@noodleseed/one 0.96.3 → 0.97.0

package/dist/devtools-auth-ui.js

@@ -0,0 +1,127 @@
+/** Authenticated-preview UI. All OAuth credentials remain in the loopback process. */
+export const DEVTOOLS_AUTH_STYLES = `
+.auth-gate{
+  position:absolute;
+  inset:64px 0 0;
+  z-index:20;
+  display:none;
+  align-items:center;
+  justify-content:center;
+  padding:28px;
+  background:rgba(8,8,10,.88);
+  backdrop-filter:blur(18px);
+}
+.auth-locked .auth-gate{display:flex}
+.auth-card{
+  display:flex;
+  width:min(440px,100%);
+  flex-direction:column;
+  align-items:center;
+  gap:12px;
+  padding:30px;
+  border:1px solid var(--nd-border);
+  border-radius:24px;
+  background:var(--nd-panel-solid);
+  text-align:center;
+  box-shadow:0 24px 80px rgba(0,0,0,.45);
+}
+.auth-card h3{margin:0;font-size:22px;font-weight:610;letter-spacing:-.03em}
+.auth-card p{margin:0;color:var(--nd-muted);font-size:12.5px;line-height:1.6}
+.auth-issuer{font-family:var(--nd-mono);color:#d4d4d8!important;word-break:break-all}
+.auth-issuer[hidden]{display:none}
+.auth-provider{
+  display:grid;
+  width:min(320px,100%);
+  gap:6px;
+  text-align:left;
+}
+.auth-provider[hidden]{display:none}
+.auth-provider label{color:var(--nd-muted);font-size:10.5px}
+.auth-provider select{
+  width:100%;
+  padding:9px 30px 9px 10px;
+  border:1px solid var(--nd-border);
+  border-radius:9px;
+  background:var(--nd-panel);
+  color:var(--nd-text);
+  font:11px var(--nd-mono);
+}
+.auth-provider select:disabled{cursor:wait;opacity:.7}
+.auth-detail{min-height:16px;color:var(--nd-faint)!important;font-size:10.5px!important}
+.auth-detail.err{color:var(--nd-error)!important}
+.auth-card .btn{
+  min-width:164px;
+  display:inline-flex;
+  align-items:center;
+  justify-content:center;
+  gap:8px;
+}
+.auth-card .btn.is-loading::before{
+  width:12px;
+  height:12px;
+  border:2px solid currentColor;
+  border-right-color:transparent;
+  border-radius:50%;
+  content:"";
+  animation:auth-button-spin .7s linear infinite;
+}
+@keyframes auth-button-spin{to{transform:rotate(360deg)}}
+@media (prefers-reduced-motion:reduce){
+  .auth-card .btn.is-loading::before{animation-duration:1.4s}
+}
+.auth-session{
+  display:none;
+  align-items:center;
+  gap:7px;
+  margin-left:auto;
+  color:var(--nd-muted);
+  font-size:10.5px;
+}
+.auth-session.on{display:flex}
+.auth-session button{
+  padding:5px 8px;
+  border:0;
+  background:transparent;
+  color:var(--nd-faint);
+  font-size:10px;
+  cursor:pointer;
+}
+.auth-session button:hover{color:var(--nd-text)}
+.auth-session .status-dot{width:6px;height:6px}
+.auth-required .brand__url{display:none}
+`;
+export const DEVTOOLS_AUTH_GATE_HTML = '<div id="auth-gate" class="auth-gate" aria-live="polite">' +
+    '<div class="auth-card">' +
+    '<h3>Sign in to test</h3>' +
+    '<p>This MCP app requires a customer account. Your token stays in this local Devtools process.</p>' +
+    '<p id="auth-issuer" class="auth-issuer"></p>' +
+    '<div id="auth-provider" class="auth-provider" hidden>' +
+    '<label for="auth-issuer-choice">Identity provider</label>' +
+    '<select id="auth-issuer-choice"></select>' +
+    '</div>' +
+    '<button id="auth-sign-in" class="btn primary-action" type="button" disabled>Sign in</button>' +
+    '<p id="auth-detail" class="auth-detail"></p>' +
+    '</div></div>';
+export const DEVTOOLS_AUTH_SESSION_HTML = '<div id="auth-session" class="auth-session">' +
+    '<span class="status-dot" aria-hidden="true"></span>' +
+    '<span id="auth-session-label">Signed in</span>' +
+    '<button id="auth-logout" type="button">Sign out</button>' +
+    '</div>';
+// Plain browser script; it intentionally receives only safe `/auth/status` fields.
+export const DEVTOOLS_AUTH_CLIENT_JS = [
+    'var authGate=document.getElementById("auth-gate"); var authSignIn=document.getElementById("auth-sign-in"); var authIssuer=document.getElementById("auth-issuer"); var authProvider=document.getElementById("auth-provider"); var authIssuerChoice=document.getElementById("auth-issuer-choice"); var authDetail=document.getElementById("auth-detail");',
+    'var authSessionView=document.getElementById("auth-session"); var authSessionLabel=document.getElementById("auth-session-label"); var authLogout=document.getElementById("auth-logout");',
+    'var authWasSignedIn=false; var authStarting=false;',
+    'function authRequest(path,options){ var init=options||{}; init.headers=hostHeaders(Boolean(init.body)); return fetch(path,init); }',
+    'function authIssuerLabel(value){ try{ return new URL(value).host; }catch(e){ return value||""; } }',
+    'function authMethodLabel(status){ return status&&status.method==="firebase"?"Firebase":status&&status.method==="microsoft"?"Microsoft":""; }',
