@pyric/cli 0.1.0-alpha.10

package/dist/conformance/browser.d.ts

@@ -0,0 +1,7 @@
+import { type BrowserFeatureSupport, type CanIUseOptions } from './.generated/can-i-use-browser.js';
+export { createCanIUseTool, type CanIUseToolOptions } from './can-i-use-tool.js';
+export type { Assurance, Availability, BrowserFeatureSupport, CanIUseMatch, CanIUseOptions, CanIUseResult, DeveloperSurface, Fidelity, } from './.generated/can-i-use-browser.js';
+/** Query the compact browser projection. Full claims and evidence remain on
+ * the Node-only `@pyric/cli/conformance` entry point. */
+export declare function canIUse(query: string, options?: CanIUseOptions): import("./browser.js").CanIUseResult<BrowserFeatureSupport>;
+//# sourceMappingURL=browser.d.ts.map

package/dist/conformance/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/conformance/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACpB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACjF,YAAY,EACV,SAAS,EACT,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,QAAQ,GACT,MAAM,mCAAmC,CAAC;AAE3C;yDACyD;AACzD,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,+DAE9D"}

package/dist/conformance/browser.js

@@ -0,0 +1,8 @@
+import { CONFORMANCE_SUPPORTS, resolveCanIUse, } from './.generated/can-i-use-browser.js';
+export { createCanIUseTool } from './can-i-use-tool.js';
+/** Query the compact browser projection. Full claims and evidence remain on
+ * the Node-only `@pyric/cli/conformance` entry point. */
+export function canIUse(query, options) {
+    return resolveCanIUse(CONFORMANCE_SUPPORTS, query, options);
+}
+//# sourceMappingURL=browser.js.map

package/dist/conformance/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/conformance/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,cAAc,GAGf,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAC;AAYjF;yDACyD;AACzD,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,OAAwB;IAC7D,OAAO,cAAc,CAAwB,oBAAoB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACrF,CAAC"}

package/dist/conformance/can-i-use-tool.d.ts

@@ -0,0 +1,21 @@
+import type { ToolHandler } from '@inbrowser/agent';
+interface CanIUseResultLike {
+    match: 'exact' | 'ambiguous' | 'suggestions' | 'none';
+    supports: readonly {
+        summary: string;
+    }[];
+}
+export interface CanIUseToolOptions<R extends CanIUseResultLike> {
+    description: string;
+    featureDescription: string;
+    importPathDescription: string;
+    query: (feature: string, options: {
+        importPath?: string;
+    }) => R;
+}
+/** The one authored pyric_can_i_use handler shape. Node and browser agents
+ * differ only in the query they pass in, so match semantics, argument
+ * validation, and summaries cannot drift between surfaces. */
+export declare function createCanIUseTool<R extends CanIUseResultLike>(options: CanIUseToolOptions<R>): ToolHandler;
+export {};
+//# sourceMappingURL=can-i-use-tool.d.ts.map

package/dist/conformance/can-i-use-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"can-i-use-tool.d.ts","sourceRoot":"","sources":["../../src/conformance/can-i-use-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,UAAU,iBAAiB;IACzB,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,aAAa,GAAG,MAAM,CAAC;IACtD,QAAQ,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,iBAAiB;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,CAAC,CAAC;CACjE;AASD;;8DAE8D;AAC9D,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,WAAW,CA0B1G"}

