schemas live inline in
+ * `tools.ts` as JSON Schema (the `ToolHandler` contract).
+ */
+export {};
+//# sourceMappingURL=spec.js.map

package/dist/storage/admin/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/storage/admin/spec.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/storage/admin/tools.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Agent-tool factory for the Firebase Storage control plane.
+ *
+ * `createStorageAdminTools({ scope })` returns the two
+ * provisioning/status tools as `ToolHandler[]`, consumable by
+ * `@inbrowser/agent`'s registry — including by `composeMcpRegistry`.
+ * Mirrors the `createFirestoreRulesTools` / `pyric-tools/deploy` factory
+ * shape: a `ProjectScope` in, JSON-Schema-typed `ToolHandler`s out.
+ */
+import type { ToolHandler } from '@inbrowser/agent';
+import type { ProjectScope } from '../../project-scope.js';
+export interface StorageAdminToolDeps {
+    /** Project identity + token resolver. Same shape `pyric-tools/deploy`'s
+     *  factories take. */
+    scope: ProjectScope;
+}
+/**
+ * Bundles:
+ *   - `storage_get_status`
+ *   - `storage_provision`
+ */
+export declare function createStorageAdminTools(deps: StorageAdminToolDeps): ToolHandler[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/storage/admin/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/storage/admin/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAK3D,MAAM,WAAW,oBAAoB;IACnC;0BACsB;IACtB,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,oBAAoB,GAAG,WAAW,EAAE,CAyFjF"}

package/dist/storage/admin/tools.js

@@ -0,0 +1,90 @@
+import { InspectStorageHandler, ProvisionStorageHandler } from './handler.js';
+/**
+ * Bundles:
+ *   - `storage_get_status`
+ *   - `storage_provision`
+ */
+export function createStorageAdminTools(deps) {
+    const { scope } = deps;
+    const inspectHandler = new InspectStorageHandler();
+    const provisionHandler = new ProvisionStorageHandler();
+    return [
+        {
+            name: 'storage_get_status',
+            description: 'Probe whether Firebase Storage is enabled on the project. Returns the underlying ' +
+                'service state (enabled/disabled/unknown), the default GCP resources location, and the ' +
+                'list of Firebase-linked Storage buckets. Use this before `storage_provision` ' +
+                'to see what work is actually needed.',
+            parameters: { type: 'object', properties: {} },
+            async execute() {
+                const result = await inspectHandler.execute(scope);
+                return {
+                    ok: true,
+                    summary: `Storage service is ${result.serviceState}; ${result.buckets.length} linked bucket(s)`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'storage_provision',
+            description: 'Enable Firebase Storage on the project end-to-end: enable the underlying ' +
+                '`firebasestorage.googleapis.com` service, set the default GCP resources location (one-time, ' +
+                'irreversible), and create + link the default Firebase Storage bucket. Optionally deploys ' +
+                'a Storage rules source as the final step. Idempotent — each sub-step probes state before ' +
+                'mutating. **Caller identity requirements**: enabling the service requires ' +
+                '`roles/serviceusage.serviceUsageAdmin` or `roles/owner`. The default Firebase Admin SDK ' +
+                'service account does NOT have this — returns `PERMISSION_DENIED` in that case. Grant the ' +
+                'role manually via IAM Console once if you want this tool to work server-side, or call ' +
+                'the underlying `provisionStorage(token, projectId)` function directly from a browser ' +
+                'context using a `cloud-platform`-scoped user OAuth token.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    locationId: {
+                        type: 'string',
+                        description: 'Default GCP resources location to use when the project has not been finalized yet. ' +
+                            'IRREVERSIBLE once set. Common values: "us-central", "nam5", "eur3". Default: "us-central".',
+                    },
+                    bucketId: {
+                        type: 'string',
+                        description: 'Override the default Firebase Storage bucket ID. Defaults to "{projectId}.firebasestorage.app".',
+                    },
+                    rules: {
+                        type: 'string',
+                        description: 'Storage rules source to deploy after the bucket is linked. Optional; when omitted, ' +
+                            'whatever rules are currently released (possibly the deny-all default) stay in place.',
+                    },
+                    cors: {
+                        type: 'array',
+                        description: 'CORS rules to apply to the bucket. Required for browser-side reads/writes from a ' +
+                            'non-Firebase origin. Omit to leave existing CORS untouched.',
+                        items: {
+                            type: 'object',
+                            properties: {
+                                origin: { type: 'array', items: { type: 'string' } },
+                                method: { type: 'array', items: { type: 'string' } },
+                                responseHeader: { type: 'array', items: { type: 'string' } },
+                                maxAgeSeconds: { type: 'number' },
+                            },
+                            required: ['origin', 'method'],
+                        },
+                    },
+                },
+            },
+            async execute(args, ctx) {
+                // The deploy CLI puts a `report` on the context (the status board); the
+                // agent runtime does not, so this is a no-op there.
+                const onProgress = ctx.report;
+                const result = await provisionHandler.execute(scope, (args ?? {}), onProgress);
+                return {
+                    ok: result.success,
+                    summary: result.success
+                        ? `Provisioned Storage bucket ${result.bucketId}`
+                        : `Storage provisioning failed (${result.error.code}): ${result.error.message}`,
+                    data: result,
+                };
+            },
+        },
+    ];
+}
+//# sourceMappingURL=tools.js.map

