@pyric/cli 0.1.0-alpha.10

package/dist/serve/worker/host/storage.js

@@ -0,0 +1,260 @@
+/**
+ * SharedWorker host — worker-backed Cloud Storage ops.
+ *
+ * Object browse (`storage.listAll`/`getMetadata`), the MessagePort-only
+ * `getBlob`, and the relay-safe base64 byte transfer (`putBytes`/`getBytes`)
+ * plus idempotent `deleteObject`. Owns the storage lens resolver
+ * (`lensStorage` — the storage mirror of the firestore/rtdb lens resolvers),
+ * the lazily-created shared handle, and the wire → `SettableMetadata` mapper.
+ *
+ * Routed here by the host dispatcher. Storage dispatch is async, so the
+ * mutating ops thread the op's provenance EXPLICITLY (their events escape the
+ * dispatcher's synchronous ambient-provenance window). Never imports the
+ * dispatcher.
+ */
+import { getStorageSandbox, ref as storageRef, listAll as storageListAll, getMetadata as storageGetMetadata, getBlob as storageGetBlob, getBytes as storageGetBytes, uploadBytes as storageUploadBytes, deleteObject as storageDeleteObject, } from 'pyric/storage';
+// Host-only rules-bypass admin plane — the storage mirror of
+// `getAdminFirestore`/`getAdminDatabase`, resolved for `actAs: { mode: 'admin' }`.
+import { bindStorageOperationContext, getAdminStorageSandbox, } from 'pyric/storage/internal';
+import { bindOperationContext } from 'pyric/sandbox/internal';
+import { bytesToBase64, base64ToBytes, storagePayloadTooLarge, MAX_STORAGE_OP_BYTES, MAX_STORAGE_OP_B64_LENGTH, } from '../protocol.js';
+import { ok, fail } from '../host-context.js';
+import { authStateForLens, lensCacheKey, opProvenance, sessionCacheKey } from './core.js';
+import { portSession } from '../host-auth.js';
+/** The shared Storage handle, lazily created (Pyric Studio data browse): one per
+ *  worker, directly over the shared sandbox. The high-level
+ *  `pyric/storage` ops enforce rules, so the host reads through them. */
+function ensureStorage(ctx) {
+    return (ctx.storage ??= getStorageSandbox(bindOperationContext(ctx.sandbox.withAuth(null), {
+        source: { kind: 'app' },
+        authLens: { mode: 'app-session' },
+    })));
+}
+/**
+ * Resolve the Storage handle a storage op runs against, given its `actAs`
+ * lens — the storage mirror of {@link lensRtdb}:
+ *
+ *   - absent / `app-session` → a handle carrying the initiating port's Auth
+ *     session, or the shared anonymous handle when that port is signed out.
+ *     Storage rules apply only when the HOST
+ *     configured them on this sandbox's storage service (first call per
+ *     sandbox wins) — the SERVED worker configures them via
+ *     `applyServeInit` (`serve-init.ts`), which opens the storage service
+ *     with `payload.storageRules` BEFORE any op can reach `ensureStorage`/
+ *     `lensStorage`, so every lens on a served worker enforces the
+ *     project's storage.rules (or runs open when the project has none,
+ *     matching Firestore/RTDB's no-rules posture). The lens split still
+ *     matters for embedding/test hosts that open the service directly.
+ *   - `{ mode: 'admin' }` → the rules-BYPASS handle from
+ *     `pyric/storage/internal`'s admin plane — same per-sandbox store +
+ *     ruleset, rule evaluation skipped (firebase-admin semantics for the
+ *     `pyric-admin` remote arm / Studio admin lens).
+ *   - `{ mode: 'as', uid }` → a frozen-identity `getStorageSandbox(
+ *     sandbox.withAuth({ uid, token? }))` handle; rules evaluate AS that
+ *     user. Cached per uid/token key on `ctx.lensStorages`.
+ */
+function sessionStorage(ctx, port) {
+    const session = portSession(ctx, port);
+    if (!session)
+        return ensureStorage(ctx);
+    const key = sessionCacheKey(session);
+    const handles = (ctx.sessionStorages ??= new Map());
+    let handle = handles.get(key);
+    if (!handle) {
+        handle = getStorageSandbox(ctx.sandbox.withAuth(session.state));
+        handles.set(key, handle);
+    }
+    return handle;
+}
+function lensStorage(ctx, actAs, port) {
+    if (!actAs || actAs.mode === 'app-session') {
+        return sessionStorage(ctx, port);
+    }
+    if (actAs.mode === 'admin') {
+        return (ctx.adminStorage ??= getAdminStorageSandbox(ctx.sandbox));
