@pyric/cli 0.1.0-alpha.20 → 0.1.0-alpha.21

package/dist/serve/ai-terminal-blocks.js

@@ -0,0 +1,128 @@
+import { redactUrl } from 'pyric/ai/internal';
+import { sanitizeForTerminal } from './ai-terminal-text.js';
+/** A non-empty string field, sanitized, or `null` when the wire omitted it. */
+function readText(value) {
+    if (typeof value !== 'string' || value === '')
+        return null;
+    return sanitizeForTerminal(redactUrl(value));
+}
+/** A raw (unsanitized) string field, for throttle keys that never print. */
+function readRawText(value, fallback) {
+    if (typeof value !== 'string' || value === '')
+        return fallback;
+    return value;
+}
+/**
+ * The `model: <id> (engine: <name>)` line shared by the rejection and block
+ * formatters, which report the same fact in the same place. Degrades to an
+ * engine-only line, and to nothing at all when the event carried neither.
+ */
+function formatModelLine(model, engine) {
+    const flatModel = readText(model);
+    const flatEngine = readText(engine);
+    if (flatModel === null && flatEngine === null)
+        return null;
+    if (flatModel === null)
+        return `      engine: ${flatEngine}`;
+    if (flatEngine === null)
+        return `      model: ${flatModel}`;
+    return `      model: ${flatModel} (engine: ${flatEngine})`;
+}
+/**
+ * Format a relayed AI broker rejection into the compact terminal block, the
+ * same `  [pyric] ...` idiom the denial relay and the ai-proxy warning print.
+ * Three lines at most: the reason production itself gives, then the model
+ * (with the resolved engine, since a rejection reads very differently for
+ * `scripted` than for a real upstream), then the wire status. Exported for
+ * unit tests.
+ */
+export function formatAiRejectionBlock(payload) {
+    const message = readText(payload.message) ?? 'request rejected';
+    const lines = [`  ⚠ [pyric] ai request rejected: ${message}`];
+    const modelLine = formatModelLine(payload.model, payload.engine);
+    if (modelLine !== null)
+        lines.push(modelLine);
+    const status = readText(payload.status);
+    const code = typeof payload.code === 'number' ? payload.code : null;
+    if (status !== null || code !== null) {
+        const label = status ?? 'ERROR';
+        let suffix = '';
+        if (code !== null)
+            suffix = ` (${code})`;
+        lines.push(`      ${label}${suffix}`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Format a relayed AI filter block, in the same three lines as
+ * {@link formatAiRejectionBlock}: the wire's own reason, the model + resolved
+ * engine, then WHY there is no content. That third line matters more here
+ * than for a rejection: a block throws nothing, so the only symptom a
+ * developer sees is an empty answer, and production's `finishMessage` (when
+ * it sent one) is the whole explanation. Exported for unit tests.
+ */
+export function formatAiBlockedBlock(payload) {
+    const finishReason = readText(payload.finishReason);
+    const blockReason = readText(payload.blockReason);
+    const reason = finishReason ?? blockReason ?? 'unknown';
+    const lines = [`  ⚠ [pyric] ai response blocked: ${reason}`];
+    const modelLine = formatModelLine(payload.model, payload.engine);
+    if (modelLine !== null)
+        lines.push(modelLine);
+    const finishMessage = readText(payload.finishMessage);
+    if (finishMessage !== null) {
+        lines.push(`      ${finishMessage}`);
+    }
+    else if (finishReason === null && blockReason !== null) {
+        lines.push('      the prompt was blocked before generation; no candidates were returned');
+    }
+    else {
+        lines.push('      no content was returned; text() and functionCalls() throw for this finish reason');
+    }
+    return lines.join('\n');
+}
+/**
+ * Format a relayed AI model substitution into ONE terminal line, a single
+ * line on purpose: there is no error, no status, and no missing content to
+ * explain. The whole fact IS the arrow, and the parenthetical says which
+ * engine did it and why (`engine modelMap`, `experimental alias`, ...).
+ * Exported for unit tests.
+ */
+export function formatAiModelSubstitutionBlock(payload) {
+    const requested = readText(payload.requestedModel) ?? 'unknown';
+    const effective = readText(payload.effectiveModel) ?? 'unknown';
+    const engine = readText(payload.engine);
+    const reason = readText(payload.reason);
+    const attribution = [engine, reason].filter((part) => part !== null);
+    let suffix = '';
+    if (attribution.length > 0)
+        suffix = ` (${attribution.join(', ')})`;
+    return `  ⚠ [pyric] ai model substituted: ${requested} → ${effective}${suffix}`;
+}
+const AI_TERMINAL_BLOCKS = {
+    'ai-rejection': {
+        format: formatAiRejectionBlock,
+        throttleTarget: (payload) => `ai-rejection ${readRawText(payload.model, '')}`,
+        throttleReason: (payload) => readRawText(payload.message, 'request rejected'),
+    },
+    'ai-blocked': {
+        format: formatAiBlockedBlock,
+        throttleTarget: (payload) => `ai-blocked ${readRawText(payload.model, '')}`,
+        throttleReason: (payload) => readRawText(payload.finishReason, readRawText(payload.blockReason, 'unknown')),
+    },
+    'ai-model-substituted': {
+        format: formatAiModelSubstitutionBlock,
+        throttleTarget: (payload) => `ai-model ${readRawText(payload.requestedModel, '')}`,
+        throttleReason: (payload) => readRawText(payload.effectiveModel, 'unknown'),
+    },
+};
+/** The record for a relayed body's `kind`, or `null` when the body is a rules
+ *  denial (or anything else this route does not recognize). */
+export function aiTerminalBlockFor(kind) {
+    if (typeof kind !== 'string')
+        return null;
+    if (!Object.hasOwn(AI_TERMINAL_BLOCKS, kind))
+        return null;
+    return AI_TERMINAL_BLOCKS[kind];
+}
+//# sourceMappingURL=ai-terminal-blocks.js.map

