pyric 0.1.0-alpha.21 → 0.1.0-alpha.24

package/dist/auth/modular.d.ts

@@ -4,6 +4,7 @@ export { TARGET_SYMBOL } from './types.js';
 export type { AuthProvider } from './providers.js';
 export type { AuthUserRecord, CreateUserRequest, MintSessionRequest, MintedSession, ProviderUserInfo, SeedUser, SignInIdentitySpec, UpdateUserRequest, } from './sandbox-backend.js';
 export type { AuthMailResolver, OutboundAuthMail } from './sandbox-auth-flow.js';
+export type { AvatarMint, AvatarMintInput } from './sandbox/default-avatar.js';
 export { EmailAuthProvider, FacebookAuthProvider, GithubAuthProvider, GoogleAuthProvider, OAuthProvider, SAMLAuthProvider, TwitterAuthProvider, FEDERATED_PROVIDER_IDS, type FederatedProviderId, } from './providers.js';
 export { AuthCredential, EmailAuthCredential, OAuthCredential, getAdditionalUserInfo, type AdditionalUserInfo, } from './credentials.js';
 export { ActionCodeOperation, AuthErrorCodes, OperationType, ProviderId, SignInMethod, } from './enums.js';
@@ -19,4 +20,12 @@ export { connectAuthEmulator, getAuth, initializeAuth } from './instances.js';
 export { createUserWithEmailAndPassword, getRedirectResult, setPersistence, signInAnonymously, signInWithCredential, signInWithEmailAndPassword, signInWithPopup, signInWithRedirect, signOut, } from './sign-in.js';
 export { beforeAuthStateChanged, deleteUser, getIdToken, getIdTokenResult, onAuthStateChanged, onIdTokenChanged, reload, updateCurrentUser, updateEmail, updatePassword, updateProfile, useDeviceLanguage, } from './user-lifecycle.js';
 export { sandbox } from './sandbox/driver.js';
+import type { AuthLens } from '../sandbox/types/operation.js';
+export type { AuthLens };
+/** Switch the active AuthLens for subsequent data operations. */
+export declare function switchAuthLens(lens: AuthLens | undefined): void;
+/** Return the currently active AuthLens, or undefined if using the default app session. */
+export declare function getAuthLens(): AuthLens | undefined;
+/** Subscribe to AuthLens changes. Returns an unsubscribe function. */
+export declare function onAuthLensChanged(cb: (lens: AuthLens | undefined) => void): () => void;
 //# sourceMappingURL=modular.d.ts.map

package/dist/auth/modular.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modular.d.ts","sourceRoot":"","sources":["../../src/auth/modular.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,YAAY,EACV,IAAI,EACJ,OAAO,EACP,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,IAAI,EACJ,cAAc,EACd,QAAQ,GACT,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAEjF,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,aAAa,EACb,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,EACZ,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE5G,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,EAClB,OAAO,GACR,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,aAAa,EACb,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"modular.d.ts","sourceRoot":"","sources":["../../src/auth/modular.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,YAAY,EACV,IAAI,EACJ,OAAO,EACP,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,IAAI,EACJ,cAAc,EACd,QAAQ,GACT,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACjF,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,aAAa,EACb,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,EACZ,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE5G,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,EAClB,OAAO,GACR,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,aAAa,EACb,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAE,QAAQ,EAAE,CAAC;AAKzB,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAK/D;AAED,2FAA2F;AAC3F,wBAAgB,WAAW,IAAI,QAAQ,GAAG,SAAS,CAElD;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,KAAK,IAAI,GAAG,MAAM,IAAI,CAKtF"}

package/dist/auth/modular.js

@@ -15,4 +15,24 @@ export { connectAuthEmulator, getAuth, initializeAuth } from './instances.js';
 export { createUserWithEmailAndPassword, getRedirectResult, setPersistence, signInAnonymously, signInWithCredential, signInWithEmailAndPassword, signInWithPopup, signInWithRedirect, signOut, } from './sign-in.js';
 export { beforeAuthStateChanged, deleteUser, getIdToken, getIdTokenResult, onAuthStateChanged, onIdTokenChanged, reload, updateCurrentUser, updateEmail, updatePassword, updateProfile, useDeviceLanguage, } from './user-lifecycle.js';
 export { sandbox } from './sandbox/driver.js';
+let _activeAuthLens;
+const _authLensListeners = new Set();
+/** Switch the active AuthLens for subsequent data operations. */
+export function switchAuthLens(lens) {
+    _activeAuthLens = lens && lens.mode === 'app-session' ? undefined : lens;
+    for (const cb of [..._authLensListeners]) {
+        cb(_activeAuthLens);
+    }
+}
+/** Return the currently active AuthLens, or undefined if using the default app session. */
+export function getAuthLens() {
+    return _activeAuthLens;
+}
+/** Subscribe to AuthLens changes. Returns an unsubscribe function. */
+export function onAuthLensChanged(cb) {
+    _authLensListeners.add(cb);
+    return () => {
+        _authLensListeners.delete(cb);
+    };
+}
 //# sourceMappingURL=modular.js.map

package/dist/auth/modular.js.map

@@ -1 +1 @@
-{"version":3,"file":"modular.js","sourceRoot":"","sources":["../../src/auth/modular.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAejF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAc3C,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,GAEvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,aAAa,EACb,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,GAEb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAsD,MAAM,sBAAsB,CAAC;AAE5G,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,EAClB,OAAO,GACR,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,aAAa,EACb,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"modular.js","sourceRoot":"","sources":["../../src/auth/modular.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAejF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAe3C,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,GAEvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,aAAa,EACb,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,GAEb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAsD,MAAM,sBAAsB,CAAC;AAE5G,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,EAClB,OAAO,GACR,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,aAAa,EACb,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAI9C,IAAI,eAAqC,CAAC;AAC1C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAwC,CAAC;AAE3E,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,IAA0B;IACvD,eAAe,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,kBAAkB,CAAC,EAAE,CAAC;QACzC,EAAE,CAAC,eAAe,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,WAAW;IACzB,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,EAAwC;IACxE,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,OAAO,GAAG,EAAE;QACV,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/reauth.js