+    }
+    // Genuinely unauthenticated — see the `anon` note on lensDb. Distinct from
+    // the shared page handle only when the host configured storage rules, but
+    // pinning it keeps remote `withAuth(null)` semantics uniform across services.
+    if (actAs.mode === 'anon') {
+        return (ctx.anonStorage ??= getStorageSandbox(ctx.sandbox.withAuth(null)));
+    }
+    const handles = (ctx.lensStorages ??= new Map());
+    const key = lensCacheKey(actAs);
+    let handle = handles.get(key);
+    if (!handle) {
+        handle = getStorageSandbox(ctx.sandbox.withAuth(authStateForLens(actAs)));
+        handles.set(key, handle);
+    }
+    return handle;
+}
+/**
+ * Map a wire `storage.putBytes` payload to `pyric/storage`'s
+ * `SettableMetadata`. The explicit `contentType` field wins; recognized
+ * settable fields are lifted from `metadata`; a GCS-style nested custom map
+ * (`metadata.metadata`, as `@google-cloud/storage`'s `save` spells it) or a
+ * pyric-style `metadata.customMetadata` becomes `customMetadata` with
+ * values coerced to strings (the storage-rules `metadata` model).
+ */
+function toSettableMetadata(msg) {
+    const md = msg.metadata ?? {};
+    const str = (key) => typeof md[key] === 'string' ? md[key] : undefined;
+    const customSource = md['customMetadata'] ?? md['metadata'];
+    let customMetadata;
+    if (customSource !== null && typeof customSource === 'object' && !Array.isArray(customSource)) {
+        customMetadata = {};
+        for (const [k, v] of Object.entries(customSource)) {
+            customMetadata[k] = String(v);
+        }
+    }
+    const settable = {};
+    const contentType = msg.contentType ?? str('contentType');
+    if (contentType !== undefined)
+        settable.contentType = contentType;
+    const cacheControl = str('cacheControl');
+    if (cacheControl !== undefined)
+        settable.cacheControl = cacheControl;
+    const contentDisposition = str('contentDisposition');
+    if (contentDisposition !== undefined)
+        settable.contentDisposition = contentDisposition;
+    const contentEncoding = str('contentEncoding');
+    if (contentEncoding !== undefined)
+        settable.contentEncoding = contentEncoding;
+    const contentLanguage = str('contentLanguage');
+    if (contentLanguage !== undefined)
+        settable.contentLanguage = contentLanguage;
+    if (customMetadata !== undefined)
+        settable.customMetadata = customMetadata;
+    return settable;
+}
+/** The storage op methods routed to {@link handleStorageOp}. */
+const STORAGE_METHODS = new Set([
+    'storage.listAll',
+    'storage.getMetadata',
+    'storage.getBlob',
+    'storage.putBytes',
+    'storage.getBytes',
+    'storage.deleteObject',
+]);
+export function isStorageOp(method) {
+    return STORAGE_METHODS.has(method);
+}
+export async function handleStorageOp(ctx, port, msg) {
+    switch (msg.method) {
+        case 'storage.listAll': {
+            // Object browse. `listAll` enforces `read` rules on the scanned prefix
+            // under the op's lens (admin lens bypasses — see lensStorage).
+            try {
+                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port), opProvenance(msg));
+                const result = await storageListAll(storageRef(storage, msg.path));
+                ok(port, msg.id, {
+                    items: result.items.map((r) => ({ fullPath: r.fullPath, name: r.name })),
+                    prefixes: result.prefixes.map((r) => ({ fullPath: r.fullPath, name: r.name })),
+                });
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'storage.getMetadata': {
+            try {
+                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port), opProvenance(msg));
+                // FullMetadata is plain JSON (bucket/fullPath/name/size/contentType/...).
+                ok(port, msg.id, await storageGetMetadata(storageRef(storage, msg.path)));
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'storage.getBlob': {
+            // MessagePort-ONLY: the Blob structured-clones to in-page callers