+    'function syncAuthIssuers(status){ var issuers=status&&Array.isArray(status.issuers)?status.issuers.filter(function(value){return typeof value==="string";}):[]; var current=authIssuerChoice.value; var options=Array.from(authIssuerChoice.options).map(function(option){return option.value;}); var changed=options.length!==issuers.length||options.some(function(value,index){return value!==issuers[index];}); if(changed){ while(authIssuerChoice.firstChild) authIssuerChoice.removeChild(authIssuerChoice.firstChild); issuers.forEach(function(issuer){ var option=document.createElement("option"); option.value=issuer; option.textContent=authIssuerLabel(issuer); authIssuerChoice.appendChild(option); }); } var statusOwnsChoice=status&&(status.state==="authorizing"||status.state==="signed_in"||status.state==="reauthorization_required"); var selected=statusOwnsChoice&&issuers.includes(status.issuer)?status.issuer:issuers.includes(current)?current:issuers.includes(status&&status.issuer)?status.issuer:issuers[0]||""; authIssuerChoice.value=selected; authProvider.hidden=issuers.length<2; authIssuer.hidden=issuers.length>1; authIssuer.textContent=authIssuerLabel((status&&status.issuer)||issuers[0]); }',
+    'function paintAuthStatus(status){ var signedIn=status&&status.state==="signed_in"; var becameSignedIn=signedIn&&!authWasSignedIn; if(status&&status.state!=="signed_out"&&status.state!=="authorizing") authStarting=false; var authBusy=Boolean(authStarting||(status&&status.state==="authorizing")); authWasSignedIn=Boolean(signedIn); document.body.classList.toggle("auth-locked",!signedIn); authSessionView.classList.toggle("on",signedIn); syncAuthIssuers(status); var scopes=(status&&status.scopes)||[]; var signedInIssuer=authIssuerLabel(status&&status.issuer); var methodLabel=authMethodLabel(status); authSessionLabel.textContent=(signedInIssuer?"Signed in · "+signedInIssuer:"Signed in")+(scopes.length?" · "+scopes.join(" "):""); authDetail.className="auth-detail"+(status&&(status.state==="error"||status.state==="unsupported")?" err":""); var statusMessage=(status&&status.message)||""; authDetail.textContent=(status&&status.errorCode?status.errorCode+": ":"")+statusMessage||(status&&status.state==="authorizing"?"Finish signing in in the new window.":status&&status.state==="reauthorization_required"?"Additional permission is required. Sign in again.":""); authSignIn.disabled=Boolean(authBusy||(status&&!status.supported)); authIssuerChoice.disabled=authBusy; authSignIn.classList.toggle("is-loading",authBusy); authSignIn.setAttribute("aria-busy",authBusy?"true":"false"); authSignIn.textContent=authBusy?(status&&status.state==="authorizing"?"Waiting for sign-in…":"Starting sign-in…"):status&&status.state==="error"?"Try sign-in again":status&&status.state==="reauthorization_required"?"Continue sign-in":methodLabel?"Sign in with "+methodLabel:"Sign in"; if(becameSignedIn&&typeof refreshTools==="function") refreshTools(); }',
+    'function refreshAuthStatus(){ return authRequest("/auth/status").then(function(r){return r.json();}).then(paintAuthStatus).catch(function(){ authDetail.className="auth-detail err"; authDetail.textContent="Could not reach the local Devtools auth host."; }); }',
+    'authSignIn.addEventListener("click",function(){ if(authSignIn.disabled)return; if(authStarting)return; authStarting=true; var selectedIssuer=authIssuerChoice.value; var startPath="/auth/start"+(selectedIssuer?"?issuer="+encodeURIComponent(selectedIssuer):""); var popup=window.open("","noodle-devtools-auth","popup,width=540,height=720"); authSignIn.disabled=true; authIssuerChoice.disabled=true; authSignIn.classList.add("is-loading"); authSignIn.setAttribute("aria-busy","true"); authSignIn.textContent="Starting sign-in…"; authDetail.className="auth-detail"; authDetail.textContent="Starting sign-in…"; authRequest(startPath,{method:"POST"}).then(function(r){return r.json().then(function(j){return {ok:r.ok,body:j};});}).then(function(result){ if(!result.ok||!result.body.authorizationUrl) throw new Error((result.body.error&&result.body.error.message)||"Could not start sign-in"); if(popup) popup.location.href=result.body.authorizationUrl; else window.open(result.body.authorizationUrl,"_blank","noopener"); paintAuthStatus({state:"authorizing",supported:true,issuer:result.body.issuer,issuers:result.body.issuers||[],method:result.body.method,scopes:result.body.scopes||[]}); }).catch(function(error){ authStarting=false; if(popup) popup.close(); authSignIn.disabled=false; authIssuerChoice.disabled=false; authSignIn.classList.remove("is-loading"); authSignIn.setAttribute("aria-busy","false"); authSignIn.textContent="Sign in"; authDetail.className="auth-detail err"; authDetail.textContent=error&&error.message||"Could not start sign-in."; }); });',
+    'authLogout.addEventListener("click",function(){ authRequest("/auth/logout",{method:"POST"}).then(refreshAuthStatus).catch(refreshAuthStatus); });',
+    'window.addEventListener("message",function(ev){ var callbackUrl; try{callbackUrl=new URL(ev.origin);}catch(e){return;} var sameLoopbackPort=callbackUrl.protocol===window.location.protocol&&callbackUrl.port===window.location.port&&callbackUrl.hostname==="localhost"&&window.location.hostname==="127.0.0.1"; if((ev.origin!==window.location.origin&&!sameLoopbackPort)||!ev.data||ev.data.type!=="noodle:auth-complete") return; refreshAuthStatus(); });',
+    'refreshAuthStatus();',
+    'setInterval(refreshAuthStatus,2000);',
+].join('\n');
+//# sourceMappingURL=devtools-auth-ui.js.map