package/dist/serve/ai-terminal-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-terminal-blocks.js","sourceRoot":"","sources":["../../src/serve/ai-terminal-blocks.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAwD5D,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,KAAc,EAAE,QAAgB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAc,EAAE,MAAe;IACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,SAAS,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,iBAAiB,UAAU,EAAE,CAAC;IAC7D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,gBAAgB,SAAS,EAAE,CAAC;IAC5D,OAAO,gBAAgB,SAAS,aAAa,UAAU,GAAG,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA2B;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;QAChC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAyB;IAC5D,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,IAAI,WAAW,IAAI,SAAS,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IACvC,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAmC;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACrE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,GAAG,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACpE,OAAO,qCAAqC,SAAS,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;AAClF,CAAC;AAoBD,MAAM,kBAAkB,GAAiD;IACvE,cAAc,EAAE;QACd,MAAM,EAAE,sBAAsB;QAC9B,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE;QAC7E,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC;KAC9E;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,oBAAoB;QAC5B,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE;QAC3E,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAC1B,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;KACjF;IACD,sBAAsB,EAAE;QACtB,MAAM,EAAE,8BAA8B;QACtC,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE;QAClF,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;KAC5E;CACF,CAAC;AAEF;+DAC+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,kBAAkB,CAAC,IAAwB,CAAC,CAAC;AACtD,CAAC"}