+            // (Studio previews) but silently corrupts under the JSON WS relay — the
+            // bridge client rejects relaying it (binary-payload guard). Remote
+            // callers use `storage.getBytes` (base64) instead.
+            try {
+                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port), opProvenance(msg));
+                ok(port, msg.id, await storageGetBlob(storageRef(storage, msg.path)));
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'storage.putBytes': {
+            // Byte upload (remote sandbox, slice 2). Decode-end size cap: reject an
+            // oversized base64 string BEFORE materializing its bytes, then re-check
+            // the exact decoded length. Rules enforce under the op's lens; the
+            // upload emits `service_mutation` events. Storage dispatch is async, so
+            // the event escapes the ambient-provenance window `handleMessage` opened;
+            // thread the op's provenance EXPLICITLY so a Studio-issued write is
+            // attributable end to end (issue #84 item 3).
+            try {
+                if (msg.dataB64.length > MAX_STORAGE_OP_B64_LENGTH) {
+                    throw storagePayloadTooLarge(Math.floor(msg.dataB64.length * 0.75), `storage.putBytes payload for '${msg.path}'`);
+                }
+                const bytes = base64ToBytes(msg.dataB64);
+                if (bytes.byteLength > MAX_STORAGE_OP_BYTES) {
+                    throw storagePayloadTooLarge(bytes.byteLength, `storage.putBytes payload for '${msg.path}'`);
+                }
+                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port), opProvenance(msg));
+                const result = await storageUploadBytes(storageRef(storage, msg.path), bytes, toSettableMetadata(msg));
+                // FullMetadata — plain JSON, relay-safe.
+                ok(port, msg.id, result.metadata);
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'storage.getBytes': {
+            // JSON-safe byte download (remote sandbox, slice 2): base64 in the
+            // result. Encode-end size cap so a big browser-side object can't blow
+            // up the relay. Metadata is read alongside for contentType (both reads
+            // run under the same lens; rule-eval order keeps `unauthorized`
+            // superseding `not-found`, matching pyric/storage).
+            try {
+                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port), opProvenance(msg));
+                const r = storageRef(storage, msg.path);
+                const meta = await storageGetMetadata(r);
+                if (meta.size > MAX_STORAGE_OP_BYTES) {
+                    throw storagePayloadTooLarge(meta.size, `object '${msg.path}'`);
+                }
+                const buf = await storageGetBytes(r);
+                if (buf.byteLength > MAX_STORAGE_OP_BYTES) {
+                    throw storagePayloadTooLarge(buf.byteLength, `object '${msg.path}'`);
+                }
+                ok(port, msg.id, {
+                    dataB64: bytesToBase64(new Uint8Array(buf)),
+                    contentType: meta.contentType,
+                    size: buf.byteLength,
+                });
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        case 'storage.deleteObject': {
+            // `pyric/storage`'s sandbox delete is idempotent (no-op on missing) —
+            // matching the pyric-admin local arm's delete semantics. Rules enforce
+            // `write` under the op's lens; deletes emit `service_mutation` events.
+            // Async dispatch escapes the ambient window — thread provenance
+            // explicitly (issue #84 item 3).
+            try {
+                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port), opProvenance(msg));
+                await storageDeleteObject(storageRef(storage, msg.path));
+                ok(port, msg.id, null);
+            }
+            catch (e) {
+                fail(port, msg.id, e);
+            }
+            break;
+        }
+        default: {
+            fail(port, msg.id, new Error(`Unknown method: ${String(msg.method)}`));
+        }
+    }
+}
+//# sourceMappingURL=storage.js.map