@@ -132,8 +132,9 @@ function completeReauth(user, target, providerId) {
     // Force a refresh: a successful re-auth produces a NEW token with a new
     // authTime. That advance is the observable trace of the re-verification
     // (and what prod's recent-login gate reads).
-    target.backend.getIdTokenResultFor(user.uid, claims, true);
-    const refreshed = stored ? target.backend.buildUserFromStored(stored) : user;
+    target.backend.getIdTokenResultFor(user.uid, claims, true, user.tenantId);
+    const hasStoredUser = stored !== undefined;
+    const refreshed = hasStoredUser ? target.backend.buildUserFromStored(stored) : user;
     return {
         user: refreshed,
         providerId,

package/dist/auth/reauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"reauth.js","sourceRoot":"","sources":["../../src/auth/reauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAkB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAIvE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAU,EACV,UAA0B;IAE1B,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,CAAC;IACjB,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAE5D,IAAI,UAAU,YAAY,mBAAmB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5D,gEAAgE;QAChE,qEAAqE;QACrE,mEAAmE;QACnE,mCAAmC;QACnC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACvC,MAAM,aAAa,CACjB,oBAAoB,EACpB,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACrC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,aAAa,CACjB,qBAAqB,EACrB,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,gBAAgB;IAChB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,MAAM,aAAa,CACjB,oBAAoB,EACpB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAU,EACV,QAAsB,EACtB,QAA2B;IAE3B,YAAY,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAC9C,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAU,EACV,QAAsB,EACtB,QAA2B;IAE3B,YAAY,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACjD,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,4BAA4B,CAAC,CAAC;AAC3F,CAAC;AAED,yEAAyE;AAEzE,KAAK,UAAU,aAAa,CAC1B,IAAU,EACV,QAAsB,EACtB,OAAqC,EACrC,IAA0B,EAC1B,GAAW;IAEX,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAoB,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAG,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,QAAQ;QACvB,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvF,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,aAAa,CACjB,qBAAqB,EACrB,GAAG,GAAG,cAAc,QAAQ,CAAC,UAAU,oNAAoN,QAAQ,CAAC,UAAU,SAAS,CACxR,CAAC;IACJ,CAAC;IACD,4DAA4D;IAC5D,qEAAqE;IACrE,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,aAAa,CACjB,oBAAoB,EACpB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;AAClF,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CACrB,IAAU,EACV,MAA6C,EAC7C,UAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;IAC1C,wEAAwE;IACxE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,OAAO;QACL,IAAI,EAAE,SAAS;QACf,UAAU;QACV,aAAa,EAAE,gBAAgB;QAC/B,mBAAmB,EAAE;YACnB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE;YACX,UAAU;SACX;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"reauth.js","sourceRoot":"","sources":["../../src/auth/reauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAkB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAIvE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAU,EACV,UAA0B;IAE1B,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,CAAC;IACjB,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAE5D,IAAI,UAAU,YAAY,mBAAmB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5D,gEAAgE;QAChE,qEAAqE;QACrE,mEAAmE;QACnE,mCAAmC;QACnC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACvC,MAAM,aAAa,CACjB,oBAAoB,EACpB,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACrC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,aAAa,CACjB,qBAAqB,EACrB,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,gBAAgB;IAChB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,MAAM,aAAa,CACjB,oBAAoB,EACpB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAU,EACV,QAAsB,EACtB,QAA2B;IAE3B,YAAY,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAC9C,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAU,EACV,QAAsB,EACtB,QAA2B;IAE3B,YAAY,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACjD,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,4BAA4B,CAAC,CAAC;AAC3F,CAAC;AAED,yEAAyE;AAEzE,KAAK,UAAU,aAAa,CAC1B,IAAU,EACV,QAAsB,EACtB,OAAqC,EACrC,IAA0B,EAC1B,GAAW;IAEX,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAoB,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAG,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,QAAQ;QACvB,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvF,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,aAAa,CACjB,qBAAqB,EACrB,GAAG,GAAG,cAAc,QAAQ,CAAC,UAAU,oNAAoN,QAAQ,CAAC,UAAU,SAAS,CACxR,CAAC;IACJ,CAAC;IACD,4DAA4D;IAC5D,qEAAqE;IACrE,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,aAAa,CACjB,oBAAoB,EACpB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;AAClF,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CACrB,IAAU,EACV,MAA6C,EAC7C,UAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;IAC1C,wEAAwE;IACxE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,MAAM,KAAK,SAAS,CAAC;IAC3C,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,OAAO;QACL,IAAI,EAAE,SAAS;QACf,UAAU;QACV,aAAa,EAAE,gBAAgB;QAC/B,mBAAmB,EAAE;YACnB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE;YACX,UAAU;SACX;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/sandbox/default-avatar.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Deterministic default-avatar generation: seed hashing + inline SVG data URI,
+ * plus the mint hook the sandbox backend calls when it creates a
+ * provider-identity record with no photo of its own.
+ */
+/**
+ * Deterministic 64-bit seed for a uid, returned as 16 lowercase hex chars.
+ * FNV-1a 32-bit is run twice with different offset baskets (forward and
+ * reversed uid bytes) to spread the uid's entropy across both halves.
+ */
+export declare function avatarSeed(uid: string): string;
+interface DefaultAvatarInput {
+    uid: string;
+    displayName?: string | null;
+    email?: string | null;
+    /** Render the generating state: the same deterministic artwork plus a
+     *  spinning ring, with the initial dimmed. A configured source producing
+     *  this user's real image is still running, so the plain avatar would
+     *  otherwise be indistinguishable from a finished one and read as a
+     *  silent failure. Declarative SVG animation, so it runs inside an
+     *  `<img>` element with no script and nothing for an application to
+     *  style. */
+    pending?: boolean;
+}
+/**
+ * Deterministic default avatar for a user: a two-hue linear gradient plus a
+ * centred initial glyph, as raw SVG markup. `defaultAvatarDataUri` encodes
+ * this for the in-page fallback; the served dev server encodes it as UTF-8
+ * bytes and serves it directly as `image/svg+xml` (the asset resolver's
+ * built-in fallback — see `pyric/auth/internal` and
+ * `@pyric/cli`'s `serve/sandbox-session.ts`).
+ */
+export declare function defaultAvatarSvg(input: DefaultAvatarInput): string;
+/**
+ * Deterministic default avatar for a user, encoded as a `data:image/svg+xml,`
+ * URI — the in-page fallback used when no dev server is present.
+ */
+export declare function defaultAvatarDataUri(input: DefaultAvatarInput): string;
+/** Everything a mint knows about the record being created. The provider id is
+ *  the one the record is created under, so a mint can vary the image by
+ *  provider or refuse a provider outright. */
+export interface AvatarMintInput {
+    uid: string;
+    displayName: string | null;
+    email: string | null;
+    providerId: string;
+}
+/**
+ * Assigns the `photoURL` a provider-created sandbox user is born with, or
+ * `null` for none. The backend calls it once, at record creation, and stores
+ * whatever it returns — the value is persisted, exported, and captured, so a
+ * mint must be deterministic in its input.
+ *
+ * Three mints exist. {@link defaultAvatarMint} is the built-in and needs no
+ * server. A served host replaces it with one that returns its
+ * `/__pyric/assets/avatar/<uid>` route, and a host with avatars disabled
+ * replaces it with one that returns `null` (Firebase's own behaviour when a
+ * provider supplies no photo).
+ */
+export type AvatarMint = (input: AvatarMintInput) => string | null;
+/** The no-server mint: a deterministic SVG data URI, resolvable anywhere. */
+export declare const defaultAvatarMint: AvatarMint;
+export {};
+//# sourceMappingURL=default-avatar.d.ts.map