package/dist/serve/ai-terminal-text.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Terminal-safe rendering of remote-authored text.
+ *
+ * Every AI diagnostic the dev server prints quotes a string somebody else
+ * wrote: a broker rejection reason, a model server's finish message, a
+ * `Retry-After` header, a model id out of a project config. The terminal is
+ * not a sandbox, so that text is flattened onto one line, stripped of control
+ * and bidi characters (the same treatment `activity-warning.ts` gives incident
+ * text), and cut to a fixed length. Without the cut, one field of a remote
+ * payload can push the rest of a diagnostic block off the screen.
+ *
+ * Leaf module: it imports nothing, so the browser-side diagnostics relay can
+ * share it without pulling the dev server's formatting code into a served
+ * bundle. Credential masking is a separate concern and comes from
+ * `pyric/ai/internal`, which publishes the broker's own `redactUrl`.
+ */
+/**
+ * Longest remote-authored string echoed into one terminal field, and the
+ * longest one the browser-side relay puts on the wire. Broker rejection
+ * reasons run to a few hundred characters at most, so anything past this is
+ * an upstream dumping a payload into a message field.
+ */
+export declare const AI_TERMINAL_TEXT_MAX = 512;
+/** Cut text to {@link AI_TERMINAL_TEXT_MAX}, marking the cut. */
+export declare function capTerminalText(text: string): string;
+/**
+ * Flatten an upstream-authored string into ONE terminal-safe line.
+ *
+ * Broker rejection reasons are production's own messages, and several are
+ * multi-line (`ai-error-empty-contents` is a bulleted list): pasted verbatim
+ * they shred the indented block into fragments. Control and bidi characters
+ * get dropped for the same reason `activity-warning.ts` drops them: the text
+ * can originate from a remote model server, and the terminal is not a sandbox.
+ */
+export declare function sanitizeForTerminal(text: string): string;
+//# sourceMappingURL=ai-terminal-text.d.ts.map

package/dist/serve/ai-terminal-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-terminal-text.d.ts","sourceRoot":"","sources":["../../src/serve/ai-terminal-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAKxC,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGpD;AAOD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGxD"}

package/dist/serve/ai-terminal-text.js

@@ -0,0 +1,48 @@
+/**
+ * Terminal-safe rendering of remote-authored text.
+ *
+ * Every AI diagnostic the dev server prints quotes a string somebody else
+ * wrote: a broker rejection reason, a model server's finish message, a
+ * `Retry-After` header, a model id out of a project config. The terminal is
+ * not a sandbox, so that text is flattened onto one line, stripped of control
+ * and bidi characters (the same treatment `activity-warning.ts` gives incident
+ * text), and cut to a fixed length. Without the cut, one field of a remote
+ * payload can push the rest of a diagnostic block off the screen.
+ *
+ * Leaf module: it imports nothing, so the browser-side diagnostics relay can
+ * share it without pulling the dev server's formatting code into a served
+ * bundle. Credential masking is a separate concern and comes from
+ * `pyric/ai/internal`, which publishes the broker's own `redactUrl`.
+ */
+/**
+ * Longest remote-authored string echoed into one terminal field, and the
+ * longest one the browser-side relay puts on the wire. Broker rejection
+ * reasons run to a few hundred characters at most, so anything past this is
+ * an upstream dumping a payload into a message field.
+ */
+export const AI_TERMINAL_TEXT_MAX = 512;
+/** Appended when text is cut, so a truncated line never reads as complete. */
+const TRUNCATION_MARKER = '\u2026';
+/** Cut text to {@link AI_TERMINAL_TEXT_MAX}, marking the cut. */
+export function capTerminalText(text) {
+    if (text.length <= AI_TERMINAL_TEXT_MAX)
+        return text;
+    return `${text.slice(0, AI_TERMINAL_TEXT_MAX)}${TRUNCATION_MARKER}`;
+}
+/** Control, bidi-override, and line-separator characters. A remote string
+ *  carrying these can forge a terminal line or reverse the text around it. */
+const TERMINAL_UNSAFE_CHARS = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g;
+/**
+ * Flatten an upstream-authored string into ONE terminal-safe line.
+ *
+ * Broker rejection reasons are production's own messages, and several are
+ * multi-line (`ai-error-empty-contents` is a bulleted list): pasted verbatim
+ * they shred the indented block into fragments. Control and bidi characters
+ * get dropped for the same reason `activity-warning.ts` drops them: the text
+ * can originate from a remote model server, and the terminal is not a sandbox.
+ */
+export function sanitizeForTerminal(text) {
+    const flattened = text.replace(TERMINAL_UNSAFE_CHARS, ' ').replace(/\s+/g, ' ').trim();
+    return capTerminalText(flattened);
+}
+//# sourceMappingURL=ai-terminal-text.js.map