package/dist/serve/worker/host/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../../../src/serve/worker/host/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,iBAAiB,EACjB,GAAG,IAAI,UAAU,EACjB,OAAO,IAAI,cAAc,EACzB,WAAW,IAAI,kBAAkB,EACjC,OAAO,IAAI,cAAc,EACzB,QAAQ,IAAI,eAAe,EAC3B,WAAW,IAAI,kBAAkB,EACjC,YAAY,IAAI,mBAAmB,GAGpC,MAAM,eAAe,CAAC;AACvB,6DAA6D;AAC7D,mFAAmF;AACnF,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAG9D,OAAO,EACL,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA+B,EAAE,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C;;yEAEyE;AACzE,SAAS,aAAa,CAAC,GAAY;IACjC,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,iBAAiB,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACzF,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;QACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;KAClC,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,cAAc,CAAC,GAAY,EAAE,IAAc;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,KAA2B,EAAE,IAAc;IAC5E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3C,OAAO,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,8EAA8E;IAC9E,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,GAG3B;IACC,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAsB,EAAE,CAC9C,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,YAAY,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,cAAkD,CAAC;IACvD,IAAI,YAAY,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9F,cAAc,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAuC,CAAC,EAAE,CAAC;YAC7E,cAAc,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,WAAW,KAAK,SAAS;QAAE,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;IAClE,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,YAAY,KAAK,SAAS;QAAE,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;IACrE,MAAM,kBAAkB,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACrD,IAAI,kBAAkB,KAAK,SAAS;QAAE,QAAQ,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IACvF,MAAM,eAAe,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,eAAe,KAAK,SAAS;QAAE,QAAQ,CAAC,eAAe,GAAG,eAAe,CAAC;IAC9E,MAAM,eAAe,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,eAAe,KAAK,SAAS;QAAE,QAAQ,CAAC,eAAe,GAAG,eAAe,CAAC;IAC9E,IAAI,cAAc,KAAK,SAAS;QAAE,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;IAC3E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gEAAgE;AAChE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IACtC,iBAAiB;IACjB,qBAAqB;IACrB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,MAA2B;IACrD,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,IAAc,EACd,GAAc;IAEd,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,2BAA2B,CACzC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EACjC,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;gBACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBACxE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;iBAC/E,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,2BAA2B,CACzC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EACjC,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;gBACF,0EAA0E;gBAC1E,EAAE,CACA,IAAI,EACJ,GAAG,CAAC,EAAE,EACN,MAAM,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACxD,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,kEAAkE;YAClE,wEAAwE;YACxE,mEAAmE;YACnE,mDAAmD;YACnD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,2BAA2B,CACzC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EACjC,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;gBACF,EAAE,CACA,IAAI,EACJ,GAAG,CAAC,EAAE,EACN,MAAM,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACpD,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,wEAAwE;YACxE,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,0EAA0E;YAC1E,oEAAoE;YACpE,8CAA8C;YAC9C,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;oBACnD,MAAM,sBAAsB,CAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EACrC,iCAAiC,GAAG,CAAC,IAAI,GAAG,CAC7C,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACzC,IAAI,KAAK,CAAC,UAAU,GAAG,oBAAoB,EAAE,CAAC;oBAC5C,MAAM,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;gBAC/F,CAAC;gBACD,MAAM,OAAO,GAAG,2BAA2B,CACzC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EACjC,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;gBACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAC7B,KAAK,EACL,kBAAkB,CAAC,GAAG,CAAC,CACxB,CAAC;gBACF,yCAAyC;gBACzC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,gEAAgE;YAChE,oDAAoD;YACpD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,2BAA2B,CACzC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EACjC,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;gBACF,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACxC,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC;gBACzC,IAAI,IAAI,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;oBACrC,MAAM,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;gBAClE,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC;gBACrC,IAAI,GAAG,CAAC,UAAU,GAAG,oBAAoB,EAAE,CAAC;oBAC1C,MAAM,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;gBACvE,CAAC;gBACD,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;oBACf,OAAO,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;oBAC3C,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,IAAI,EAAE,GAAG,CAAC,UAAU;iBACrB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,gEAAgE;YAChE,iCAAiC;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,2BAA2B,CACzC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EACjC,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;gBACF,MAAM,mBAAmB,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzD,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAE,GAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/serve/worker/host/studio.d.ts