package/dist/devtools-auth-ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-auth-ui.js","sourceRoot":"","sources":["../src/devtools-auth-ui.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0FnC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAClC,2DAA2D;IAC3D,yBAAyB;IACzB,0BAA0B;IAC1B,mGAAmG;IACnG,8CAA8C;IAC9C,uDAAuD;IACvD,2DAA2D;IAC3D,2CAA2C;IAC3C,QAAQ;IACR,8FAA8F;IAC9F,8CAA8C;IAC9C,cAAc,CAAC;AAEjB,MAAM,CAAC,MAAM,0BAA0B,GACrC,8CAA8C;IAC9C,qDAAqD;IACrD,gDAAgD;IAChD,0DAA0D;IAC1D,QAAQ,CAAC;AAEX,mFAAmF;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,yVAAyV;IACzV,yLAAyL;IACzL,oDAAoD;IACpD,oIAAoI;IACpI,oGAAoG;IACpG,8IAA8I;IAC9I,+qCAA+qC;IAC/qC,6sDAA6sD;IAC7sD,oQAAoQ;IACpQ,uhDAAuhD;IACvhD,mJAAmJ;IACnJ,icAAic;IACjc,sBAAsB;IACtB,sCAAsC;CACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}

package/dist/devtools-delegated-credential.d.ts

@@ -0,0 +1,10 @@
+import type { McpOAuthTokens } from '@noodle-borg/auth';
+import type { LocalDevtoolsDelegatedCredentialSink } from '@noodle-borg/service';
+import { type DevtoolsCustomerAuth } from './devtools-auth-types.js';
+export declare function storeDevtoolsDelegatedCredential(options: {
+    readonly auth: DevtoolsCustomerAuth;
+    readonly resource: string;
+    readonly tokens: McpOAuthTokens;
+    readonly sink: LocalDevtoolsDelegatedCredentialSink | undefined;
+}): Promise<void>;
+//# sourceMappingURL=devtools-delegated-credential.d.ts.map

package/dist/devtools-delegated-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-delegated-credential.d.ts","sourceRoot":"","sources":["../src/devtools-delegated-credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,sBAAsB,CAAC;AAEjF,OAAO,EAAqB,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAExF,wBAAsB,gCAAgC,CAAC,OAAO,EAAE;IAC9D,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,oCAAoC,GAAG,SAAS,CAAC;CACjE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB"}

package/dist/devtools-delegated-credential.js

@@ -0,0 +1,32 @@
+import { decodeJwt } from 'jose';
+import { DevtoolsAuthError } from './devtools-auth-types.js';
+export async function storeDevtoolsDelegatedCredential(options) {
+    const provider = options.auth.kind === 'firebase' || options.auth.kind === 'microsoft'
+        ? options.auth.kind
+        : undefined;
+    if (provider === undefined || options.sink === undefined)
+        return;
+    if (options.tokens.refreshToken === undefined) {
+        options.sink.clearResource(options.resource);
+        return;
+    }
+    let subject;
+    try {
+        const claims = decodeJwt(options.tokens.accessToken);
+        subject = typeof claims.sub === 'string' ? claims.sub : undefined;
+    }
+    catch {
+        // The loopback verifier remains authoritative. Decoding here only selects the same subject-keyed
+        // broker slot; an unsigned/forged value cannot produce a verified MCP caller.
+    }
+    if (subject === undefined || subject.length === 0) {
+        throw new DevtoolsAuthError('delegated_credential_subject_missing', `${provider === 'firebase' ? 'Firebase' : 'Microsoft'} did not return a subject-bound identity token.`);
+    }
+    await options.sink.setCredential({
+        resource: options.resource,
+        provider,
+        subject,
+        refreshToken: options.tokens.refreshToken,
+    });
+}
+//# sourceMappingURL=devtools-delegated-credential.js.map