package/dist/serve/ai-terminal-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-terminal-text.js","sourceRoot":"","sources":["../../src/serve/ai-terminal-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,GAAG,iBAAiB,EAAE,CAAC;AACtE,CAAC;AAED;8EAC8E;AAC9E,MAAM,qBAAqB,GACzB,iFAAiF,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACvF,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC"}

package/dist/serve/beacon-route.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `POST /__pyric/beacon`, the host half of the interception handshake.
+ *
+ * `@pyric/cli/register` posts here once per activated child, after its module
+ * hooks and net-guard are installed. Receiving it is the only positive proof
+ * the dev server has that `NODE_OPTIONS=--import @pyric/cli/register` actually
+ * reached that process; everything else about the launch is an assumption. See
+ * `register/beacon.ts` for why the child reports on two channels.
+ *
+ * Who may post, and why it is locked down
+ * ---------------------------------------
+ * The dev server is reachable from any page the developer happens to have
+ * open, so an unauthenticated route here would let a web page disarm the
+ * watchdog (post a beacon the launcher counts) and would let any page grow the
+ * server's memory with an unbounded body. Four checks close that, in order:
+ *
+ *  1. `content-type: application/json`. A cross-origin page cannot send that
+ *     header on a POST without a CORS preflight, and this server answers no
+ *     `OPTIONS` on this path, so the browser never sends the real request.
+ *  2. No `Origin` header and no `Sec-Fetch-Mode: cors`. A browser attaches one
+ *     or both to every cross-site request it makes; a Node child attaches
+ *     neither.
+ *  3. A per-launch secret in `x-pyric-beacon-token`, which the launcher put in
+ *     the child's environment as `PYRIC_BEACON_TOKEN`. A page cannot read it.
+ *  4. A 4 KB body cap. A report is under 200 bytes.
+ *
+ * Everything that passes those checks is still best-effort: a malformed body
+ * gets 204 and is dropped, because the consequence of an absent beacon is a
+ * warning on the parent side and must never be a failure on the child's.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type BeaconReport } from '../register/beacon.js';
+/** Largest beacon body accepted. A report is well under 200 bytes. */
+export declare const BEACON_BODY_LIMIT_BYTES = 4096;
+export interface BeaconRouteOptions {
+    /** The per-launch secret the child must present. */
+    readonly token: string;
+    /** Receives each accepted report. Absent means the route still 204s. */
+    readonly onBeacon?: (report: BeaconReport) => void;
+}
+/**
+ * Read a beacon body defensively. It is JSON off a socket, and the only fields
+ * that matter are the ones the parent reports. `null` for anything that does
+ * not carry a plausible report.
+ */
+export declare function parseBeaconReport(value: unknown): BeaconReport | null;
+/** The one terminal line confirming a child is interlocked. A beacon that
+ *  reports `hooks: false` is the interesting case: the child is running the
+ *  register module, and it is telling us the rewrite did not install. */
+export declare function formatBeaconReceipt(report: BeaconReport): string;
+/** Handle `POST /__pyric/beacon`. */
+export declare function handleBeacon(opts: BeaconRouteOptions, req: IncomingMessage, res: ServerResponse): Promise<void>;
+//# sourceMappingURL=beacon-route.d.ts.map