package/dist/auth/sandbox/default-avatar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-avatar.d.ts","sourceRoot":"","sources":["../../../src/auth/sandbox/default-avatar.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAmBH;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM9C;AAED,UAAU,kBAAkB;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;iBAMa;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAkDD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAmClE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAEtE;AAED;;8CAE8C;AAC9C,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,MAAM,GAAG,IAAI,CAAC;AAEnE,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,EAAE,UAAmD,CAAC"}

package/dist/auth/sandbox/default-avatar.js

@@ -0,0 +1,118 @@
+/**
+ * Deterministic default-avatar generation: seed hashing + inline SVG data URI,
+ * plus the mint hook the sandbox backend calls when it creates a
+ * provider-identity record with no photo of its own.
+ */
+const FNV_OFFSET_BASIS_A = 0x811c9dc5;
+const FNV_OFFSET_BASIS_B = 0x9e3779b9;
+const FNV_PRIME = 0x01000193;
+function fnv1a32(bytes, offsetBasis) {
+    let hash = offsetBasis;
+    for (let i = 0; i < bytes.length; i++) {
+        hash ^= bytes[i];
+        hash = Math.imul(hash, FNV_PRIME);
+    }
+    return hash >>> 0;
+}
+function toHex8(value) {
+    return value.toString(16).padStart(8, '0');
+}
+/**
+ * Deterministic 64-bit seed for a uid, returned as 16 lowercase hex chars.
+ * FNV-1a 32-bit is run twice with different offset baskets (forward and
+ * reversed uid bytes) to spread the uid's entropy across both halves.
+ */
+export function avatarSeed(uid) {
+    const forwardBytes = new TextEncoder().encode(uid);
+    const reversedBytes = new TextEncoder().encode([...uid].reverse().join(''));
+    const highHalf = fnv1a32(forwardBytes, FNV_OFFSET_BASIS_A);
+    const lowHalf = fnv1a32(reversedBytes, FNV_OFFSET_BASIS_B);
+    return toHex8(highHalf) + toHex8(lowHalf);
+}
+function gradientHuesFromSeed(seed) {
+    const highHalf = Number.parseInt(seed.slice(0, 8), 16);
+    const lowHalf = Number.parseInt(seed.slice(8, 16), 16);
+    const hueStart = highHalf % 360;
+    const hueSpread = 40 + (lowHalf % 80);
+    const hueEnd = (hueStart + hueSpread) % 360;
+    const saturation = 60 + (highHalf % 16); // 60-75
+    const lightness = 45 + (lowHalf % 16); // 45-60
+    return { hueStart, hueEnd, saturation, lightness };
+}
+/** First Unicode code point of a string, safe for surrogate pairs (emoji, CJK). */
+function firstCodePoint(value) {
+    const segmenter = new Intl.Segmenter(undefined, { granularity: 'grapheme' });
+    const first = segmenter.segment(value)[Symbol.iterator]().next();
+    if (first.done)
+        return undefined;
+    return first.value.segment;
+}
+function glyphFromInput(input) {
+    const displayNameFirst = input.displayName?.trim();
+    if (displayNameFirst) {
+        const glyph = firstCodePoint(displayNameFirst);
+        if (glyph)
+            return glyph.toUpperCase();
+    }
+    const emailLocalPart = input.email?.split('@')[0]?.trim();
+    if (emailLocalPart) {
+        const glyph = firstCodePoint(emailLocalPart);
+        if (glyph)
+            return glyph.toUpperCase();
+    }
+    return undefined;
+}
+/** Encode SVG markup for embedding as a `data:image/svg+xml,` URI. */
+function encodeSvgForDataUri(svg) {
+    return encodeURIComponent(svg)
+        .replace(/'/g, '%27')
+        .replace(/\(/g, '%28')
+        .replace(/\)/g, '%29');
+}
+/**
+ * Deterministic default avatar for a user: a two-hue linear gradient plus a
+ * centred initial glyph, as raw SVG markup. `defaultAvatarDataUri` encodes
+ * this for the in-page fallback; the served dev server encodes it as UTF-8
+ * bytes and serves it directly as `image/svg+xml` (the asset resolver's
+ * built-in fallback — see `pyric/auth/internal` and
+ * `@pyric/cli`'s `serve/sandbox-session.ts`).
+ */
+export function defaultAvatarSvg(input) {
+    const seed = avatarSeed(input.uid);
+    const { hueStart, hueEnd, saturation, lightness } = gradientHuesFromSeed(seed);
+    const gradientId = `g${seed}`;
+    const glyph = glyphFromInput(input);
+    const pending = input.pending === true;
+    const glyphMarkup = glyph === undefined
+        ? ''
+        : `<text x="64" y="64" font-family="system-ui, -apple-system, sans-serif" ` +
+            `font-size="56" fill="#fff" fill-opacity="${pending ? '0.55' : '0.9'}" text-anchor="middle" ` +
+            `dominant-baseline="central">${glyph}</text>`;
+    // r=56 with a 6-wide stroke stays inside the 64 radius a circular crop
+    // cuts at, so the ring survives `border-radius: 50%`. The dash pattern
+    // sums to the circumference (2*pi*56), leaving one visible arc.
+    const pendingMarkup = pending
+        ? `<circle cx="64" cy="64" r="56" fill="none" stroke="#fff" stroke-opacity="0.25" stroke-width="6"/>` +
+            `<circle cx="64" cy="64" r="56" fill="none" stroke="#fff" stroke-opacity="0.95" stroke-width="6" ` +
+            `stroke-linecap="round" stroke-dasharray="44 308">` +
+            `<animateTransform attributeName="transform" type="rotate" from="0 64 64" to="360 64 64" ` +
+            `dur="1s" repeatCount="indefinite"/></circle>`
+        : '';
+    return (`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128">` +
+        `<defs><linearGradient id="${gradientId}" x1="0" y1="0" x2="1" y2="1">` +
+        `<stop offset="0%" stop-color="hsl(${hueStart},${saturation}%,${lightness}%)"/>` +
+        `<stop offset="100%" stop-color="hsl(${hueEnd},${saturation}%,${lightness}%)"/>` +
+        `</linearGradient></defs>` +
+        `<rect width="128" height="128" fill="url(#${gradientId})"/>` +
+        `${glyphMarkup}${pendingMarkup}</svg>`);
+}
+/**
+ * Deterministic default avatar for a user, encoded as a `data:image/svg+xml,`
+ * URI — the in-page fallback used when no dev server is present.
+ */
+export function defaultAvatarDataUri(input) {
+    return `data:image/svg+xml,${encodeSvgForDataUri(defaultAvatarSvg(input))}`;
+}
+/** The no-server mint: a deterministic SVG data URI, resolvable anywhere. */
+export const defaultAvatarMint = (input) => defaultAvatarDataUri(input);
+//# sourceMappingURL=default-avatar.js.map