package/dist/devtools-delegated-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-delegated-credential.js","sourceRoot":"","sources":["../src/devtools-delegated-credential.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAA6B,MAAM,0BAA0B,CAAC;AAExF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,OAKtD;IACC,MAAM,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;QACnE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;QACnB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO;IACjE,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IACD,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrD,OAAO,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,iGAAiG;QACjG,8EAA8E;IAChF,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,iBAAiB,CACzB,sCAAsC,EACtC,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,iDAAiD,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ;QACR,OAAO;QACP,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;KAC1C,CAAC,CAAC;AACL,CAAC"}

package/dist/devtools-firebase-auth.d.ts

@@ -0,0 +1,55 @@
+import type { McpOAuthTokens } from '@noodle-borg/auth';
+export interface DevtoolsFirebaseAuthConfig {
+    readonly kind: 'firebase';
+    readonly projectId: string;
+    /** Firebase Web API keys are public client configuration, not service credentials. */
+    readonly apiKey: string;
+    readonly authDomain?: string;
+    readonly appId?: string;
+    readonly tenantId?: string;
+    /** Optional customer-owned Firebase sign-in UI. It must form-post tokens to `redirect_uri`. */
+    readonly authorizeUrl?: string;
+    /** Opaque local-only revision used to clear credentials when verification configuration changes. */
+    readonly configurationKey?: string;
+    /** Test/self-host seam. Customer-owned authorization pages must otherwise use HTTPS. */
+    readonly allowInsecureLocalhost?: boolean;
+}
+export interface DevtoolsFirebasePendingAuthorization {
+    readonly authorizationUrl: string;
+    readonly state: string;
+    readonly expiresAt: number;
+}
+export interface DevtoolsFirebaseCallback {
+    readonly state: string;
+    readonly idToken?: string;
+    readonly refreshToken?: string;
+    readonly expiresIn?: number;
+    readonly error?: string;
+}
+export interface DevtoolsFirebaseAuthorizationPage {
+    readonly status: number;
+    readonly html: string;
+}
+export interface DevtoolsFirebaseDriver {
+    beginAuthorization(): DevtoolsFirebasePendingAuthorization;
+    completeAuthorization(pending: DevtoolsFirebasePendingAuthorization, callback: DevtoolsFirebaseCallback): Promise<McpOAuthTokens>;
+    refresh(current: McpOAuthTokens): Promise<McpOAuthTokens>;
+    renderAuthorizationPage(url: URL, pending: DevtoolsFirebasePendingAuthorization): DevtoolsFirebaseAuthorizationPage | undefined;
+}
+/** Local Firebase adapter. ID/refresh tokens never leave the loopback process after callback receipt. */
+export declare class FirebaseDevtoolsAuthDriver implements DevtoolsFirebaseDriver {
+    #private;
+    constructor(options: {
+        readonly auth: DevtoolsFirebaseAuthConfig;
+        readonly resource: string;
+        readonly redirectUri: string;
+        readonly fetchFn?: typeof fetch;
+        readonly now?: () => number;
+        readonly stateFactory?: () => string;
+    });
+    beginAuthorization(): DevtoolsFirebasePendingAuthorization;
+    completeAuthorization(pending: DevtoolsFirebasePendingAuthorization, callback: DevtoolsFirebaseCallback): Promise<McpOAuthTokens>;
+    refresh(current: McpOAuthTokens): Promise<McpOAuthTokens>;
+    renderAuthorizationPage(url: URL, pending: DevtoolsFirebasePendingAuthorization): DevtoolsFirebaseAuthorizationPage | undefined;
+}
+//# sourceMappingURL=devtools-firebase-auth.d.ts.map

package/dist/devtools-firebase-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-firebase-auth.d.ts","sourceRoot":"","sources":["../src/devtools-firebase-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAOxD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,oGAAoG;IACpG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,wFAAwF;IACxF,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,kBAAkB,IAAI,oCAAoC,CAAC;IAC3D,qBAAqB,CACnB,OAAO,EAAE,oCAAoC,EAC7C,QAAQ,EAAE,wBAAwB,GACjC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1D,uBAAuB,CACrB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,oCAAoC,GAC5C,iCAAiC,GAAG,SAAS,CAAC;CAClD;AAED,yGAAyG;AACzG,qBAAa,0BAA2B,YAAW,sBAAsB;;gBAS3D,OAAO,EAAE;QACnB,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;QAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;KACtC;IAUD,kBAAkB,IAAI,oCAAoC;IAuBpD,qBAAqB,CACzB,OAAO,EAAE,oCAAoC,EAC7C,QAAQ,EAAE,wBAAwB,GACjC,OAAO,CAAC,cAAc,CAAC;IAkBpB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAuC/D,uBAAuB,CACrB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,oCAAoC,GAC5C,iCAAiC,GAAG,SAAS;CAejD"}