@@ -0,0 +1,13 @@
+/**
+ * SharedWorker host — Pyric Studio control ops.
+ *
+ * The sandbox-snapshot export Studio forks for rules re-run (`getSnapshot`).
+ * Kept as its own family to mirror the client's `studio` module.
+ *
+ * Routed here by the host dispatcher. Never imports the dispatcher.
+ */
+import type { OpMessage } from '../protocol.js';
+import { type HostCtx, type PortLike } from '../host-context.js';
+export declare function isStudioOp(method: OpMessage['method']): boolean;
+export declare function handleStudioOp(ctx: HostCtx, port: PortLike, msg: OpMessage): void;
+//# sourceMappingURL=studio.d.ts.map

package/dist/serve/worker/host/studio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"studio.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/host/studio.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAY,MAAM,oBAAoB,CAAC;AAO3E,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,OAAO,CAE/D;AAED,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,SAAS,GACb,IAAI,CAaN"}

package/dist/serve/worker/host/studio.js

@@ -0,0 +1,30 @@
+/**
+ * SharedWorker host — Pyric Studio control ops.
+ *
+ * The sandbox-snapshot export Studio forks for rules re-run (`getSnapshot`).
+ * Kept as its own family to mirror the client's `studio` module.
+ *
+ * Routed here by the host dispatcher. Never imports the dispatcher.
+ */
+import { ok, fail } from '../host-context.js';
+/** The Studio control op methods routed to {@link handleStudioOp}. */
+const STUDIO_METHODS = new Set([
+    'getSnapshot',
+]);
+export function isStudioOp(method) {
+    return STUDIO_METHODS.has(method);
+}
+export function handleStudioOp(ctx, port, msg) {
+    switch (msg.method) {
+        case 'getSnapshot': {
+            // Export the current sandbox snapshot (Pyric Studio rules re-run): Studio
+            // forks it locally to test edited rules / re-issue as the user on a branch.
+            ok(port, msg.id, ctx.sandbox.snapshot());
+            break;
+        }
+        default: {
+            fail(port, msg.id, new Error(`Unknown method: ${String(msg.method)}`));
+        }
+    }
+}
+//# sourceMappingURL=studio.js.map

package/dist/serve/worker/host/studio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"studio.js","sourceRoot":"","sources":["../../../../src/serve/worker/host/studio.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAA+B,EAAE,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE3E,sEAAsE;AACtE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,UAAU,UAAU,CAAC,MAA2B;IACpD,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAY,EACZ,IAAc,EACd,GAAc;IAEd,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,0EAA0E;YAC1E,4EAA4E;YAC5E,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzC,MAAM;QACR,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAE,GAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/serve/worker/host/subscriptions.d.ts

@@ -0,0 +1,21 @@
+/**
+ * SharedWorker host — Firestore + RTDB value-subscription registry.
+ *
+ * `onSnapshot` / RTDB `onValue` listeners registered against the op's
+ * lens-resolved handle, with cross-port snapshot fan-out. Owns the
+ * session-bound sub registry (#754) that re-establishes a port's lens-less
+ * listeners under its NEW identity on every auth transition, mirroring prod's
+ * stream re-establishment (a sign-out re-evaluates live listeners so an
+ * auth-gated stream loses access instead of leaking the previous user's data).
+ *
+ * Routed here by the host dispatcher. Never imports the dispatcher.
+ */
+import type { FirestoreSubMessage, RtdbValueSubMessage, UnsubMessage } from '../protocol.js';
+import { type HostCtx, type PortLike } from '../host-context.js';
+/** Drop a port's session-bound sub records — invoked by the dispatcher's
+ *  `cleanupPort` on port disconnect. */
+export declare function dropPortSessionSubs(ctx: HostCtx, port: PortLike): void;
+export declare function handleSub(ctx: HostCtx, port: PortLike, msg: FirestoreSubMessage): void;
+export declare function handleRtdbSub(ctx: HostCtx, port: PortLike, msg: RtdbValueSubMessage): void;
+export declare function handleUnsub(ctx: HostCtx, port: PortLike, msg: UnsubMessage): void;
+//# sourceMappingURL=subscriptions.d.ts.map

package/dist/serve/worker/host/subscriptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/host/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE7F,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAQ,MAAM,oBAAoB,CAAC;AA4BvE;wCACwC;AACxC,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,CAEtE;AA2BD,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAiCtF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAoB1F;AAoDD,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,GAAG,IAAI,CAWjF"}