package/dist/auth/sandbox/default-avatar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-avatar.js","sourceRoot":"","sources":["../../../src/auth/sandbox/default-avatar.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,kBAAkB,GAAG,UAAU,CAAC;AACtC,MAAM,kBAAkB,GAAG,UAAU,CAAC;AACtC,MAAM,SAAS,GAAG,UAAU,CAAC;AAE7B,SAAS,OAAO,CAAC,KAAiB,EAAE,WAAmB;IACrD,IAAI,IAAI,GAAG,WAAW,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAuBD,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,QAAQ,GAAG,GAAG,CAAC;IAChC,MAAM,SAAS,GAAG,EAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,CAAC,QAAQ,GAAG,SAAS,CAAC,GAAG,GAAG,CAAC;IAC5C,MAAM,UAAU,GAAG,EAAE,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ;IACjD,MAAM,SAAS,GAAG,EAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ;IAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACrD,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,gBAAgB,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QAC7C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sEAAsE;AACtE,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,kBAAkB,CAAC,GAAG,CAAC;SAC3B,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;IAEvC,MAAM,WAAW,GACf,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,yEAAyE;YACzE,4CAA4C,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,yBAAyB;YAC7F,+BAA+B,KAAK,SAAS,CAAC;IAEpD,uEAAuE;IACvE,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAC,mGAAmG;YACnG,kGAAkG;YAClG,mDAAmD;YACnD,0FAA0F;YAC1F,8CAA8C;QAChD,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,CACL,gEAAgE;QAChE,6BAA6B,UAAU,gCAAgC;QACvE,qCAAqC,QAAQ,IAAI,UAAU,KAAK,SAAS,OAAO;QAChF,uCAAuC,MAAM,IAAI,UAAU,KAAK,SAAS,OAAO;QAChF,0BAA0B;QAC1B,6CAA6C,UAAU,MAAM;QAC7D,GAAG,WAAW,GAAG,aAAa,QAAQ,CACvC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC5D,OAAO,sBAAsB,mBAAmB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC;AA0BD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAe,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC"}

package/dist/auth/sandbox/driver.d.ts

@@ -1,5 +1,6 @@
 import type { AuthActionCode, AuthMailResolver, OutboundAuthMail } from '../sandbox-auth-flow.js';
 import type { AuthUserRecord, CreateUserRequest, MintSessionRequest, MintedSession, SeedUser, SignInIdentitySpec, UpdateUserRequest } from '../sandbox-backend.js';
+import type { AvatarMint } from './default-avatar.js';
 import type { Auth, AuthFlowResolver, Unsubscribe, User, UserCredential } from '../types.js';
 export declare const sandbox: {
     setUser(auth: Auth, user: User | null): void;
@@ -28,7 +29,22 @@ export declare const sandbox: {
     seedUsers(auth: Auth, users: ReadonlyArray<SeedUser>): void;
     exportUsers(auth: Auth): SeedUser[];
     restoreSession(auth: Auth, uid: string): User;
+    /** Read `Auth.tenantId` without going through the handle's own property,
+     *  for a host capturing the tenant scope alongside a signed-in uid (a
+     *  process boundary has no live `Auth` object to read it from later). */
+    getTenantId(auth: Auth): string | null;
+    /** Write `Auth.tenantId` without a sign-in, the seam a host uses to put
+     *  a captured tenant scope back once {@link restoreSession} has restored
+     *  the uid it was captured alongside. */
+    setTenantId(auth: Auth, tenantId: string | null): void;
     mintSession(auth: Auth, request: MintSessionRequest): MintedSession;
+    /**
+     * The provider the app session signed in through: `password`, `anonymous`,
+     * `custom`, or a federated provider id such as `google.com`.
+     * The same value `IdTokenResult.signInProvider` carries, so a reporter that
+     * labels a session keeps no second copy of it. `null` when signed out.
+     */
+    signInProvider(auth: Auth): string | null;
     listUsers(auth: Auth): AuthUserRecord[];
     createUser(auth: Auth, request: CreateUserRequest): AuthUserRecord;
     updateUser(auth: Auth, uid: string, update: UpdateUserRequest): AuthUserRecord;
@@ -39,6 +55,17 @@ export declare const sandbox: {
     deleteUser(auth: Auth, uid: string): void;
     clearUsers(auth: Auth): void;
     subscribeUsers(auth: Auth, callback: () => void): Unsubscribe;
+    /**
+     * Which sign-in providers are enabled, keyed by provider id.
+     *
+     * The whole-state form, beside {@link getAuthProviderConfig}'s listing: it
+     * is what a capture writes down and what {@link restoreProviderConfig} takes
+     * back, so a state capture reaches the account store through this namespace
+     * rather than through the backend handle.
+     */
+    exportProviderConfig(auth: Auth): Record<string, boolean>;
+    /** Replace the provider configuration with exactly the one given. */
+    restoreProviderConfig(auth: Auth, config: Record<string, boolean>): void;
     getAuthProviderConfig(auth: Auth): Array<{
         providerId: string;
         enabled: boolean;
@@ -46,6 +73,15 @@ export declare const sandbox: {
     setAuthProviderConfig(auth: Auth, providerId: string, enabled: boolean): void;
     assertAuthProviderEnabled(auth: Auth, providerId: string): void;
     delegateProviderEnforcement(auth: Auth, delegated: boolean): void;
+    /**
+     * Replace the mint that assigns a default `photoURL` to federated-provider
+     * users at creation. The built-in mint returns a deterministic SVG data URI;
+     * a served host installs one that returns its avatar route, and a host with
+     * avatars turned off installs `() => null` for Firebase's own no-photo
+     * behaviour. Install it during boot: the minted value is stored on each
+     * record as it is created.
+     */
+    setAvatarMint(auth: Auth, mint: AvatarMint): void;
     subscribeAuthProviderConfig(auth: Auth, callback: () => void): Unsubscribe;
 };
 //# sourceMappingURL=driver.d.ts.map