package/dist/serve/beacon-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"beacon-route.d.ts","sourceRoot":"","sources":["../../src/serve/beacon-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE/E,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;CACpD;AAyBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAarE;AAED;;yEAEyE;AACzE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAShE;AAED,qCAAqC;AACrC,wBAAsB,YAAY,CAChC,IAAI,EAAE,kBAAkB,EACxB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC,CAgCf"}

package/dist/serve/beacon-route.js

@@ -0,0 +1,101 @@
+import { timingSafeEqual } from 'node:crypto';
+import { BODY_TOO_LARGE_CODE, collectBody } from '../bridge/server/peer.js';
+import { getHeader } from './server.js';
+import { BEACON_TOKEN_HEADER } from '../register/beacon.js';
+/** Largest beacon body accepted. A report is well under 200 bytes. */
+export const BEACON_BODY_LIMIT_BYTES = 4_096;
+/** Constant-time string comparison over the token bytes. */
+function tokenMatches(presented, expected) {
+    if (presented === undefined)
+        return false;
+    const a = Buffer.from(presented, 'utf8');
+    const b = Buffer.from(expected, 'utf8');
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+/** Whether the request carries the browser markings of a cross-site fetch. */
+function isBrowserOriginated(req) {
+    if (getHeader(req, 'origin') !== undefined)
+        return true;
+    return getHeader(req, 'sec-fetch-mode') === 'cors';
+}
+/** Whether the body is declared as JSON, the header a page cannot set without
+ *  a preflight this server never answers. */
+function declaresJsonBody(req) {
+    const contentType = getHeader(req, 'content-type');
+    if (contentType === undefined)
+        return false;
+    return contentType.split(';')[0].trim().toLowerCase() === 'application/json';
+}
+/**
+ * Read a beacon body defensively. It is JSON off a socket, and the only fields
+ * that matter are the ones the parent reports. `null` for anything that does
+ * not carry a plausible report.
+ */
+export function parseBeaconReport(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const raw = value;
+    if (typeof raw.pid !== 'number' || !Number.isFinite(raw.pid))
+        return null;
+    const guard = raw.guard;
+    if (guard !== 'warn' && guard !== 'block' && guard !== 'off')
+        return null;
+    if (typeof raw.hooks !== 'boolean')
+        return null;
+    return {
+        pid: raw.pid,
+        guard,
+        hooks: raw.hooks,
+        sandbox: typeof raw.sandbox === 'string' ? raw.sandbox : '',
+    };
+}
+/** The one terminal line confirming a child is interlocked. A beacon that
+ *  reports `hooks: false` is the interesting case: the child is running the
+ *  register module, and it is telling us the rewrite did not install. */
+export function formatBeaconReceipt(report) {
+    if (!report.hooks) {
+        return (`  ⚠ interlock pid=${report.pid}: register loaded but module hooks did NOT install. ` +
+            `That process's firebase-admin/firebase imports are NOT routed to the sandbox ` +
+            `(Node >= 22.15 is required for full coverage). Net-guard mode ${report.guard}.`);
+    }
+    return `  ⓘ interlock pid=${report.pid}: sandbox interception confirmed live (guard=${report.guard})`;
+}
+/** Handle `POST /__pyric/beacon`. */
+export async function handleBeacon(opts, req, res) {
+    if (req.method !== 'POST') {
+        res.writeHead(405, { allow: 'POST' }).end('method not allowed');
+        return;
+    }
+    if (!declaresJsonBody(req)) {
+        res.writeHead(415, { 'content-type': 'text/plain' }).end('Unsupported Media Type');
+        return;
+    }
+    if (isBrowserOriginated(req)) {
+        res.writeHead(403, { 'content-type': 'text/plain' }).end('Forbidden: browser origin');
+        return;
+    }
+    if (!tokenMatches(getHeader(req, BEACON_TOKEN_HEADER), opts.token)) {
+        res.writeHead(401, { 'content-type': 'text/plain' }).end('Unauthorized: invalid beacon token');
+        return;
+    }
+    let body;
+    try {
+        body = await collectBody(req, BEACON_BODY_LIMIT_BYTES);
+    }
+    catch (err) {
+        if (err.code === BODY_TOO_LARGE_CODE) {
+            res.writeHead(413, { 'content-type': 'text/plain' }).end('Payload Too Large');
+            return;
+        }
+        // Malformed JSON: drop it. Proof-of-life is a side channel.
+        res.writeHead(204).end();
+        return;
+    }
+    const report = parseBeaconReport(body);
+    if (report !== null)
+        opts.onBeacon?.(report);
+    res.writeHead(204).end();
+}
+//# sourceMappingURL=beacon-route.js.map