package/dist/serve/worker/host/subscriptions.js

@@ -0,0 +1,162 @@
+/**
+ * SharedWorker host — Firestore + RTDB value-subscription registry.
+ *
+ * `onSnapshot` / RTDB `onValue` listeners registered against the op's
+ * lens-resolved handle, with cross-port snapshot fan-out. Owns the
+ * session-bound sub registry (#754) that re-establishes a port's lens-less
+ * listeners under its NEW identity on every auth transition, mirroring prod's
+ * stream re-establishment (a sign-out re-evaluates live listeners so an
+ * auth-gated stream loses access instead of leaking the previous user's data).
+ *
+ * Routed here by the host dispatcher. Never imports the dispatcher.
+ */
+import { onSnapshot, } from 'pyric/firestore';
+import { ref as rtdbRef, onValue as rtdbOnValue, } from 'pyric/database';
+import { serializeError, isRtdbSub } from '../protocol.js';
+import { post } from '../host-context.js';
+import { lensDb, sessionDb, lensRtdb, resolveTarget, serializeDocSnap } from './core.js';
+import { rtdbSnapToWire } from './rtdb.js';
+const _sessionSubs = new WeakMap();
+function sessionSubsFor(ctx, port) {
+    let byPort = _sessionSubs.get(ctx);
+    if (!byPort) {
+        byPort = new Map();
+        _sessionSubs.set(ctx, byPort);
+    }
+    let bySubId = byPort.get(port);
+    if (!bySubId) {
+        bySubId = new Map();
+        byPort.set(port, bySubId);
+    }
+    return bySubId;
+}
+/** Drop a port's session-bound sub records — invoked by the dispatcher's
+ *  `cleanupPort` on port disconnect. */
+export function dropPortSessionSubs(ctx, port) {
+    _sessionSubs.get(ctx)?.delete(port);
+}
+/**
+ * Re-establish a port's session-bound listeners under its CURRENT session —
+ * invoked (via the ctx hook) on every port session change. Mirrors prod's
+ * stream re-establishment on auth transitions: each listener is torn down and
+ * re-registered through `sessionDb`, so the fresh evaluation either delivers
+ * a snapshot (allowed) or a `permission-denied` snap-error (revoked). A
+ * signed-out page no longer keeps receiving auth-gated data.
+ */
+function resubscribeSessionSubs(ctx, port) {
+    const bound = _sessionSubs.get(ctx)?.get(port);
+    if (!bound || bound.size === 0)
+        return;
+    const portSubs = ctx.subs.get(port);
+    for (const [subId, msg] of [...bound]) {
+        const unsub = portSubs?.get(subId);
+        if (unsub)
+            unsub();
+        portSubs?.delete(subId);
+        bound.delete(subId); // handleSub/handleRtdbSub re-records it
+        if (isRtdbSub(msg)) {
+            handleRtdbSub(ctx, port, msg);
+        }
+        else {
+            handleSub(ctx, port, msg);
+        }
+    }
+}
+export function handleSub(ctx, port, msg) {
+    // Resolve the listener's data handle through the SAME lens path ops use
+    // (Pyric Studio F4 "watch as user"): `{ mode: 'as', uid }` registers the
+    // listener as that user so its rule evals impersonate, `{ mode: 'admin' }`
+    // bypasses rules. Absent ⇒ the PORT'S SESSION (#754), so an app listener
+    // evaluates rules as whoever this tab signed in as.
+    const db = msg.actAs ? lensDb(ctx, msg.actAs) : sessionDb(ctx, port);
+    ensurePortSubs(ctx, port);
+    const portSubs = ctx.subs.get(port);
+    if (portSubs.has(msg.subId))
+        return; // idempotent
+    // Session-bound listeners re-establish on this port's auth transitions.
+    if (!msg.actAs) {
+        ctx.resubscribePortSubs ??= (p) => resubscribeSessionSubs(ctx, p);
+        sessionSubsFor(ctx, port).set(msg.subId, msg);
+    }
+    let target;
+    let unsub;
+    try {
+        target = resolveTarget(db, msg.target);
+        unsub = registerListener(ctx, port, msg, target);
+    }
+    catch (e) {
+        // resolveTarget / onSnapshot can throw synchronously (e.g. an invalid
+        // query or a rules-rejected target). Deliver it to the client's onSnapshot
+        // error callback as a snap-error instead of letting it escape handleMessage
+        // as an unhandled rejection (which would silently deliver NOTHING).
+        post(port, { t: 'snap', subId: msg.subId, value: { __error: serializeError(e) } });
+        return;
+    }
+    portSubs.set(msg.subId, unsub);
+}
+export function handleRtdbSub(ctx, port, msg) {
+    ensurePortSubs(ctx, port);
+    const portSubs = ctx.subs.get(port);
+    if (portSubs.has(msg.subId))
+        return;
+    if (!msg.actAs) {
+        ctx.resubscribePortSubs ??= (p) => resubscribeSessionSubs(ctx, p);
+        sessionSubsFor(ctx, port).set(msg.subId, msg);
+    }
+    try {
+        const ref = rtdbRef(lensRtdb(ctx, msg.actAs, port), msg.target.path);
+        const unsub = rtdbOnValue(ref, (snap) => post(port, { t: 'snap', subId: msg.subId, value: rtdbSnapToWire(snap) }));
+        portSubs.set(msg.subId, unsub);
+    }
+    catch (e) {
+        post(port, { t: 'snap', subId: msg.subId, value: { __error: serializeError(e) } });
+    }
+}
+/** Register the real sandbox listener for a resolved target; returns its unsub.
+ *  Split out of handleSub so the throwing surface (resolveTarget + onSnapshot)
+ *  is inside handleSub's try/catch. */
+function registerListener(_ctx, port, msg, target) {
+    return onSnapshot(target, (snap) => {
+        // Detect doc vs query snapshot by shape.
+        const snapAny = snap;
+        if (Array.isArray(snapAny.docs)) {
+            // Query snapshot
+            const docs = snapAny.docs.map((d) => serializeDocSnap(d));
+            post(port, { t: 'snap', subId: msg.subId, value: { docs } });
+        }
+        else if (snapAny.id !== undefined) {
+            // Doc snapshot
+            post(port, {
+                t: 'snap',
+                subId: msg.subId,
+                value: serializeDocSnap(snapAny),
+            });
+        }
+    }, (err) => {
+        // Snapshot listener error (e.g. rules changed to deny).
+        // We forward as a snap with an __error field so the client can
+        // surface it to the original onSnapshot error callback.
+        post(port, { t: 'snap', subId: msg.subId, value: { __error: serializeError(err) } });
+    });
+}
+export function handleUnsub(ctx, port, msg) {
+    // Drop the session-bound record first — even when the live listener never
+    // registered (it errored at sub time), the record must not resurrect the
+    // sub on a later session change.
+    _sessionSubs.get(ctx)?.get(port)?.delete(msg.subId);
+    const portSubs = ctx.subs.get(port);
+    if (!portSubs)
+        return;
+    const unsub = portSubs.get(msg.subId);
+    if (!unsub)
+        return;
+    unsub();
+    portSubs.delete(msg.subId);
+}
+// ─── Internal helpers ─────────────────────────────────────────────────────
+function ensurePortSubs(ctx, port) {
+    if (!ctx.subs.has(port)) {
+        ctx.subs.set(port, new Map());
+    }
+}
+//# sourceMappingURL=subscriptions.js.map