package/dist/devtools-firebase-auth.js

@@ -0,0 +1,237 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+const FIREBASE_PENDING_TTL_MS = 10 * 60 * 1_000;
+const FIREBASE_MAX_TOKEN_BYTES = 64 * 1_024;
+const FIREBASE_MAX_RESPONSE_BYTES = 64 * 1_024;
+const FIREBASE_REFRESH_URL = 'https://securetoken.googleapis.com/v1/token';
+/** Local Firebase adapter. ID/refresh tokens never leave the loopback process after callback receipt. */
+export class FirebaseDevtoolsAuthDriver {
+    #auth;
+    #resource;
+    #redirectUri;
+    #localAuthorizeUrl;
+    #fetchFn;
+    #now;
+    #stateFactory;
+    constructor(options) {
+        this.#auth = options.auth;
+        this.#resource = options.resource;
+        this.#redirectUri = options.redirectUri;
+        this.#localAuthorizeUrl = new URL('/auth/firebase/authorize', options.redirectUri).href;
+        this.#fetchFn = options.fetchFn ?? fetch;
+        this.#now = options.now ?? Date.now;
+        this.#stateFactory = options.stateFactory ?? (() => randomBytes(32).toString('base64url'));
+    }
+    beginAuthorization() {
+        const state = this.#stateFactory();
+        if (state.length < 16 || state.length > 256)
+            throw new Error('Could not create Firebase state');
+        const configuredAuthorizeUrl = this.#auth.authorizeUrl;
+        if (configuredAuthorizeUrl !== undefined) {
+            assertTrustedAuthorizeUrl(configuredAuthorizeUrl, this.#auth.allowInsecureLocalhost === true);
+        }
+        const authorizationUrl = new URL(configuredAuthorizeUrl ?? this.#localAuthorizeUrl);
+        authorizationUrl.searchParams.set('state', state);
+        authorizationUrl.searchParams.set('redirect_uri', this.#redirectUri);
+        authorizationUrl.searchParams.set('resource', this.#resource);
+        authorizationUrl.searchParams.set('provider', 'firebase');
+        authorizationUrl.searchParams.set('project_id', this.#auth.projectId);
+        if (this.#auth.tenantId !== undefined) {
+            authorizationUrl.searchParams.set('tenant_id', this.#auth.tenantId);
+        }
+        return {
+            authorizationUrl: authorizationUrl.href,
+            state,
+            expiresAt: this.#now() + FIREBASE_PENDING_TTL_MS,
+        };
+    }
+    async completeAuthorization(pending, callback) {
+        if (pending.expiresAt <= this.#now())
+            throw new Error('Firebase authorization request expired');
+        if (!constantTimeStringEqual(callback.state, pending.state)) {
+            throw new Error('Firebase callback does not match the active sign-in');
+        }
+        if (callback.error !== undefined)
+            throw new Error('Firebase sign-in was cancelled or denied');
+        const idToken = requireBoundedToken(callback.idToken, 'Firebase ID token');
+        const refreshToken = optionalBoundedToken(callback.refreshToken, 'Firebase refresh token');
+        const expiresIn = positiveExpiresIn(callback.expiresIn);
+        return {
+            accessToken: idToken,
+            ...(refreshToken === undefined ? {} : { refreshToken }),
+            tokenType: 'Bearer',
+            ...(expiresIn === undefined ? {} : { expiresAt: this.#now() + expiresIn * 1_000 }),
+            scope: [],
+        };
+    }
+    async refresh(current) {
+        const refreshToken = requireBoundedToken(current.refreshToken, 'Firebase refresh token');
+        const params = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+        });
+        const endpoint = new URL(FIREBASE_REFRESH_URL);
+        endpoint.searchParams.set('key', this.#auth.apiKey);
+        const response = await this.#fetchFn(endpoint.href, {
+            method: 'POST',
+            redirect: 'error',
+            headers: {
+                accept: 'application/json',
+                'content-type': 'application/x-www-form-urlencoded',
+                'user-agent': 'noodleseed-devtools/firebase',
+            },
+            body: params.toString(),
+            signal: AbortSignal.timeout(10_000),
+        });
+        const text = await boundedResponseText(response, FIREBASE_MAX_RESPONSE_BYTES);
+        if (!response.ok)
+            throw new Error(`Firebase refresh failed with status ${response.status}`);
+        const body = parseJsonRecord(text);
+        const idToken = requireBoundedToken(body.id_token, 'Firebase refresh ID token');
+        const rotatedRefresh = requireBoundedToken(body.refresh_token, 'Firebase rotated refresh token');
+        const expiresIn = positiveExpiresIn(typeof body.expires_in === 'string' ? Number(body.expires_in) : body.expires_in);
+        return {
+            accessToken: idToken,
+            refreshToken: rotatedRefresh,
+            tokenType: 'Bearer',
+            expiresAt: this.#now() + (expiresIn ?? 3_600) * 1_000,
+            scope: [],
+        };
+    }
+    renderAuthorizationPage(url, pending) {
+        if (this.#auth.authorizeUrl !== undefined)
+            return undefined;
+        const expected = new URL(this.#localAuthorizeUrl);
+        if (url.origin !== expected.origin || url.pathname !== expected.pathname)
+            return undefined;
+        const valid = pending.expiresAt > this.#now() &&
+            constantTimeStringEqual(url.searchParams.get('state') ?? '', pending.state) &&
+            url.searchParams.get('redirect_uri') === this.#redirectUri &&
+            url.searchParams.get('resource') === this.#resource &&
+            url.searchParams.get('provider') === 'firebase' &&
+            url.searchParams.get('project_id') === this.#auth.projectId;
+        return valid
+            ? { status: 200, html: renderFirebasePage(this.#auth, pending.state, this.#redirectUri) }
+            : { status: 400, html: renderFirebaseErrorPage() };
+    }
+}
+function renderFirebasePage(auth, state, redirectUri) {
+    const nonce = randomBytes(18).toString('base64url');
+    const config = {
+        apiKey: auth.apiKey,
+        authDomain: auth.authDomain ?? `${auth.projectId}.firebaseapp.com`,
+        projectId: auth.projectId,
+        ...(auth.appId === undefined ? {} : { appId: auth.appId }),
+    };
+    const authOrigin = firebaseAuthOrigin(config.authDomain);
+    const redirectOrigin = new URL(redirectUri).origin;
+    const contentSecurityPolicy = [
+        "default-src 'none'",
+        `script-src 'nonce-${nonce}' https://www.gstatic.com https://apis.google.com`,
+        `style-src 'nonce-${nonce}'`,
+        `connect-src https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://www.googleapis.com https://accounts.google.com ${authOrigin}`,