package/dist/storage/admin/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/storage/admin/tools.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAU9E;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA0B;IAChE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,MAAM,cAAc,GAAG,IAAI,qBAAqB,EAAE,CAAC;IACnD,MAAM,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAEvD,OAAO;QACL;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EACT,mFAAmF;gBACnF,wFAAwF;gBACxF,+EAA+E;gBAC/E,sCAAsC;YACxC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;YAC9C,KAAK,CAAC,OAAO;gBACX,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnD,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,sBAAsB,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,mBAAmB;oBAC/F,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,WAAW,EACT,2EAA2E;gBAC3E,8FAA8F;gBAC9F,2FAA2F;gBAC3F,2FAA2F;gBAC3F,4EAA4E;gBAC5E,0FAA0F;gBAC1F,2FAA2F;gBAC3F,wFAAwF;gBACxF,uFAAuF;gBACvF,2DAA2D;YAC7D,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,qFAAqF;4BACrF,4FAA4F;qBAC/F;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,iGAAiG;qBACpG;oBACD,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,qFAAqF;4BACrF,sFAAsF;qBACzF;oBACD,IAAI,EAAE;wBACJ,IAAI,EAAE,OAAO;wBACb,WAAW,EACT,mFAAmF;4BACnF,6DAA6D;wBAC/D,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gCACpD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gCACpD,cAAc,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gCAC5D,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;6BAClC;4BACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;yBAC/B;qBACF;iBACF;aACF;YACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;gBACrB,wEAAwE;gBACxE,oDAAoD;gBACpD,MAAM,UAAU,GAAI,GAAmD,CAAC,MAAM,CAAC;gBAC/E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAA0B,EAAE,UAAU,CAAC,CAAC;gBACxG,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACrB,CAAC,CAAC,8BAA8B,MAAM,CAAC,QAAQ,EAAE;wBACjD,CAAC,CAAC,gCAAgC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;oBACjF,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/storage/download.d.ts

@@ -0,0 +1,27 @@
+import { type StorageReference } from './reference.js';
+/**
+ * Read the blob at `ref` and return its contents as an
+ * `ArrayBuffer`. Honors the optional `maxDownloadSizeBytes` cap.
+ */
+export declare function getBytes(ref: StorageReference, maxDownloadSizeBytes?: number): Promise<ArrayBuffer>;
+/**
+ * Read the blob at `ref` and return it as a `Blob`. Same semantics
+ * as `getBytes` but skips the `arrayBuffer()` conversion when the
+ * caller wants a `Blob` directly (e.g. for streaming or
+ * `URL.createObjectURL`). Note: this is the browser-side
+ * counterpart of the JS SDK's `getBlob` — the v1 scope doesn't ship
+ * a Node-stream variant.
+ */
+export declare function getBlob(ref: StorageReference, maxDownloadSizeBytes?: number): Promise<Blob>;
+/**
+ * Delete the object at `ref` — removes both the blob and the
+ * metadata atomically. No-op when the path doesn't exist (the
+ * persistence layer's `delete` is no-op on missing keys).
+ *
+ * NOTE: the JS SDK's `deleteObject` throws
+ * `storage/object-not-found` when the path is missing. The v1 scope
+ * keeps the persistence-layer no-op behavior for now; Slice 8 will
+ * reconsider whether to mirror the strict throw.
+ */
+export declare function deleteObject(ref: StorageReference): Promise<void>;
+//# sourceMappingURL=download.d.ts.map

package/dist/storage/download.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../src/storage/download.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEhE;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,gBAAgB,EACrB,oBAAoB,CAAC,EAAE,MAAM,GAC5B,OAAO,CAAC,WAAW,CAAC,CAQtB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,gBAAgB,EACrB,oBAAoB,CAAC,EAAE,MAAM,GAC5B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCvE"}