package/dist/serve/worker/host/subscriptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscriptions.js","sourceRoot":"","sources":["../../../../src/serve/worker/host/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,UAAU,GAIX,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,GAAG,IAAI,OAAO,EACd,OAAO,IAAI,WAAW,GAEvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAA+B,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAU3C,MAAM,YAAY,GAAG,IAAI,OAAO,EAA+D,CAAC;AAEhG,SAAS,cAAc,CAAC,GAAY,EAAE,IAAc;IAClD,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACnB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;wCACwC;AACxC,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,IAAc;IAC9D,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,GAAY,EAAE,IAAc;IAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,KAAK;YAAE,KAAK,EAAE,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,wCAAwC;QAC7D,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAY,EAAE,IAAc,EAAE,GAAwB;IAC9E,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;IAErC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,aAAa;IAElD,wEAAwE;IACxE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,mBAAmB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,MAAuD,CAAC;IAC5D,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,sEAAsE;QACtE,2EAA2E;QAC3E,4EAA4E;QAC5E,oEAAoE;QACpE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,IAAc,EAAE,GAAwB;IAClF,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IAEpC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,mBAAmB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,WAAW,CACvB,GAAwB,EACxB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CACnF,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;uCAEuC;AACvC,SAAS,gBAAgB,CACvB,IAAa,EACb,IAAc,EACd,GAAwB,EACxB,MAAuD;IAEvD,OAAO,UAAU,CACf,MAAmC,EACnC,CAAC,IAAI,EAAE,EAAE;QACP,yCAAyC;QACzC,MAAM,OAAO,GAAG,IAWf,CAAC;QAEF,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,iBAAiB;YACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,gBAAgB,CAAC,CAA2C,CAAC,CAC9D,CAAC;YACF,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YACpC,eAAe;YACf,IAAI,CAAC,IAAI,EAAE;gBACT,CAAC,EAAE,MAAM;gBACT,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,gBAAgB,CAAC,OAAiD,CAAC;aAC3E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;QACN,wDAAwD;QACxD,+DAA+D;QAC/D,wDAAwD;QACxD,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,IAAc,EAAE,GAAiB;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,iCAAiC;IACjC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,KAAK,EAAE,CAAC;IACR,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,6EAA6E;AAE7E,SAAS,cAAc,CAAC,GAAY,EAAE,IAAc;IAClD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAChC,CAAC;AACH,CAAC"}