package/dist/serve/beacon-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"beacon-route.js","sourceRoot":"","sources":["../../src/serve/beacon-route.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAqB,MAAM,uBAAuB,CAAC;AAE/E,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAS7C,4DAA4D;AAC5D,SAAS,YAAY,CAAC,SAA6B,EAAE,QAAgB;IACnE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,GAAoB;IAC/C,IAAI,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,KAAK,MAAM,CAAC;AACrD,CAAC;AAED;6CAC6C;AAC7C,SAAS,gBAAgB,CAAC,GAAoB;IAC5C,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,kBAAkB,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;yEAEyE;AACzE,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CACL,qBAAqB,MAAM,CAAC,GAAG,sDAAsD;YACrF,+EAA+E;YAC/E,iEAAiE,MAAM,CAAC,KAAK,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,MAAM,CAAC,GAAG,gDAAgD,MAAM,CAAC,KAAK,GAAG,CAAC;AACxG,CAAC;AAED,qCAAqC;AACrC,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAwB,EACxB,GAAoB,EACpB,GAAmB;IAEnB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACtF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAC/F,OAAO;IACT,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAAyB,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC5D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,4DAA4D;QAC5D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI;QAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;IAC7C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;AAC3B,CAAC"}

package/dist/serve/entries/active-auth-registry.d.ts

@@ -0,0 +1,16 @@
+type AuthUser<Auth extends {
+    currentUser: unknown;
+}> = Auth['currentUser'];
+export interface ActiveAuthRegistry<Auth extends {
+    currentUser: unknown;
+}> {
+    register(auth: Auth): () => void;
+    subscribe(listener: (user: AuthUser<Auth>) => void): () => void;
+    auths(): IterableIterator<Auth>;
+}
+/** Coordinates unique Auth handles while allowing more than one lifecycle owner. */
+export declare function createActiveAuthRegistry<Auth extends {
+    currentUser: unknown;
+}>(observe: (auth: Auth, listener: (user: AuthUser<Auth>) => void) => () => void): ActiveAuthRegistry<Auth>;
+export {};
+//# sourceMappingURL=active-auth-registry.d.ts.map

package/dist/serve/entries/active-auth-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-auth-registry.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/active-auth-registry.ts"],"names":[],"mappings":"AAAA,KAAK,QAAQ,CAAC,IAAI,SAAS;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC;AAE3E,MAAM,WAAW,kBAAkB,CAAC,IAAI,SAAS;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE;IACvE,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,IAAI,CAAC;IACjC,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAChE,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;CACjC;AAED,oFAAoF;AACpF,wBAAgB,wBAAwB,CAAC,IAAI,SAAS;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,EAC5E,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,MAAM,IAAI,GAC5E,kBAAkB,CAAC,IAAI,CAAC,CA4C1B"}