+        `frame-src ${authOrigin} https://accounts.google.com`,
+        `form-action ${redirectOrigin}`,
+        "base-uri 'none'",
+        "object-src 'none'",
+    ].join('; ');
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="robots" content="noindex"><meta http-equiv="Content-Security-Policy" content="${escapeHtml(contentSecurityPolicy)}"><title>Firebase sign-in · Noodle Seed Devtools</title><style nonce="${nonce}">${FIREBASE_PAGE_STYLES}</style></head><body><main><p class="eyebrow">Local Devtools</p><h1>Sign in to your app</h1><p id="status">Continue with the Firebase account you use for this app. The resulting token stays in this local process.</p><form id="firebase-form" method="post" action="${escapeHtml(redirectUri)}"><input type="hidden" name="state" value="${escapeHtml(state)}"><input type="hidden" id="id-token" name="id_token"><input type="hidden" id="refresh-token" name="refresh_token"><input type="hidden" id="expires-in" name="expires_in"><button id="firebase-sign-in" type="button">Continue with Google</button></form><p class="note">Using another Firebase sign-in method? Configure <code>authorizeUrl</code> with your app's existing auth UI.</p></main><script nonce="${nonce}" type="module">const firebaseConfig=${safeScriptJson(config)};const tenantId=${safeScriptJson(auth.tenantId ?? null)};const status=document.getElementById("status");const button=document.getElementById("firebase-sign-in");const form=document.getElementById("firebase-form");try{const [{initializeApp},{getAuth,GoogleAuthProvider,signInWithPopup}]=await Promise.all([import("https://www.gstatic.com/firebasejs/10.14.1/firebase-app.js"),import("https://www.gstatic.com/firebasejs/10.14.1/firebase-auth.js")]);const firebaseAuth=getAuth(initializeApp(firebaseConfig));if(tenantId)firebaseAuth.tenantId=tenantId;button.addEventListener("click",async()=>{button.disabled=true;button.textContent="Waiting for sign-in…";status.textContent="Finish signing in in the new window.";try{const credential=await signInWithPopup(firebaseAuth,new GoogleAuthProvider());document.getElementById("id-token").value=await credential.user.getIdToken();document.getElementById("refresh-token").value=credential.user.refreshToken||"";const result=await credential.user.getIdTokenResult();document.getElementById("expires-in").value=String(Math.max(1,Math.floor((Date.parse(result.expirationTime)-Date.now())/1000)));form.submit();}catch(error){status.textContent="Firebase sign-in failed. Please try again.";button.disabled=false;button.textContent="Continue with Google";}});}catch(error){status.textContent="Could not load Firebase sign-in. Check your network and Firebase Web configuration.";button.disabled=true;}</script></body></html>`;
+}
+function renderFirebaseErrorPage() {
+    return ('<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="robots" content="noindex"><title>Authorization expired</title><style>' +
+        FIREBASE_PAGE_STYLES +
+        '</style></head><body><main><h1>Authorization request expired</h1><p>Return to Devtools and start a fresh sign-in.</p></main></body></html>');
+}
+const FIREBASE_PAGE_STYLES = ':root{color-scheme:dark}*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;background:#09090b;color:#fafafa;font:14px system-ui,sans-serif}main{width:min(420px,100%);padding:30px;border:1px solid #27272a;border-radius:22px;background:#111113;box-shadow:0 24px 80px #0008}h1{margin:4px 0 10px;font-size:24px}p{color:#a1a1aa;line-height:1.6}.eyebrow{margin:0;color:#f97316;font-size:11px;text-transform:uppercase;letter-spacing:.14em}button{width:100%;margin-top:18px;padding:12px 16px;border:0;border-radius:999px;background:#fafafa;color:#09090b;font:600 14px system-ui;cursor:pointer}button:disabled{cursor:wait;opacity:.65}.note{margin:18px 0 0;padding-top:16px;border-top:1px solid #27272a;font-size:12px}code{color:#d4d4d8}';
+function firebaseAuthOrigin(value) {
+    const url = new URL(value.includes('://') ? value : `https://${value}`);
+    if (url.protocol !== 'https:' ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.pathname !== '/' ||
+        url.search !== '' ||
+        url.hash !== '') {
+        throw new Error('Firebase authDomain must be an HTTPS origin or hostname');
+    }
+    return url.origin;
+}
+function assertTrustedAuthorizeUrl(value, allowInsecureLocalhost) {
+    const url = new URL(value);
+    if (url.protocol === 'https:')
+        return;
+    if (url.protocol === 'http:' && allowInsecureLocalhost && isLoopbackHostname(url.hostname))
+        return;
+    throw new Error('Firebase authorizeUrl must use HTTPS');
+}
+function isLoopbackHostname(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}
+function requireBoundedToken(value, name) {
+    if (typeof value !== 'string' || value.length === 0)
+        throw new Error(`${name} is missing`);
+    if (Buffer.byteLength(value, 'utf8') > FIREBASE_MAX_TOKEN_BYTES) {
+        throw new Error(`${name} is too large`);
+    }
+    return value;
+}
+function optionalBoundedToken(value, name) {
+    return value === undefined || value === '' ? undefined : requireBoundedToken(value, name);
+}
+function positiveExpiresIn(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0 || value > 86_400) {
+        throw new Error('Firebase token lifetime is invalid');
+    }
+    return Math.floor(value);
+}
+async function boundedResponseText(response, maxBytes) {
+    const declared = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > maxBytes)
+        throw new Error('Firebase response is too large');
+    if (response.body === null)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    while (true) {
+        const next = await reader.read();
+        if (next.done)
+            break;
+        size += next.value.byteLength;
+        if (size > maxBytes) {
+            await reader.cancel();
+            throw new Error('Firebase response is too large');
+        }
+        chunks.push(next.value);
+    }
+    return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))).toString('utf8');
+}
+function parseJsonRecord(value) {
+    try {
+        const parsed = JSON.parse(value);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // Fall through to a stable, credential-free error.
+    }
+    throw new Error('Firebase returned an invalid refresh response');
+}
+function constantTimeStringEqual(left, right) {
+    const leftBytes = Buffer.from(left);
+    const rightBytes = Buffer.from(right);
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}
+function safeScriptJson(value) {
+    return JSON.stringify(value).replaceAll('<', '\\u003c');
+}
+//# sourceMappingURL=devtools-firebase-auth.js.map