package/dist/conformance/can-i-use-tool.js

@@ -0,0 +1,40 @@
+function resultSummary(result) {
+    if (result.match === 'none')
+        return 'No conformance feature matched that query';
+    if (result.match === 'suggestions')
+        return `No exact match; found ${result.supports.length} deterministic suggestions`;
+    if (result.match === 'ambiguous')
+        return `Found ${result.supports.length} exact matches across surfaces`;
+    return result.supports[0].summary;
+}
+/** The one authored pyric_can_i_use handler shape. Node and browser agents
+ * differ only in the query they pass in, so match semantics, argument
+ * validation, and summaries cannot drift between surfaces. */
+export function createCanIUseTool(options) {
+    return {
+        name: 'pyric_can_i_use',
+        description: options.description,
+        parameters: {
+            type: 'object',
+            properties: {
+                feature: { type: 'string', description: options.featureDescription },
+                importPath: { type: 'string', description: options.importPathDescription },
+            },
+            required: ['feature'],
+        },
+        async execute(args) {
+            const { feature, importPath } = args;
+            if (typeof feature !== 'string' || feature.trim() === '') {
+                return { ok: false, summary: 'pyric_can_i_use requires a non-empty feature name' };
+            }
+            if (importPath !== undefined && (typeof importPath !== 'string' || importPath.trim() === '')) {
+                return { ok: false, summary: 'pyric_can_i_use importPath must be a non-empty string when provided' };
+            }
+            const result = options.query(feature, {
+                importPath: typeof importPath === 'string' ? importPath : undefined,
+            });
+            return { ok: result.match === 'exact', summary: resultSummary(result), data: result };
+        },
+    };
+}
+//# sourceMappingURL=can-i-use-tool.js.map

package/dist/conformance/can-i-use-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"can-i-use-tool.js","sourceRoot":"","sources":["../../src/conformance/can-i-use-tool.ts"],"names":[],"mappings":"AAcA,SAAS,aAAa,CAAC,MAAyB;IAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM;QAAE,OAAO,2CAA2C,CAAC;IAChF,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa;QAAE,OAAO,yBAAyB,MAAM,CAAC,QAAQ,CAAC,MAAM,4BAA4B,CAAC;IACvH,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW;QAAE,OAAO,SAAS,MAAM,CAAC,QAAQ,CAAC,MAAM,gCAAgC,CAAC;IACzG,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;AACrC,CAAC;AAED;;8DAE8D;AAC9D,MAAM,UAAU,iBAAiB,CAA8B,OAA8B;IAC3F,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,kBAAkB,EAAE;gBACpE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,qBAAqB,EAAE;aAC3E;YACD,QAAQ,EAAE,CAAC,SAAS,CAAC;SACtB;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAmD,CAAC;YACpF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC;YACrF,CAAC;YACD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBAC7F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qEAAqE,EAAE,CAAC;YACvG,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE;gBACpC,UAAU,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;aACpE,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/conformance/can-i-use.d.ts

@@ -0,0 +1,6 @@
+import { type CanIUseOptions, type FeatureSupport } from './.generated/can-i-use.js';
+/** Query the generated, build-time conformance support projection. */
+export declare function canIUse(query: string, options?: CanIUseOptions): import("./index.js").CanIUseResult<FeatureSupport>;
+/** Find the generated compatibility-page evidence for a published import. */
+export declare function canIUseImport(importPath: string): import("./index.js").ImportEvidence | undefined;
+//# sourceMappingURL=can-i-use.d.ts.map

package/dist/conformance/can-i-use.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"can-i-use.d.ts","sourceRoot":"","sources":["../../src/conformance/can-i-use.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAC;AAEnC,sEAAsE;AACtE,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,sDAE9D;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,mDAE/C"}

package/dist/conformance/can-i-use.js

@@ -0,0 +1,10 @@
+import { CONFORMANCE_IMPORT_EVIDENCE, CONFORMANCE_SUPPORTS, resolveCanIUse, resolveImportEvidence, } from './.generated/can-i-use.js';
+/** Query the generated, build-time conformance support projection. */
+export function canIUse(query, options) {
+    return resolveCanIUse(CONFORMANCE_SUPPORTS, query, options);
+}
+/** Find the generated compatibility-page evidence for a published import. */
+export function canIUseImport(importPath) {
+    return resolveImportEvidence(CONFORMANCE_IMPORT_EVIDENCE, importPath);
+}
+//# sourceMappingURL=can-i-use.js.map

package/dist/conformance/can-i-use.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"can-i-use.js","sourceRoot":"","sources":["../../src/conformance/can-i-use.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,cAAc,EACd,qBAAqB,GAGtB,MAAM,2BAA2B,CAAC;AAEnC,sEAAsE;AACtE,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,OAAwB;IAC7D,OAAO,cAAc,CAAiB,oBAAoB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,qBAAqB,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAC;AACxE,CAAC"}