package/dist/auth/sandbox/driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../src/auth/sandbox/driver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACV,IAAI,EACJ,gBAAgB,EAChB,WAAW,EACX,IAAI,EACJ,cAAc,EACf,MAAM,aAAa,CAAC;AAMrB,eAAO,MAAM,OAAO;kBACJ,IAAI,QAAQ,IAAI,GAAG,IAAI,GAAG,IAAI;8BAIlB,IAAI,YAAY,gBAAgB,GAAG,IAAI,GAAG,IAAI;8BAI9C,IAAI,YAAY,gBAAgB,GAAG,IAAI,GAAG,IAAI;uBAIrD,IAAI,UAAU,MAAM,GAAG,gBAAgB,GAAG,IAAI;uBAI9C,IAAI,GAAG,gBAAgB,EAAE;yBAIvB,IAAI,QAAQ,MAAM,QAAQ,cAAc,GAAG,IAAI;yBAI/C,IAAI;;;;;;;;;iCAKjB,IAAI,WAEN;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GACnC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,kBAAkB,CAAA;KAAE,GACnD,cAAc;2BAIM,IAAI,UAAU,cAAc,GAAG,IAAI;oBAW1C,IAAI,SAAS,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI;sBAIzC,IAAI,GAAG,QAAQ,EAAE;yBAId,IAAI,OAAO,MAAM,GAAG,IAAI;sBAI3B,IAAI,WAAW,kBAAkB,GAAG,aAAa;oBAInD,IAAI,GAAG,cAAc,EAAE;qBAItB,IAAI,WAAW,iBAAiB,GAAG,cAAc;qBAIjD,IAAI,OAAO,MAAM,UAAU,iBAAiB,GAAG,cAAc;wBAKtE,IAAI,OACL,MAAM,WACF;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACjE,cAAc;qBAIA,IAAI,OAAO,MAAM,GAAG,IAAI;qBAIxB,IAAI,GAAG,IAAI;yBAIP,IAAI,YAAY,MAAM,IAAI,GAAG,WAAW;gCAIjC,IAAI,GAAG,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;gCAItD,IAAI,cAAc,MAAM,WAAW,OAAO,GAAG,IAAI;oCAI7C,IAAI,cAAc,MAAM,GAAG,IAAI;sCAI7B,IAAI,aAAa,OAAO,GAAG,IAAI;sCAI/B,IAAI,YAAY,MAAM,IAAI,GAAG,WAAW;CAG3E,CAAC"}
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../src/auth/sandbox/driver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EACV,IAAI,EACJ,gBAAgB,EAChB,WAAW,EACX,IAAI,EACJ,cAAc,EACf,MAAM,aAAa,CAAC;AAMrB,eAAO,MAAM,OAAO;kBACJ,IAAI,QAAQ,IAAI,GAAG,IAAI,GAAG,IAAI;8BAIlB,IAAI,YAAY,gBAAgB,GAAG,IAAI,GAAG,IAAI;8BAI9C,IAAI,YAAY,gBAAgB,GAAG,IAAI,GAAG,IAAI;uBAIrD,IAAI,UAAU,MAAM,GAAG,gBAAgB,GAAG,IAAI;uBAI9C,IAAI,GAAG,gBAAgB,EAAE;yBAIvB,IAAI,QAAQ,MAAM,QAAQ,cAAc,GAAG,IAAI;yBAI/C,IAAI;;;;;;;;;iCAKjB,IAAI,WAEN;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GACnC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,kBAAkB,CAAA;KAAE,GACnD,cAAc;2BAIM,IAAI,UAAU,cAAc,GAAG,IAAI;oBAW1C,IAAI,SAAS,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI;sBAIzC,IAAI,GAAG,QAAQ,EAAE;yBAId,IAAI,OAAO,MAAM,GAAG,IAAI;IAI7C;;6EAEyE;sBACvD,IAAI,GAAG,MAAM,GAAG,IAAI;IAItC;;6CAEyC;sBACvB,IAAI,YAAY,MAAM,GAAG,IAAI,GAAG,IAAI;sBAIpC,IAAI,WAAW,kBAAkB,GAAG,aAAa;IAInE;;;;;OAKG;yBACkB,IAAI,GAAG,MAAM,GAAG,IAAI;oBAIzB,IAAI,GAAG,cAAc,EAAE;qBAItB,IAAI,WAAW,iBAAiB,GAAG,cAAc;qBAIjD,IAAI,OAAO,MAAM,UAAU,iBAAiB,GAAG,cAAc;wBAKtE,IAAI,OACL,MAAM,WACF;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACjE,cAAc;qBAIA,IAAI,OAAO,MAAM,GAAG,IAAI;qBAIxB,IAAI,GAAG,IAAI;yBAIP,IAAI,YAAY,MAAM,IAAI,GAAG,WAAW;IAI7D;;;;;;;OAOG;+BACwB,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIzD,qEAAqE;gCACzC,IAAI,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;gCAI5C,IAAI,GAAG,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;gCAItD,IAAI,cAAc,MAAM,WAAW,OAAO,GAAG,IAAI;oCAI7C,IAAI,cAAc,MAAM,GAAG,IAAI;sCAI7B,IAAI,aAAa,OAAO,GAAG,IAAI;IAIjE;;;;;;;OAOG;wBACiB,IAAI,QAAQ,UAAU,GAAG,IAAI;sCAIf,IAAI,YAAY,MAAM,IAAI,GAAG,WAAW;CAG3E,CAAC"}