package/dist/serve/entries/active-auth-registry.js

@@ -0,0 +1,48 @@
+/** Coordinates unique Auth handles while allowing more than one lifecycle owner. */
+export function createActiveAuthRegistry(observe) {
+    const registrations = new Map();
+    const listeners = new Set();
+    const register = (auth) => {
+        const existing = registrations.get(auth);
+        if (existing) {
+            existing.owners += 1;
+        }
+        else {
+            const unsubscribe = observe(auth, (user) => {
+                for (const listener of listeners)
+                    listener(user);
+            });
+            registrations.set(auth, { owners: 1, unsubscribe });
+        }
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            const registration = registrations.get(auth);
+            if (!registration)
+                return;
+            registration.owners -= 1;
+            if (registration.owners > 0)
+                return;
+            registrations.delete(auth);
+            registration.unsubscribe();
+        };
+    };
+    const subscribe = (listener) => {
+        listeners.add(listener);
+        for (const auth of registrations.keys()) {
+            if (auth.currentUser) {
+                listener(auth.currentUser);
+                break;
+            }
+        }
+        return () => listeners.delete(listener);
+    };
+    return {
+        register,
+        subscribe,
+        auths: () => registrations.keys(),
+    };
+}
+//# sourceMappingURL=active-auth-registry.js.map

package/dist/serve/entries/active-auth-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-auth-registry.js","sourceRoot":"","sources":["../../../src/serve/entries/active-auth-registry.ts"],"names":[],"mappings":"AAQA,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CACtC,OAA6E;IAE7E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAqD,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkC,CAAC;IAE5D,MAAM,QAAQ,GAAG,CAAC,IAAU,EAAgB,EAAE;QAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzC,KAAK,MAAM,QAAQ,IAAI,SAAS;oBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;YACH,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,OAAO,GAAG,EAAE;YACV,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,YAAY;gBAAE,OAAO;YAC1B,YAAY,CAAC,MAAM,IAAI,CAAC,CAAC;YACzB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO;YACpC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,YAAY,CAAC,WAAW,EAAE,CAAC;QAC7B,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,QAAwC,EAAgB,EAAE;QAC3E,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC3B,MAAM;YACR,CAAC;QACH,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,SAAS;QACT,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE;KAClC,CAAC;AACJ,CAAC"}

package/dist/serve/entries/active-auth.d.ts

@@ -0,0 +1,18 @@
+import { type RuntimeIdentity } from '../runtime/identity.js';
+type ActiveAuth = {
+    currentUser: RuntimeIdentity | null;
+};
+export declare function registerActiveAuth(auth: ActiveAuth): () => void;
+export declare function subscribeToActiveAuth(listener: (user: RuntimeIdentity | null) => void): () => void;
+export declare function getActiveAuthUser(): RuntimeIdentity | null;
+export declare function switchAllAuthUsers(uid: string): Promise<void>;
+export declare function signOutAllAuths(): Promise<void>;
+export declare function commitCredentialToAllAuths(identity: {
+    uid: string;
+    email?: string | null;
+    displayName?: string | null;
+    customClaims?: Record<string, unknown>;
+    providerId?: string;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=active-auth.d.ts.map

package/dist/serve/entries/active-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-auth.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/active-auth.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAMhC,KAAK,UAAU,GAAG;IAAE,WAAW,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAO1D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,IAAI,CAE/D;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,KAAK,IAAI,GAC/C,MAAM,IAAI,CAEZ;AAED,wBAAgB,iBAAiB,IAAI,eAAe,GAAG,IAAI,CAO1D;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcnE;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAUrD;AAED,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BhB"}