package/dist/conformance/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Query Pyric's build-time conformance model by developer-facing feature name.
+ * Results keep availability, behavior fidelity, and assurance eligibility as
+ * separate trust axes.
+ */
+export { type Assurance, type Availability, type DeveloperSurface, type FeatureClaim, type FeatureClaimKind, type FeatureSupport, type Fidelity, type ImportEvidence, type CanIUseMatch, type CanIUseOptions, type CanIUseResult, } from './.generated/can-i-use.js';
+export { canIUse, canIUseImport } from './can-i-use.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/conformance/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/conformance/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/conformance/index.js

@@ -0,0 +1,2 @@
+export { canIUse, canIUseImport } from './can-i-use.js';
+//# sourceMappingURL=index.js.map

package/dist/conformance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/conformance/index.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/conformance/tools.d.ts

@@ -0,0 +1,4 @@
+import type { ToolHandler } from '@inbrowser/agent';
+/** Node-only conformance tools. The richer model never enters a browser bundle. */
+export declare function createConformanceTools(): ToolHandler[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/conformance/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/conformance/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIpD,mFAAmF;AACnF,wBAAgB,sBAAsB,IAAI,WAAW,EAAE,CAUtD"}

package/dist/conformance/tools.js

@@ -0,0 +1,14 @@
+import { createCanIUseTool } from './can-i-use-tool.js';
+import { CONFORMANCE_SUPPORTS, resolveCanIUse } from './.generated/can-i-use.js';
+/** Node-only conformance tools. The richer model never enters a browser bundle. */
+export function createConformanceTools() {
+    return [
+        createCanIUseTool({
+            description: 'Check whether Pyric can support a developer-facing Firebase feature. Reports availability, behavior fidelity, and assurance eligibility separately, with caveats and auditable claims. Exact names resolve first; fuzzy names return deterministic candidates.',
+            featureDescription: 'Developer feature name, optionally prefixed by a surface (for example firestore-rules/getAfter).',
+            importPathDescription: 'Optional published import path that must expose the feature (for example pyric/storage).',
+            query: (feature, options) => resolveCanIUse(CONFORMANCE_SUPPORTS, feature, options),
+        }),
+    ];
+}
+//# sourceMappingURL=tools.js.map

package/dist/conformance/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/conformance/tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAuB,MAAM,2BAA2B,CAAC;AAEtG,mFAAmF;AACnF,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,iBAAiB,CAAC;YAChB,WAAW,EACT,gQAAgQ;YAClQ,kBAAkB,EAAE,kGAAkG;YACtH,qBAAqB,EAAE,0FAA0F;YACjH,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAiB,oBAAoB,EAAE,OAAO,EAAE,OAAO,CAAC;SACpG,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/credentials/core/memoize-ttl.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Host-side caching wrapper for credential resolvers.
+ *
+ * Per F4, the SDK convention is "resolvers fire per-dispatch; hosts
+ * memoize via `memoizeTtl` if cost matters." This is that memoizer.
+ *
+ * Default behavior (locked in v4.1):
+ * - Parse `expires_in` from the resolved token's claims when the
+ *   resolver returns an object whose shape carries it.
+ * - Refresh proactively at **90% of TTL** — gives the next caller a
+ *   fresh token before the in-flight window hits expiry.
+ * - Accept an explicit `ttlMs` override when the resolver doesn't
+ *   surface `expires_in` (rare; tests, mock tokens).
+ *
+ * Two shapes supported:
+ *
+ * 1. **Plain string resolver** — `() => Promise<string>`. Caller
+ *    must supply `ttlMs` (the SDK can't infer TTL from an opaque
+ *    string).
+ * 2. **Structured token resolver** — `() => Promise<{ token: string;
+ *    expiresIn?: number }>`. `expiresIn` is parsed as seconds; the
+ *    memoizer refreshes at 90% of that. Callers can still pass
+ *    `ttlMs` to override.
+ */
+export interface MemoizeTtlOptions {
+    /** Explicit TTL in milliseconds. Required for plain-string
+     *  resolvers; optional override for structured-token resolvers
+     *  (defaults to 90% of `expiresIn`). */
+    ttlMs?: number;
+    /** Fraction of TTL to use as the refresh window. Default 0.9. */
+    refreshAtFraction?: number;
+    /**
+     * Per-attempt timeout (ms) on the underlying resolver. Default
+     * 30_000 (30 seconds). If the resolver hangs longer than this,
+     * the in-flight wait rejects with a timeout error and the next
+     * caller can retry afresh — prevents a wedged resolver from
+     * deadlocking every subsequent call.
+     */
+    resolverTimeoutMs?: number;
+}
+/**
+ * Wrap a plain string-returning resolver with TTL memoization.
+ * Callers must supply `ttlMs` since opaque strings carry no
+ * expiry information.
+ */
+export declare function memoizeTtl(resolver: () => Promise<string>, opts: MemoizeTtlOptions & {
+    ttlMs: number;
+}): () => Promise<string>;
+/**
+ * Wrap a structured-token resolver with TTL memoization. The
+ * memoizer parses `expiresIn` (seconds) from the resolver's return
+ * value and refreshes at 90% of TTL by default.
+ */
+export declare function memoizeTtl(resolver: () => Promise<{
+    token: string;
+    expiresIn?: number;
+}>, opts?: MemoizeTtlOptions): () => Promise<string>;
+//# sourceMappingURL=memoize-ttl.d.ts.map