package/dist/auth/sandbox/driver.js

@@ -45,9 +45,30 @@ export const sandbox = {
     restoreSession(auth, uid) {
         return requireSandbox(auth).backend.restoreSession(uid);
     },
+    /** Read `Auth.tenantId` without going through the handle's own property,
+     *  for a host capturing the tenant scope alongside a signed-in uid (a
+     *  process boundary has no live `Auth` object to read it from later). */
+    getTenantId(auth) {
+        return requireSandbox(auth).backend.getTenantId();
+    },
+    /** Write `Auth.tenantId` without a sign-in, the seam a host uses to put
+     *  a captured tenant scope back once {@link restoreSession} has restored
+     *  the uid it was captured alongside. */
+    setTenantId(auth, tenantId) {
+        requireSandbox(auth).backend.setTenantId(tenantId);
+    },
     mintSession(auth, request) {
         return requireSandbox(auth).backend.mintDetachedSession(request);
     },
+    /**
+     * The provider the app session signed in through: `password`, `anonymous`,
+     * `custom`, or a federated provider id such as `google.com`.
+     * The same value `IdTokenResult.signInProvider` carries, so a reporter that
+     * labels a session keeps no second copy of it. `null` when signed out.
+     */
+    signInProvider(auth) {
+        return requireSandbox(auth).backend.getCurrentSignInProvider();
+    },
     listUsers(auth) {
         return requireSandbox(auth).backend.listUsers();
     },
@@ -69,6 +90,21 @@ export const sandbox = {
     subscribeUsers(auth, callback) {
         return requireSandbox(auth).backend.subscribeUsers(callback);
     },
+    /**
+     * Which sign-in providers are enabled, keyed by provider id.
+     *
+     * The whole-state form, beside {@link getAuthProviderConfig}'s listing: it
+     * is what a capture writes down and what {@link restoreProviderConfig} takes
+     * back, so a state capture reaches the account store through this namespace
+     * rather than through the backend handle.
+     */
+    exportProviderConfig(auth) {
+        return requireSandbox(auth).backend.exportProviderConfig();
+    },
+    /** Replace the provider configuration with exactly the one given. */
+    restoreProviderConfig(auth, config) {
+        requireSandbox(auth).backend.restoreProviderConfig(config);
+    },
     getAuthProviderConfig(auth) {
         return requireSandbox(auth).backend.listProviderConfig();
     },
@@ -81,6 +117,17 @@ export const sandbox = {
     delegateProviderEnforcement(auth, delegated) {
         requireSandbox(auth).backend.setProviderEnforcementDelegated(delegated);
     },
+    /**
+     * Replace the mint that assigns a default `photoURL` to federated-provider
+     * users at creation. The built-in mint returns a deterministic SVG data URI;
+     * a served host installs one that returns its avatar route, and a host with
+     * avatars turned off installs `() => null` for Firebase's own no-photo
+     * behaviour. Install it during boot: the minted value is stored on each
+     * record as it is created.
+     */
+    setAvatarMint(auth, mint) {
+        requireSandbox(auth).backend.setAvatarMint(mint);
+    },
     subscribeAuthProviderConfig(auth, callback) {
         return requireSandbox(auth).backend.subscribeProviderConfig(callback);
     },