package/dist/storage/download.js

@@ -0,0 +1,136 @@
+/**
+ * Download + delete operations: `getBytes`, `getBlob`,
+ * `deleteObject`.
+ *
+ * Rules are evaluated via `enforceRules`; denials surface as a
+ * `StorageError` with `.code === 'storage/unauthorized'`. The other
+ * failure modes — all `StorageError`-shaped now (ST-B1) — are:
+ *
+ *   - `storage/object-not-found` when no entry exists at the
+ *     reference's `fullPath`.
+ *   - `storage/invalid-root-operation` when `fullPath` is empty —
+ *     matches Firebase's pre-flight on root refs.
+ *   - `storage/quota-exceeded` when the persisted blob is larger
+ *     than the optional `maxDownloadSizeBytes` cap. (Prod uses
+ *     `storage/invalid-argument` for the client-side cap; the
+ *     sandbox keeps the descriptive `quota-exceeded` code — see
+ *     COMPAT row 55.)
+ */
+import * as fb from 'firebase/storage';
+import { emitSandboxEvent, makeServiceMutationEvent } from 'pyric/sandbox/internal';
+import { getStorageService, targetOf } from './service.js';
+import { enforceRules } from './enforce.js';
+import { resourceFromStored } from './rules.js';
+import { objectNotFound, quotaExceeded, invalidRootOperation } from './errors.js';
+import { fbRefOf } from './reference.js';
+/**
+ * Read the blob at `ref` and return its contents as an
+ * `ArrayBuffer`. Honors the optional `maxDownloadSizeBytes` cap.
+ */
+export async function getBytes(ref, maxDownloadSizeBytes) {
+    guardNonRoot(ref, 'getBytes');
+    const target = targetOf(ref.storage);
+    if (target.kind === 'prod') {
+        return fb.getBytes(fbRefOf(ref), maxDownloadSizeBytes);
+    }
+    const blob = await fetchBlob(ref, maxDownloadSizeBytes);
+    return blob.arrayBuffer();
+}
+/**
+ * Read the blob at `ref` and return it as a `Blob`. Same semantics
+ * as `getBytes` but skips the `arrayBuffer()` conversion when the
+ * caller wants a `Blob` directly (e.g. for streaming or
+ * `URL.createObjectURL`). Note: this is the browser-side
+ * counterpart of the JS SDK's `getBlob` — the v1 scope doesn't ship
+ * a Node-stream variant.
+ */
+export async function getBlob(ref, maxDownloadSizeBytes) {
+    guardNonRoot(ref, 'getBlob');
+    const target = targetOf(ref.storage);
+    if (target.kind === 'prod') {
+        return fb.getBlob(fbRefOf(ref), maxDownloadSizeBytes);
+    }
+    return fetchBlob(ref, maxDownloadSizeBytes);
+}
+/**
+ * Delete the object at `ref` — removes both the blob and the
+ * metadata atomically. No-op when the path doesn't exist (the
+ * persistence layer's `delete` is no-op on missing keys).
+ *
+ * NOTE: the JS SDK's `deleteObject` throws
+ * `storage/object-not-found` when the path is missing. The v1 scope
+ * keeps the persistence-layer no-op behavior for now; Slice 8 will
+ * reconsider whether to mirror the strict throw.
+ */
+export async function deleteObject(ref) {
+    guardNonRoot(ref, 'deleteObject');
+    const target = targetOf(ref.storage);
+    if (target.kind === 'prod') {
+        await fb.deleteObject(fbRefOf(ref));
+        return;
+    }
+    const service = await getStorageService(ref.storage);
+    const existing = await service.backend.getMetadata(ref.fullPath);
+    enforceRules(service, {
+        request: {
+            auth: target.context.auth,
+            method: 'write',
+            path: ref.fullPath,
+        },
+        resource: resourceFromStored(existing),
+    }, target);
+    await service.backend.delete(ref.fullPath);
+    try {
+        emitSandboxEvent(target.sandbox, makeServiceMutationEvent({
+            service: 'storage',
+            op: 'object_delete',
+            path: ref.fullPath,
+            auth: target.context.auth,
+            before: existing ?? undefined,
+            detail: { bucket: ref.bucket },
+        }), { service: 'storage' });
+    }
+    catch {
+        // Observational — never let event emission break a storage delete.
+    }
+}
+// ─── Helpers ───────────────────────────────────────────────────────
+async function fetchBlob(ref, maxDownloadSizeBytes) {
+    const target = targetOf(ref.storage);
+    // Prod is handled at the caller (early-return) — this helper is
+    // sandbox-only after the dual-target refactor.
+    if (target.kind !== 'sandbox') {
+        throw new Error('fetchBlob: sandbox-only helper called with prod target');
+    }
+    const service = await getStorageService(ref.storage);
+    // Rule check uses the existing object's metadata (when present)
+    // as `resource`. `unauthorized` supersedes `not-found`: the rule
+    // check runs FIRST, so an unauthorized read of a missing path
+    // reports `unauthorized`, not `not-found`. This matches prod — the
+    // server won't disclose object existence to a caller that lacks
+    // read permission.
+    const existing = await service.backend.getMetadata(ref.fullPath);
+    enforceRules(service, {
+        request: {
+            auth: target.context.auth,
+            method: 'read',
+            path: ref.fullPath,
+        },
+        resource: resourceFromStored(existing),
+    }, target);
+    const blob = await service.backend.getBlob(ref.fullPath);
+    if (!blob) {
+        throw objectNotFound(ref.fullPath);
+    }
+    if (typeof maxDownloadSizeBytes === 'number' &&
+        blob.size > maxDownloadSizeBytes) {
+        throw quotaExceeded(ref.fullPath, blob.size, maxDownloadSizeBytes);
+    }
+    return blob;
+}
+function guardNonRoot(ref, op) {
+    if (ref.fullPath === '') {
+        throw invalidRootOperation(op);
+    }
+}
+//# sourceMappingURL=download.js.map