package/dist/credentials/core/memoize-ttl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoize-ttl.d.ts","sourceRoot":"","sources":["../../../src/credentials/core/memoize-ttl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AASH,MAAM,WAAW,iBAAiB;IAChC;;4CAEwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAC/B,IAAI,EAAE,iBAAiB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAEzB;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9D,IAAI,CAAC,EAAE,iBAAiB,GACvB,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC"}

package/dist/credentials/core/memoize-ttl.js

@@ -0,0 +1,88 @@
+/**
+ * Host-side caching wrapper for credential resolvers.
+ *
+ * Per F4, the SDK convention is "resolvers fire per-dispatch; hosts
+ * memoize via `memoizeTtl` if cost matters." This is that memoizer.
+ *
+ * Default behavior (locked in v4.1):
+ * - Parse `expires_in` from the resolved token's claims when the
+ *   resolver returns an object whose shape carries it.
+ * - Refresh proactively at **90% of TTL** — gives the next caller a
+ *   fresh token before the in-flight window hits expiry.
+ * - Accept an explicit `ttlMs` override when the resolver doesn't
+ *   surface `expires_in` (rare; tests, mock tokens).
+ *
+ * Two shapes supported:
+ *
+ * 1. **Plain string resolver** — `() => Promise<string>`. Caller
+ *    must supply `ttlMs` (the SDK can't infer TTL from an opaque
+ *    string).
+ * 2. **Structured token resolver** — `() => Promise<{ token: string;
+ *    expiresIn?: number }>`. `expiresIn` is parsed as seconds; the
+ *    memoizer refreshes at 90% of that. Callers can still pass
+ *    `ttlMs` to override.
+ */
+export function memoizeTtl(resolver, opts = {}) {
+    let entry = null;
+    let inFlight = null;
+    const fraction = opts.refreshAtFraction ?? 0.9;
+    const timeoutMs = opts.resolverTimeoutMs ?? 30_000;
+    return async () => {
+        const now = Date.now();
+        if (entry && entry.refreshAt > now)
+            return entry.value;
+        // Coalesce concurrent refreshes — only one inflight at a time.
+        if (inFlight)
+            return inFlight;
+        inFlight = (async () => {
+            // Race the resolver against a timeout so a hung resolver
+            // can't wedge every subsequent caller. The timer is cleared
+            // either way so we don't keep the process alive.
+            let timerHandle;
+            const timeout = new Promise((_, reject) => {
+                timerHandle = setTimeout(() => {
+                    reject(new Error(`memoizeTtl: resolver did not complete within ${timeoutMs}ms`));
+                }, timeoutMs);
+            });
+            let raw;
+            try {
+                raw = await Promise.race([resolver(), timeout]);
+            }
+            finally {
+                if (timerHandle !== undefined)
+                    clearTimeout(timerHandle);
+            }
+            let token;
+            let ttlMs;
+            if (typeof raw === 'string') {
+                token = raw;
+                if (opts.ttlMs === undefined) {
+                    throw new Error('memoizeTtl: plain-string resolver requires explicit ttlMs');
+                }
+                ttlMs = opts.ttlMs;
+            }
+            else {
+                token = raw.token;
+                ttlMs =
+                    opts.ttlMs ??
+                        (raw.expiresIn !== undefined
+                            ? raw.expiresIn * 1000
+                            : (() => {
+                                throw new Error('memoizeTtl: structured-token resolver returned no expiresIn; pass an explicit ttlMs');
+                            })());
+            }
+            entry = {
+                value: token,
+                refreshAt: Date.now() + Math.floor(ttlMs * fraction),
+            };
+            return token;
+        })();
+        try {
+            return await inFlight;
+        }
+        finally {
+            inFlight = null;
+        }
+    };
+}
+//# sourceMappingURL=memoize-ttl.js.map