package/dist/auth/sandbox/driver.js.map

@@ -1 +1 @@
-{"version":3,"file":"driver.js","sourceRoot":"","sources":["../../../src/auth/sandbox/driver.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAW7C,OAAO,EAAE,QAAQ,EAAsB,MAAM,cAAc,CAAC;AAS5D,SAAS,cAAc,CAAC,IAAU;IAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,CAAC,IAAU,EAAE,IAAiB;QACnC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,mBAAmB,CAAC,IAAU,EAAE,QAAiC;QAC/D,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,IAAU,EAAE,QAAiC;QAC/D,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,YAAY,CAAC,IAAU,EAAE,KAAc;QACrC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,YAAY,CAAC,IAAU;QACrB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC;IAED,cAAc,CAAC,IAAU,EAAE,IAAY,EAAE,IAAoB;QAC3D,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,cAAc,CAAC,IAAU;QACvB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;IACvD,CAAC;IAED,sBAAsB,CACpB,IAAU,EACV,OAEoD;QAEpD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,gBAAgB,CAAC,IAAU,EAAE,MAAsB;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CACpB,kBAAkB,EAClB,4HAA4H,CAC7H,CAAC;QACJ,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAED,SAAS,CAAC,IAAU,EAAE,KAA8B;QAClD,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,IAAU;QACpB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACpD,CAAC;IAED,cAAc,CAAC,IAAU,EAAE,GAAW;QACpC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,WAAW,CAAC,IAAU,EAAE,OAA2B;QACjD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,SAAS,CAAC,IAAU;QAClB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,UAAU,CAAC,IAAU,EAAE,OAA0B;QAC/C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,UAAU,CAAC,IAAU,EAAE,GAAW,EAAE,MAAyB;QAC3D,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,aAAa,CACX,IAAU,EACV,GAAW,EACX,OAAkE;QAElE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,UAAU,CAAC,IAAU,EAAE,GAAW;QAChC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,UAAU,CAAC,IAAU;QACnB,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;IAC5C,CAAC;IAED,cAAc,CAAC,IAAU,EAAE,QAAoB;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,qBAAqB,CAAC,IAAU;QAC9B,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAC3D,CAAC;IAED,qBAAqB,CAAC,IAAU,EAAE,UAAkB,EAAE,OAAgB;QACpE,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,yBAAyB,CAAC,IAAU,EAAE,UAAkB;QACtD,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;IAED,2BAA2B,CAAC,IAAU,EAAE,SAAkB;QACxD,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IAED,2BAA2B,CAAC,IAAU,EAAE,QAAoB;QAC1D,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC;CACF,CAAC"}
+{"version":3,"file":"driver.js","sourceRoot":"","sources":["../../../src/auth/sandbox/driver.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAW7C,OAAO,EAAE,QAAQ,EAAsB,MAAM,cAAc,CAAC;AAU5D,SAAS,cAAc,CAAC,IAAU;IAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,CAAC,IAAU,EAAE,IAAiB;QACnC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,mBAAmB,CAAC,IAAU,EAAE,QAAiC;QAC/D,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,IAAU,EAAE,QAAiC;QAC/D,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,YAAY,CAAC,IAAU,EAAE,KAAc;QACrC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,YAAY,CAAC,IAAU;QACrB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC;IAED,cAAc,CAAC,IAAU,EAAE,IAAY,EAAE,IAAoB;QAC3D,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,cAAc,CAAC,IAAU;QACvB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;IACvD,CAAC;IAED,sBAAsB,CACpB,IAAU,EACV,OAEoD;QAEpD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,gBAAgB,CAAC,IAAU,EAAE,MAAsB;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CACpB,kBAAkB,EAClB,4HAA4H,CAC7H,CAAC;QACJ,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAED,SAAS,CAAC,IAAU,EAAE,KAA8B;QAClD,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,IAAU;QACpB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACpD,CAAC;IAED,cAAc,CAAC,IAAU,EAAE,GAAW;QACpC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED;;6EAEyE;IACzE,WAAW,CAAC,IAAU;QACpB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACpD,CAAC;IAED;;6CAEyC;IACzC,WAAW,CAAC,IAAU,EAAE,QAAuB;QAC7C,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,WAAW,CAAC,IAAU,EAAE,OAA2B;QACjD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,IAAU;QACvB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;IACjE,CAAC;IAED,SAAS,CAAC,IAAU;QAClB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,UAAU,CAAC,IAAU,EAAE,OAA0B;QAC/C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,UAAU,CAAC,IAAU,EAAE,GAAW,EAAE,MAAyB;QAC3D,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,aAAa,CACX,IAAU,EACV,GAAW,EACX,OAAkE;QAElE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,UAAU,CAAC,IAAU,EAAE,GAAW;QAChC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,UAAU,CAAC,IAAU;QACnB,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;IAC5C,CAAC;IAED,cAAc,CAAC,IAAU,EAAE,QAAoB;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,IAAU;QAC7B,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAC7D,CAAC;IAED,qEAAqE;IACrE,qBAAqB,CAAC,IAAU,EAAE,MAA+B;QAC/D,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,qBAAqB,CAAC,IAAU;QAC9B,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAC3D,CAAC;IAED,qBAAqB,CAAC,IAAU,EAAE,UAAkB,EAAE,OAAgB;QACpE,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,yBAAyB,CAAC,IAAU,EAAE,UAAkB;QACtD,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;IAED,2BAA2B,CAAC,IAAU,EAAE,SAAkB;QACxD,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;OAOG;IACH,aAAa,CAAC,IAAU,EAAE,IAAgB;QACxC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,2BAA2B,CAAC,IAAU,EAAE,QAAoB;QAC1D,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC;CACF,CAAC"}

package/dist/auth/sandbox/project-store.d.ts

@@ -8,7 +8,6 @@ export interface AuthProjectStore {
     readonly providerConfigSubscribers: Set<() => void>;
     readonly counters: {
         nextAdminUserId: number;
-        nextAnonymousId: number;
     };
 }
 export declare function createAuthProjectStore(): AuthProjectStore;

package/dist/auth/sandbox/project-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-store.d.ts","sourceRoot":"","sources":["../../../src/auth/sandbox/project-store.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,QAAQ,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAezD"}
+{"version":3,"file":"project-store.d.ts","sourceRoot":"","sources":["../../../src/auth/sandbox/project-store.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,QAAQ,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE;QACjB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAczD"}

package/dist/auth/sandbox/project-store.js

@@ -10,7 +10,6 @@ export function createAuthProjectStore() {
         providerConfigSubscribers: new Set(),
         counters: {
             nextAdminUserId: 1,
-            nextAnonymousId: 1,
         },
     };
 }

package/dist/auth/sandbox/project-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-store.js","sourceRoot":"","sources":["../../../src/auth/sandbox/project-store.ts"],"names":[],"mappings":"AAeA,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,UAAU,EAAE,IAAI,GAAG,EAAE;QACrB,iBAAiB,EAAE,IAAI,GAAG,EAAE;QAC5B,cAAc,EAAE,IAAI,GAAG,CAAC;YACtB,CAAC,UAAU,EAAE,IAAI,CAAC;YAClB,CAAC,WAAW,EAAE,IAAI,CAAC;SACpB,CAAC;QACF,yBAAyB,EAAE,IAAI,GAAG,EAAE;QACpC,QAAQ,EAAE;YACR,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,CAAC;SACnB;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"project-store.js","sourceRoot":"","sources":["../../../src/auth/sandbox/project-store.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,UAAU,EAAE,IAAI,GAAG,EAAE;QACrB,iBAAiB,EAAE,IAAI,GAAG,EAAE;QAC5B,cAAc,EAAE,IAAI,GAAG,CAAC;YACtB,CAAC,UAAU,EAAE,IAAI,CAAC;YAClB,CAAC,WAAW,EAAE,IAAI,CAAC;SACpB,CAAC;QACF,yBAAyB,EAAE,IAAI,GAAG,EAAE;QACpC,QAAQ,EAAE;YACR,eAAe,EAAE,CAAC;SACnB;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/sandbox-backend-types.d.ts