package/dist/devtools-firebase-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-firebase-auth.js","sourceRoot":"","sources":["../src/devtools-firebase-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG3D,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAChD,MAAM,wBAAwB,GAAG,EAAE,GAAG,KAAK,CAAC;AAC5C,MAAM,2BAA2B,GAAG,EAAE,GAAG,KAAK,CAAC;AAC/C,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAkD3E,yGAAyG;AACzG,MAAM,OAAO,0BAA0B;IAC5B,KAAK,CAA6B;IAClC,SAAS,CAAS;IAClB,YAAY,CAAS;IACrB,kBAAkB,CAAS;IAC3B,QAAQ,CAAe;IACvB,IAAI,CAAe;IACnB,aAAa,CAAe;IAErC,YAAY,OAOX;QACC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,0BAA0B,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;QACxF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,kBAAkB;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAChG,MAAM,sBAAsB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QACvD,IAAI,sBAAsB,KAAK,SAAS,EAAE,CAAC;YACzC,yBAAyB,CAAC,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,KAAK,IAAI,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,sBAAsB,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACpF,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC1D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtC,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtE,CAAC;QACD,OAAO;YACL,gBAAgB,EAAE,gBAAgB,CAAC,IAAI;YACvC,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,uBAAuB;SACjD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,OAA6C,EAC7C,QAAkC;QAElC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChG,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC3E,MAAM,YAAY,GAAG,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO;YACL,WAAW,EAAE,OAAO;YACpB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,SAAS,GAAG,KAAK,EAAE,CAAC;YAClF,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAuB;QACnC,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC/C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,mCAAmC;gBACnD,YAAY,EAAE,8BAA8B;aAC7C;YACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;YACvB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;QAChF,MAAM,cAAc,GAAG,mBAAmB,CACxC,IAAI,CAAC,aAAa,EAClB,gCAAgC,CACjC,CAAC;QACF,MAAM,SAAS,GAAG,iBAAiB,CACjC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAChF,CAAC;QACF,OAAO;YACL,WAAW,EAAE,OAAO;YACpB,YAAY,EAAE,cAAc;YAC5B,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK;YACrD,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED,uBAAuB,CACrB,GAAQ,EACR,OAA6C;QAE7C,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC3F,MAAM,KAAK,GACT,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE;YAC/B,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC;YAC3E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,YAAY;YAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,SAAS;YACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,UAAU;YAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAC9D,OAAO,KAAK;YACV,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE;YACzF,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,CAAC;IACvD,CAAC;CACF;AAED,SAAS,kBAAkB,CACzB,IAAgC,EAChC,KAAa,EACb,WAAmB;IAEnB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,GAAG,IAAI,CAAC,SAAS,kBAAkB;QAClE,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;KAC3D,CAAC;IACF,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IACnD,MAAM,qBAAqB,GAAG;QAC5B,oBAAoB;QACpB,qBAAqB,KAAK,mDAAmD;QAC7E,oBAAoB,KAAK,GAAG;QAC5B,gJAAgJ,UAAU,EAAE;QAC5J,aAAa,UAAU,8BAA8B;QACrD,eAAe,cAAc,EAAE;QAC/B,iBAAiB;QACjB,mBAAmB;KACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,2NAA2N,UAAU,CAAC,qBAAqB,CAAC,yEAAyE,KAAK,KAAK,oBAAoB,0QAA0Q,UAAU,CAAC,WAAW,CAAC,8CAA8C,UAAU,CAAC,KAAK,CAAC,kZAAkZ,KAAK,wCAAwC,cAAc,CAAC,MAAM,CAAC,mBAAmB,cAAc,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,y3CAAy3C,CAAC;AACnlF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,CACL,8IAA8I;QAC9I,oBAAoB;QACpB,4IAA4I,CAC7I,CAAC;AACJ,CAAC;AAED,MAAM,oBAAoB,GACxB,0wBAA0wB,CAAC;AAE7wB,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IACxE,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa,EAAE,sBAA+B;IAC/E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,sBAAsB,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxF,OAAO;IACT,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;AACtF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,wBAAwB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,IAAY;IACxD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAkB,EAAE,QAAgB;IACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;QAClD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM;QACrB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAC9B,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,OAAO,MAAiC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAC1D,CAAC"}