package/dist/credentials/core/memoize-ttl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoize-ttl.js","sourceRoot":"","sources":["../../../src/credentials/core/memoize-ttl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA8CH,MAAM,UAAU,UAAU,CACxB,QAE0D,EAC1D,OAA0B,EAAE;IAE5B,IAAI,KAAK,GAAyB,IAAI,CAAC;IACvC,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,GAAG,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC;IAEnD,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;QACvD,+DAA+D;QAC/D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YACrB,yDAAyD;YACzD,4DAA4D;YAC5D,iDAAiD;YACjD,IAAI,WAAsD,CAAC;YAC3D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/C,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,MAAM,CACJ,IAAI,KAAK,CACP,gDAAgD,SAAS,IAAI,CAC9D,CACF,CAAC;gBACJ,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,IAAI,GAAmD,CAAC;YACxD,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YAClD,CAAC;oBAAS,CAAC;gBACT,IAAI,WAAW,KAAK,SAAS;oBAAE,YAAY,CAAC,WAAW,CAAC,CAAC;YAC3D,CAAC;YAED,IAAI,KAAa,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,KAAK,GAAG,GAAG,CAAC;gBACZ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;gBACJ,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;gBAClB,KAAK;oBACH,IAAI,CAAC,KAAK;wBACV,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS;4BAC1B,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI;4BACtB,CAAC,CAAC,CAAC,GAAG,EAAE;gCACJ,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;4BACJ,CAAC,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;YACD,KAAK,GAAG;gBACN,KAAK,EAAE,KAAK;gBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC;aACrD,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/credentials/core/types.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Project identity plus a fresh-enough Google OAuth token resolver.
+ *
+ * The identity is stable for the lifetime of an operation while token
+ * acquisition remains lazy so long-running commands can refresh credentials.
+ */
+export interface ProjectScope {
+    readonly projectId: string;
+    resolveToken(): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/credentials/core/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/credentials/core/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC"}

package/dist/credentials/core/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/credentials/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/credentials/core/types.ts"],"names":[],"mappings":""}

package/dist/credentials/node/from-adc.d.ts

@@ -0,0 +1,10 @@
+import type { ProjectScope } from '../core/types.js';
+/** The well-known ADC file path (honours CLOUDSDK_CONFIG; %APPDATA% on Windows). */
+export declare function adcWellKnownPath(env?: NodeJS.ProcessEnv): string;
+/**
+ * Build a `ProjectScope` from ADC, or `null` if no ADC file is present. The
+ * project is supplied by the caller — an ADC user credential isn't bound to one
+ * (`--project` / `.firebaserc`).
+ */
+export declare function fromAdc(projectId: string, env?: NodeJS.ProcessEnv, path?: string): Promise<ProjectScope | null>;
+//# sourceMappingURL=from-adc.d.ts.map

package/dist/credentials/node/from-adc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-adc.d.ts","sourceRoot":"","sources":["../../../src/credentials/node/from-adc.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrD,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAK7E;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE,MAA8B,GACnC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAqC9B"}