@@ -19,29 +19,17 @@ export type Mutable<T> = {
     -readonly [K in keyof T]: T[K];
 };
 /** Seed record for `sandbox.seedUsers`. */
-/** Stand-in password for exported provider-flow identities that never had
- *  one — keeps `exportUsers` → `seedUsers` round-trips lossless without
- *  widening the `SeedUser` shape. Not a secret: sandbox-only. */
+/** Legacy passwordless-account marker, accepted on import only.
+ * New exports omit the password instead. Kept for older fixture readers. */
 export declare const NO_PASSWORD_SENTINEL = "__pyric_no_password__";
-export interface SeedUser {
-    uid: string;
-    email: string;
-    password: string;
-    displayName?: string;
-    customClaims?: Record<string, unknown>;
-    /** Originating provider for this identity (e.g. `'google.com'`).
-     *  Defaults to `'password'` — the natural provider for a record
-     *  seeded with an email + password. A host seeding popup-flow
-     *  identities passes the real provider so `listIdentities` /
-     *  `IdTokenResult.signInProvider` label them correctly. */
-    providerId?: string;
-}
+export type { SeedUser } from './seed-user.js';
 /**
  * Request for {@link SandboxBackend.mintDetachedSession} — one variant
- * per client sign-in shape, plus `uid` for existing identities
- * (session restore, provider-bridge accept).
+ * per client sign-in shape, plus `uid` for session restoration and
+ * `provider` for a provider sign-in to an existing linked identity.
+ * `custom` binds an identity already resolved from a custom token.
  */
-export type MintSessionRequest = {
+export type MintSessionRequest = TenantScope & ({
     kind: 'anonymous';
 } | {
     kind: 'password';
@@ -54,7 +42,21 @@ export type MintSessionRequest = {
 } | {
     kind: 'uid';
     uid: string;
-};
+} | {
+    kind: 'provider';
+    uid: string;
+    providerId: string;
+} | {
+    kind: 'custom';
+    uid: string;
+});
+/** The tenant a minted session authenticates under. Carried on every
+ *  {@link MintSessionRequest} because a detached session has no `Auth` handle
+ *  to read `tenantId` from: the caller (the SharedWorker host, acting for one
+ *  port's `ClientAuth`) states it per request. Absent means untenanted. */
+export interface TenantScope {
+    tenantId?: string | null;
+}
 /** A minted per-connection session: the `User` plus the {@link AuthState}
  *  its data contexts should carry (`sandbox.withAuth(state)`). */
 export interface MintedSession {
@@ -105,6 +107,9 @@ export interface SignInIdentitySpec {
     uid?: string;
     email: string;
     displayName?: string;
+    /** Profile photo for the identity, mirroring the stored record's
+     *  `photoUrl`. Omitted when the caller supplies none. */
+    photoUrl?: string;
     customClaims?: Record<string, unknown>;
 }
 /** Internal record in the in-memory user DB. `email`/`password` are
@@ -133,6 +138,11 @@ export interface StoredUser {
     /** ISO timestamp of the most recent sign-in, or null if this
      *  identity never signed in. */
     lastLoginAt: string | null;
+    /** Identity Platform tenant this identity last signed in under, or
+     *  `null` for the project-level (untenanted) pool. Written from
+     *  `Auth.tenantId` at sign-in and read back on session restore, so a
+     *  restored user keeps the tenant it authenticated with. */
+    tenantId: string | null;
 }
 /**
  * Public per-user record for the user-admin surface
@@ -150,6 +160,10 @@ export interface AuthUserRecord {
     isAnonymous: boolean;
     disabled: boolean;
     emailVerified: boolean;
+    /** Identity Platform tenant the record belongs to, or `null` for the
+     *  project-level pool. Rules read the same value as
+     *  `request.auth.token.firebase.tenant` once the identity signs in. */
+    tenantId: string | null;
     /** ISO timestamp. */
     createdAt: string;
     /** ISO timestamp, or null if the identity never signed in. */

package/dist/auth/sandbox-backend-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-backend-types.d.ts","sourceRoot":"","sources":["../../src/auth/sandbox-backend-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAErD;;gFAEgF;AAChF,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI;IAAE,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAE5D,2CAA2C;AAC3C;;iEAEiE;AACjE,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC;;;;+DAI2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;kEACkE;AAClE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB;;;2EAGuE;IACvE,QAAQ,EAAE,OAAO,CAAC;IAClB;;oEAEgE;IAChE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;8DAE8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;uBAEuB;AACvB,MAAM,WAAW,kBAAkB;IACjC,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;uDAEuD;AACvD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,WAAW,EAAE,OAAO,CAAC;IACrB;;;0BAGsB;IACtB,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACrC;mDAC+C;IAC/C,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB;oCACgC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACrC,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;+DAC+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;mEAI+D;IAC/D,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACvC;AAED;;6DAE6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;2DAMuD;IACvD,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACvC"}
+{"version":3,"file":"sandbox-backend-types.d.ts","sourceRoot":"","sources":["../../src/auth/sandbox-backend-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAErD;;gFAEgF;AAChF,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI;IAAE,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAE5D,2CAA2C;AAC3C;4EAC4E;AAC5E,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D,YAAY,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,CAC3C;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAClC,CAAC;AAEF;;;2EAG2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;kEACkE;AAClE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB;;;2EAGuE;IACvE,QAAQ,EAAE,OAAO,CAAC;IAClB;;oEAEgE;IAChE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;8DAE8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;uBAEuB;AACvB,MAAM,WAAW,kBAAkB;IACjC,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6DACyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;uDAEuD;AACvD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,WAAW,EAAE,OAAO,CAAC;IACrB;;;0BAGsB;IACtB,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACrC;mDAC+C;IAC/C,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB;oCACgC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;gEAG4D;IAC5D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACrC,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB;;2EAEuE;IACvE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;+DAC+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;mEAI+D;IAC/D,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACvC;AAED;;6DAE6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;2DAMuD;IACvD,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACvC"}

package/dist/auth/sandbox-backend-types.js

@@ -11,8 +11,7 @@
  * behavior: type declarations plus one const sentinel.
  */
 /** Seed record for `sandbox.seedUsers`. */
-/** Stand-in password for exported provider-flow identities that never had
- *  one — keeps `exportUsers` → `seedUsers` round-trips lossless without
- *  widening the `SeedUser` shape. Not a secret: sandbox-only. */
+/** Legacy passwordless-account marker, accepted on import only.
+ * New exports omit the password instead. Kept for older fixture readers. */
 export const NO_PASSWORD_SENTINEL = '__pyric_no_password__';
 //# sourceMappingURL=sandbox-backend-types.js.map