package/dist/storage/download.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"download.js","sourceRoot":"","sources":["../../src/storage/download.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,OAAO,EAAyB,MAAM,gBAAgB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAqB,EACrB,oBAA6B;IAE7B,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAqB,EACrB,oBAA6B;IAE7B,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAqB;IACtD,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjE,YAAY,CAAC,OAAO,EAAE;QACpB,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,GAAG,CAAC,QAAQ;SACnB;QACD,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC;KACvC,EAAE,MAAM,CAAC,CAAC;IACX,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,gBAAgB,CACd,MAAM,CAAC,OAAO,EACd,wBAAwB,CAAC;YACvB,OAAO,EAAE,SAAS;YAClB,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,QAAQ,IAAI,SAAS;YAC7B,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;SAC/B,CAAC,EACF,EAAE,OAAO,EAAE,SAAS,EAAE,CACvB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;AACH,CAAC;AAED,sEAAsE;AAEtE,KAAK,UAAU,SAAS,CACtB,GAAqB,EACrB,oBAAwC;IAExC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,gEAAgE;IAChE,+CAA+C;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrD,gEAAgE;IAChE,iEAAiE;IACjE,8DAA8D;IAC9D,mEAAmE;IACnE,gEAAgE;IAChE,mBAAmB;IACnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjE,YAAY,CAAC,OAAO,EAAE;QACpB,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,CAAC,QAAQ;SACnB;QACD,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC;KACvC,EAAE,MAAM,CAAC,CAAC;IACX,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,IACE,OAAO,oBAAoB,KAAK,QAAQ;QACxC,IAAI,CAAC,IAAI,GAAG,oBAAoB,EAChC,CAAC;QACD,MAAM,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,GAAqB,EAAE,EAAU;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/storage/enforce.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Rule-enforcement helper shared by every gated operation. Pulled
+ * out so `upload.ts`, `download.ts`, and `metadata.ts` don't each
+ * grow their own copy of the same dispatch.
+ *
+ * Behavior:
+ *   - No rules configured → allow. The v1 scope's session-archive
+ *     ruleset is opt-in; bare `getStorage` with no `rules` option
+ *     keeps the open-by-default semantics consistent with the
+ *     pre-Slice-8 surface.
+ *   - Rules configured → call `evaluateStorageRules`. Throw
+ *     `storage/unauthorized` with the evaluator's `reasons` joined
+ *     into the message on denial.
+ *
+ * `listAll` DOES call this (ST-B2): Firebase Storage's `read`
+ * permission governs both download and list, so `list.ts` enforces a
+ * `read` check on the scanned prefix path. A previous v1 scope build
+ * silently bypassed list — that contradicted the rules-enforcement
+ * contract (a denied tree was still enumerable). With no rules
+ * configured the check is a no-op (open-by-default), so the
+ * session-archive demo is unaffected.
+ */
+import type { StorageService, Target } from './service.js';
+import { type EvaluationInput } from './rules.js';
+export declare function enforceRules(service: StorageService, input: EvaluationInput, target?: Target): void;
+//# sourceMappingURL=enforce.d.ts.map