package/dist/credentials/node/from-adc.js

@@ -0,0 +1,76 @@
+/**
+ * Application Default Credentials source — the gcloud / workload-identity path,
+ * the modern keyless alternative to a long-lived token. Reads the well-known ADC
+ * file (`gcloud auth application-default login`):
+ *   - `authorized_user` -> refresh-token grant (the common dev case).
+ *   - `service_account` -> delegate to `fromServiceAccount`.
+ * The metadata-server path (GCE / Cloud Run) is a separate fallback, not yet
+ * wired. Node-only (reads disk) -> lives in node/.
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { memoizeTtl } from '../core/memoize-ttl.js';
+import { fromServiceAccount } from './from-service-account.js';
+const GOOGLE_TOKEN_URI = 'https://oauth2.googleapis.com/token';
+/** The well-known ADC file path (honours CLOUDSDK_CONFIG; %APPDATA% on Windows). */
+export function adcWellKnownPath(env = process.env) {
+    const base = env.CLOUDSDK_CONFIG ??
+        (process.platform === 'win32' && env.APPDATA ? join(env.APPDATA, 'gcloud') : join(homedir(), '.config', 'gcloud'));
+    return join(base, 'application_default_credentials.json');
+}
+/**
+ * Build a `ProjectScope` from ADC, or `null` if no ADC file is present. The
+ * project is supplied by the caller — an ADC user credential isn't bound to one
+ * (`--project` / `.firebaserc`).
+ */
+export async function fromAdc(projectId, env = process.env, path = adcWellKnownPath(env)) {
+    let raw;
+    try {
+        raw = await readFile(path, 'utf-8');
+    }
+    catch {
+        return null; // no ADC file
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.type === 'authorized_user' && parsed.client_id && parsed.client_secret && parsed.refresh_token) {
+        const clientId = parsed.client_id;
+        const clientSecret = parsed.client_secret;
+        const refreshToken = parsed.refresh_token;
+        const resolveToken = memoizeTtl(async () => {
+            const { access_token, expires_in } = await exchangeAdcRefreshToken(clientId, clientSecret, refreshToken);
+            return { token: access_token, expiresIn: expires_in };
+        });
+        return Object.freeze({ projectId, resolveToken });
+    }
+    if (parsed.type === 'service_account') {
+        const sa = await fromServiceAccount(raw); // fromServiceAccount accepts a raw JSON string
+        return projectId && projectId !== sa.projectId
+            ? Object.freeze({ projectId, resolveToken: sa.resolveToken })
+            : sa;
+    }
+    return null; // unknown ADC type (e.g. external_account) — not supported here
+}
+async function exchangeAdcRefreshToken(clientId, clientSecret, refreshToken) {
+    const response = await fetch(GOOGLE_TOKEN_URI, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: clientId,
+            client_secret: clientSecret,
+            refresh_token: refreshToken,
+            grant_type: 'refresh_token',
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`pyric: Application Default Credentials token exchange failed (${response.status}): ${await response.text()}`);
+    }
+    return (await response.json());
+}
+//# sourceMappingURL=from-adc.js.map

package/dist/credentials/node/from-adc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-adc.js","sourceRoot":"","sources":["../../../src/credentials/node/from-adc.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAE/D,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,IAAI,GACR,GAAG,CAAC,eAAe;QACnB,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrH,OAAO,IAAI,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,SAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG,EACpC,OAAe,gBAAgB,CAAC,GAAG,CAAC;IAEpC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,cAAc;IAC7B,CAAC;IACD,IAAI,MAA6F,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1G,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,uBAAuB,CAChE,QAAQ,EACR,YAAY,EACZ,YAAY,CACb,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,+CAA+C;QACzF,OAAO,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC,SAAS;YAC5C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC;YAC7D,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,gEAAgE;AAC/E,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,QAAgB,EAChB,YAAoB,EACpB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,eAAe;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,iEAAiE,QAAQ,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiD,CAAC;AACjF,CAAC"}