package/dist/devtools-harness.d.ts

@@ -17,6 +17,8 @@ export declare function openAiShimScript(init: {
     readonly toolResponseMetadata?: unknown;
     readonly toolResult?: unknown;
     readonly theme?: 'light' | 'dark';
+    /** Route calls through the credential-owning parent rather than allowing the widget to call loopback. */
+    readonly hostMediated?: boolean;
 }): string;
 /** Insert the reset + shim into the widget document so they run before the (deferred) bridge module script. */
 export declare function wrapWidgetHtml(html: string, shimScript: string): string;
@@ -25,5 +27,8 @@ export declare function harnessHtml(options: {
     readonly mcpUrl: string;
     readonly theme: PreviewTheme;
     readonly device: PreviewDevice;
+    readonly rpcCapability?: string;
+    readonly secureWidgets?: boolean;
+    readonly authRequired?: boolean;
 }): string;
 //# sourceMappingURL=devtools-harness.d.ts.map

package/dist/devtools-harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devtools-harness.d.ts","sourceRoot":"","sources":["../src/devtools-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AACrD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1D,8FAA8F;AAC9F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtF;AAgBD,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACnC,GAAG,MAAM,CA8BT;AAUD,+GAA+G;AAC/G,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAcvE;AAMD,oCAAoC;AACpC,wBAAgB,WAAW,CAAC,OAAO,EAAE;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC,GAAG,MAAM,CAoHT"}
+{"version":3,"file":"devtools-harness.d.ts","sourceRoot":"","sources":["../src/devtools-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmBH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AACrD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1D,8FAA8F;AAC9F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtF;AAgBD,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,yGAAyG;IACzG,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC,GAAG,MAAM,CA+CT;AAUD,+GAA+G;AAC/G,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAcvE;AAMD,oCAAoC;AACpC,wBAAgB,WAAW,CAAC,OAAO,EAAE;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC,GAAG,MAAM,CAgIT"}