package/dist/serve/worker/host-ai.d.ts

@@ -0,0 +1,59 @@
+/**
+ * SharedWorker host — AI op + stream-subscription handlers (pyric/ai).
+ *
+ * Implements cdd-deltas "Where the engines live under pyric dev (#98)":
+ *
+ *   1. The broker and engines run IN-PROCESS with the sandbox — here, in the
+ *      worker host. The scripted engine does no I/O anywhere.
+ *   2. The openai engine's default base URL in this (browser) context is the
+ *      same-origin `/__pyric/ai-proxy` route, so a localhost upstream (Ollama)
+ *      needs no CORS setup. Relative URLs resolve against the worker script's
+ *      origin, so the plain path works from inside the SharedWorker.
+ *   3. `ai.generateContent` / `ai.countTokens` are unary ops exactly like
+ *      `rtdb.*` / `auth.*`; `ai.streamGenerateContent` is a FINITE
+ *      subscription that delivers `{ chunk }` snaps in order, then a terminal
+ *      `{ done: true }` snap and auto-unsubscribes (see AiStreamSubMessage).
+ *   4. Engine choice + model mapping are per-sandbox config: the broker is
+ *      recovered from `getAI(ctx.sandbox, …)` (the mirror's OWN per-sandbox
+ *      broker — its events land on the shared sandbox's unified stream), and
+ *      is created ONCE — host config (`ctx.aiEngine`) wins over the first
+ *      op's `engine` field; later configs are ignored, mirroring `getAI`'s
+ *      first-call-wins idempotence.
+ *
+ * Decomposition mirrors host-auth.ts / host-events.ts: host.ts routes
+ * `ai.*` ops and `{ service: 'ai' }` subs here; this module never imports
+ * host.ts (no cycles — it leans only on the host-context foundation).
+ */
+import { type OpMessage, type AiStreamSubMessage, type AiEngineConfigWire } from './protocol.js';
+import { type HostCtx, type PortLike, type AiBrokerLike } from './host-context.js';
+/** The serve proxy route the browser openai engine defaults to (#98.2). */
+export declare const AI_PROXY_PATH = "/__pyric/ai-proxy";
+/** Is this op an AI op (routed here instead of handleOp)? */
+export declare function isAiOp(method: OpMessage['method']): boolean;
+/**
+ * The sandbox's AiBroker, created once per worker lifetime. `getAI` is
+ * idempotent per sandbox+backend, so this IS the mirror's broker — a page
+ * embedding host and this handler resolve the same instance, and every
+ * broker op lands `service: 'ai'` events on the shared sandbox's unified
+ * event stream (what Studio consumes).
+ *
+ * `AiBroker` is not exported from `pyric/ai`'s public surface; the instance
+ * is recovered from the branded handle via the exported `TARGET_SYMBOL`
+ * (the mirror's own dispatch seam).
+ */
+export declare function ensureAiBroker(ctx: HostCtx, opEngine?: AiEngineConfigWire): AiBrokerLike;
+/** Handle the unary AI ops. Requests/replies are plain Gemini-wire JSON. */
+export declare function handleAiOp(ctx: HostCtx, port: PortLike, msg: OpMessage): Promise<void>;
+/**
+ * Handle an AI stream subscription: pump the broker's chunk stream to the
+ * port as `{ chunk }` snaps IN ORDER, then post the terminal `{ done: true }`
+ * snap and drop the sub (finite — auto-unsub on done). The pump is detached
+ * (sub handling is synchronous, like the other sub handlers); a client
+ * `unsub` mid-stream flips the registered cancel and delivery stops.
+ *
+ * Broker validation runs eagerly inside `streamGenerateContent` (before
+ * iteration) — either way a throw lands as the shared `{ __error }` snap
+ * convention, terminal for this sub.
+ */
+export declare function handleAiSub(ctx: HostCtx, port: PortLike, msg: AiStreamSubMessage): void;
+//# sourceMappingURL=host-ai.d.ts.map

package/dist/serve/worker/host-ai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-ai.d.ts","sourceRoot":"","sources":["../../../src/serve/worker/host-ai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAAkB,KAAK,SAAS,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACjH,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,YAAY,EAAkB,MAAM,mBAAmB,CAAC;AAEnG,2EAA2E;AAC3E,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAEjD,6DAA6D;AAC7D,wBAAgB,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,OAAO,CAE3D;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,YAAY,CAaxF;AAED,4EAA4E;AAC5E,wBAAsB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAmCvF"}