package/dist/credentials/node/from-service-account.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Build a `ProjectScope` from a Google service
+ * account JSON file. Exchanges the SA key for a short-lived OAuth
+ * access token via the standard JWT-bearer flow, and wires
+ * `memoizeTtl` internally so consumers get caching for free.
+ *
+ * No `firebase-admin` dependency — uses only Node's built-in
+ * `crypto` for RS256 signing and `fetch` for the token exchange.
+ *
+ * **Node-only credential adapter**: the function itself requires
+ * `node:fs/promises` + `node:crypto`.
+ */
+import type { ProjectScope } from '../core/types.js';
+/**
+ * Read the service account from a JSON file and return a
+ * `ProjectScope` whose `resolveToken` is memoized internally.
+ *
+ * The JSON file path can be:
+ * - An absolute / relative filesystem path (Node only).
+ * - A base64-encoded JSON string (when prefixed with `base64:`),
+ *   for environments that ship the SA in an env var.
+ */
+export declare function fromServiceAccount(saJsonOrPath: string): Promise<ProjectScope>;
+//# sourceMappingURL=from-service-account.d.ts.map

package/dist/credentials/node/from-service-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-service-account.d.ts","sourceRoot":"","sources":["../../../src/credentials/node/from-service-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAsBrD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,YAAY,CAAC,CAcvB"}

package/dist/credentials/node/from-service-account.js

@@ -0,0 +1,108 @@
+/**
+ * Build a `ProjectScope` from a Google service
+ * account JSON file. Exchanges the SA key for a short-lived OAuth
+ * access token via the standard JWT-bearer flow, and wires
+ * `memoizeTtl` internally so consumers get caching for free.
+ *
+ * No `firebase-admin` dependency — uses only Node's built-in
+ * `crypto` for RS256 signing and `fetch` for the token exchange.
+ *
+ * **Node-only credential adapter**: the function itself requires
+ * `node:fs/promises` + `node:crypto`.
+ */
+import { memoizeTtl } from '../core/memoize-ttl.js';
+const GOOGLE_TOKEN_URI = 'https://oauth2.googleapis.com/token';
+const SCOPE = [
+    // Project verification and inspection use Firebase and Google Cloud APIs.
+    'https://www.googleapis.com/auth/firebase',
+    'https://www.googleapis.com/auth/cloud-platform',
+].join(' ');
+/**
+ * Read the service account from a JSON file and return a
+ * `ProjectScope` whose `resolveToken` is memoized internally.
+ *
+ * The JSON file path can be:
+ * - An absolute / relative filesystem path (Node only).
+ * - A base64-encoded JSON string (when prefixed with `base64:`),
+ *   for environments that ship the SA in an env var.
+ */
+export async function fromServiceAccount(saJsonOrPath) {
+    const sa = await loadServiceAccount(saJsonOrPath);
+    const resolveToken = memoizeTtl(async () => {
+        const { access_token, expires_in } = await exchangeJwtForAccessToken(sa);
+        return { token: access_token, expiresIn: expires_in };
+    });
+    // Freeze the returned scope so `projectId` can't be mutated at
+    // runtime. TS `readonly` is compile-time-only; Object.freeze
+    // enforces it at runtime — defense in depth for the
+    // security-relevant identity field.
+    return Object.freeze({
+        projectId: sa.project_id,
+        resolveToken,
+    });
+}
+async function loadServiceAccount(saJsonOrPath) {
+    let raw;
+    if (saJsonOrPath.startsWith('base64:')) {
+        raw = Buffer.from(saJsonOrPath.slice('base64:'.length), 'base64').toString('utf-8');
+    }
+    else if (saJsonOrPath.trim().startsWith('{')) {
+        raw = saJsonOrPath;
+    }
+    else {
+        // Dynamic import keeps `node:fs/promises` out of browser bundles
+        // when this function isn't called.
+        const { readFile } = await import('node:fs/promises');
+        raw = await readFile(saJsonOrPath, 'utf-8');
+    }
+    const parsed = JSON.parse(raw);
+    if (!parsed.client_email || !parsed.private_key || !parsed.project_id) {
+        throw new Error('fromServiceAccount: input is missing required fields (client_email, private_key, project_id)');
+    }
+    return parsed;
+}
+async function exchangeJwtForAccessToken(sa) {
+    const jwt = await buildSignedJwt(sa);
+    const res = await fetch(sa.token_uri ?? GOOGLE_TOKEN_URI, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+            assertion: jwt,
+        }).toString(),
+    });
+    if (!res.ok) {
+        throw new Error(`fromServiceAccount: token exchange failed (${res.status}): ${await res.text()}`);
+    }
+    return (await res.json());
+}
+async function buildSignedJwt(sa) {
+    // Dynamic import keeps `node:crypto` out of browser bundles when
+    // `fromServiceAccount` is never called.
+    const { createSign } = await import('node:crypto');
+    const now = Math.floor(Date.now() / 1000);
+    const header = { alg: 'RS256', typ: 'JWT' };
+    const claims = {
+        iss: sa.client_email,
+        scope: SCOPE,
+        aud: sa.token_uri ?? GOOGLE_TOKEN_URI,
+        exp: now + 3600,
+        iat: now,
+    };
+    const headerB64 = base64UrlEncode(JSON.stringify(header));
+    const claimsB64 = base64UrlEncode(JSON.stringify(claims));
+    const signingInput = `${headerB64}.${claimsB64}`;
+    const signer = createSign('RSA-SHA256');
+    signer.update(signingInput);
+    signer.end();
+    const signature = signer.sign(sa.private_key);
+    const signatureB64 = base64UrlEncodeBuffer(signature);
+    return `${signingInput}.${signatureB64}`;
+}
+function base64UrlEncode(s) {
+    return base64UrlEncodeBuffer(Buffer.from(s, 'utf-8'));
+}
+function base64UrlEncodeBuffer(b) {
+    return b.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+//# sourceMappingURL=from-service-account.js.map