package/dist/storage/enforce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforce.d.ts","sourceRoot":"","sources":["../../src/storage/enforce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAGxE,wBAAgB,YAAY,CAC1B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,eAAe,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CASN"}

package/dist/storage/enforce.js

@@ -0,0 +1,16 @@
+import { evaluateStorageRules } from './rules.js';
+import { unauthorized } from './errors.js';
+export function enforceRules(service, input, target) {
+    // Admin plane (internal `getAdminStorageSandbox` handles): rules are
+    // bypassed entirely — firebase-admin semantics. See `SandboxTarget.admin`.
+    if (target?.kind === 'sandbox' && target.admin === true)
+        return;
+    if (!service.rules)
+        return;
+    const result = evaluateStorageRules(service.rules, input);
+    if (result.allowed)
+        return;
+    const detail = result.reasons.length > 0 ? ` — ${result.reasons.join('; ')}` : '';
+    throw unauthorized(input.request.method, input.request.path, detail);
+}
+//# sourceMappingURL=enforce.js.map

package/dist/storage/enforce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforce.js","sourceRoot":"","sources":["../../src/storage/enforce.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,oBAAoB,EAAwB,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,UAAU,YAAY,CAC1B,OAAuB,EACvB,KAAsB,EACtB,MAAe;IAEf,qEAAqE;IACrE,2EAA2E;IAC3E,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO;IAChE,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO;IAC3B,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC"}

package/dist/storage/errors.d.ts

@@ -0,0 +1,46 @@
+/**
+ * `StorageError` — the sandbox's analog of `firebase/storage`'s
+ * `StorageError`. Every sandbox operation that fails throws one of
+ * these so `err.code === 'storage/...'` branching works identically
+ * against the sandbox and a real bucket (ST-B1).
+ *
+ * Shape parity with upstream (`clones/firebase-js-sdk/packages/
+ * storage/src/implementation/error.ts`):
+ *   - `.code` is the prefixed form `storage/<code>` (e.g.
+ *     `storage/object-not-found`).
+ *   - the message embeds the prefixed code so the substring-matching
+ *     probes (`toThrow(/object-not-found/)`) and `err.code` reads
+ *     agree.
+ *
+ * Intentional divergence (documented in COMPAT row 105): upstream's
+ * `StorageError extends FirebaseError` and reports `name:
+ * 'FirebaseError'` with a `"Firebase Storage: … (storage/…)"`
+ * message. The sandbox keeps a plain `Error` subclass — same as
+ * `SandboxError` for Firestore — so the `.code` contract is faithful
+ * while the message wording stays sandbox-flavored. The
+ * `storage/<code>` prefix is what consumer code branches on.
+ */
+/**
+ * The unprefixed storage error codes the sandbox can raise. Mirrors
+ * the subset of `StorageErrorCode` the implemented operations use;
+ * the deny-listed surface (download URLs, resumable, checksums) is
+ * out of scope per the v1 scope.
+ */
+export type StorageErrorCode = 'unknown' | 'object-not-found' | 'quota-exceeded' | 'unauthenticated' | 'unauthorized' | 'invalid-root-operation' | 'invalid-format' | 'invalid-argument';
+/** Prefix an unprefixed code with `storage/` — matches upstream. */
+export declare function prependCode(code: StorageErrorCode): `storage/${StorageErrorCode}`;
+/**
+ * Storage error carrying a prefixed `storage/<code>` on `.code`.
+ * Drop-in for `err.code === 'storage/object-not-found'` branching.
+ */
+export declare class StorageError extends Error {
+    /** Prefixed code, e.g. `storage/object-not-found`. */
+    readonly code: `storage/${StorageErrorCode}`;
+    constructor(code: StorageErrorCode, message: string);
+}
+export declare function objectNotFound(path: string): StorageError;
+export declare function unauthorized(method: string, path: string, detail: string): StorageError;
+export declare function quotaExceeded(path: string, size: number, max: number): StorageError;
+export declare function invalidRootOperation(op: string): StorageError;
+export declare function invalidFormat(format: string, message: string): StorageError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/storage/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/storage/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,wBAAwB,GACxB,gBAAgB,GAChB,kBAAkB,CAAC;AAEvB,oEAAoE;AACpE,wBAAgB,WAAW,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,gBAAgB,EAAE,CAEjF;AAED;;;GAGG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,WAAW,gBAAgB,EAAE,CAAC;gBAEjC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM;CAWpD;AAID,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAEzD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAKvF;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAKnF;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,CAK7D;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAE3E"}