package/dist/credentials/node/from-service-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-service-account.js","sourceRoot":"","sources":["../../../src/credentials/node/from-service-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,KAAK,GAAG;IACZ,0EAA0E;IAC1E,0CAA0C;IAC1C,gDAAgD;CACjD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAeZ;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB;IAEpB,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;QACzC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;IACH,+DAA+D;IAC/D,6DAA6D;IAC7D,oDAAoD;IACpD,oCAAoC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,EAAE,CAAC,UAAU;QACxB,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,YAAoB;IACpD,IAAI,GAAW,CAAC;IAChB,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtF,CAAC;SAAM,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,GAAG,GAAG,YAAY,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,iEAAiE;QACjE,mCAAmC;QACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACtD,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,MAAwB,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,EAAkB;IACzD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,SAAS,IAAI,gBAAgB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,6CAA6C;YACzD,SAAS,EAAE,GAAG;SACf,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,CAAC,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAkB;IAC9C,iEAAiE;IACjE,wCAAwC;IACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,EAAE,CAAC,YAAY;QACpB,KAAK,EAAE,KAAK;QACZ,GAAG,EAAE,EAAE,CAAC,SAAS,IAAI,gBAAgB;QACrC,GAAG,EAAE,GAAG,GAAG,IAAI;QACf,GAAG,EAAE,GAAG;KACT,CAAC;IACF,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,EAAE,CAAC;IACb,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,GAAG,YAAY,IAAI,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAS;IACtC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACzF,CAAC"}

package/dist/credentials/node/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Node-only credentials used by hosted Rules Test API verification.
+ * Pyric does not own an interactive Google login or credential store.
+ */
+export { fromAdc } from './from-adc.js';
+export { fromServiceAccount } from './from-service-account.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/credentials/node/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/credentials/node/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/credentials/node/index.js

@@ -0,0 +1,7 @@
+/**
+ * Node-only credentials used by hosted Rules Test API verification.
+ * Pyric does not own an interactive Google login or credential store.
+ */
+export { fromAdc } from './from-adc.js';
+export { fromServiceAccount } from './from-service-account.js';
+//# sourceMappingURL=index.js.map

package/dist/credentials/node/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/credentials/node/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC"}