package/dist/serve/entries/active-auth.js

@@ -0,0 +1,84 @@
+import * as ipAuth from 'pyric/auth';
+import * as wcRaw from '../worker/client.js';
+import { acceptProviderCredential, restorePortSession } from '../worker/client.js';
+import { projectRuntimeIdentity, } from '../runtime/identity.js';
+import { createActiveAuthRegistry } from './active-auth-registry.js';
+import { useWorker } from './worker-runtime.js';
+const wc = wcRaw;
+const selectedAuth = useWorker ? wc : ipAuth;
+const observeActiveAuth = selectedAuth.onAuthStateChanged;
+const activeAuthRegistry = createActiveAuthRegistry(observeActiveAuth);
+export function registerActiveAuth(auth) {
+    return activeAuthRegistry.register(auth);
+}
+export function subscribeToActiveAuth(listener) {
+    return activeAuthRegistry.subscribe(listener);
+}
+export function getActiveAuthUser() {
+    for (const auth of activeAuthRegistry.auths()) {
+        if (auth.currentUser) {
+            return projectRuntimeIdentity(auth.currentUser);
+        }
+    }
+    return null;
+}
+export async function switchAllAuthUsers(uid) {
+    const promises = [];
+    for (const auth of activeAuthRegistry.auths()) {
+        if (useWorker) {
+            promises.push(restorePortSession(auth, uid));
+        }
+        else {
+            try {
+                ipAuth.sandbox.restoreSession(auth, uid);
+            }
+            catch {
+                // A stale handle or unavailable identity must not block other handles.
+            }
+        }
+    }
+    await Promise.all(promises);
+}
+export async function signOutAllAuths() {
+    const promises = [];
+    for (const auth of activeAuthRegistry.auths()) {
+        if (useWorker) {
+            promises.push(wc.signOut(auth));
+        }
+        else {
+            promises.push(ipAuth.signOut(auth));
+        }
+    }
+    await Promise.all(promises);
+}
+export async function commitCredentialToAllAuths(identity) {
+    const promises = [];
+    for (const auth of activeAuthRegistry.auths()) {
+        if (useWorker) {
+            promises.push(acceptProviderCredential(auth, {
+                uid: identity.uid,
+                email: identity.email ?? null,
+                displayName: identity.displayName ?? null,
+                customClaims: identity.customClaims ?? {},
+                providerId: identity.providerId ?? 'password',
+            }));
+        }
+        else {
+            try {
+                ipAuth.sandbox.seedUsers(auth, [{
+                        uid: identity.uid,
+                        email: identity.email ?? '',
+                        password: 'synthetic-password',
+                        displayName: identity.displayName ?? undefined,
+                        customClaims: identity.customClaims ?? {},
+                        providerId: identity.providerId ?? 'password',
+                    }]);
+            }
+            catch {
+                // A stale handle or duplicate seed must not block other handles.
+            }
+        }
+    }
+    await Promise.all(promises);
+}
+//# sourceMappingURL=active-auth.js.map

package/dist/serve/entries/active-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-auth.js","sourceRoot":"","sources":["../../../src/serve/entries/active-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,YAAY,CAAC;AACrC,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EACL,sBAAsB,GAEvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,EAAE,GAAG,KAAiC,CAAC;AAC7C,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAE7C,MAAM,iBAAiB,GAAG,YAAY,CAAC,kBAGxB,CAAC;AAChB,MAAM,kBAAkB,GAAG,wBAAwB,CAAa,iBAAiB,CAAC,CAAC;AAEnF,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAgD;IAEhD,OAAO,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAa,EAAE,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAa,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAa,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAa,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,QAMhD;IACC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAa,EAAE;gBACpD,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;gBAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;gBACzC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;gBACzC,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,UAAU;aAC9C,CAAC,CAAC,CAAC;QACN,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAa,EAAE,CAAC;wBACvC,GAAG,EAAE,QAAQ,CAAC,GAAG;wBACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;wBAC3B,QAAQ,EAAE,oBAAoB;wBAC9B,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,SAAS;wBAC9C,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;wBACzC,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,UAAU;qBAC9C,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC"}

package/dist/serve/entries/auth-helper-core.d.ts

@@ -56,6 +56,7 @@ export declare class ServeAuthHelper {
     private readonly mint;
     constructor(directory: HelperIdentityDirectory, mint?: HelperCredentialMint);
     resolver(): AuthFlowResolver;
+    promptCreateUser(providerId?: string): Promise<UserCredential>;
     subscribe(fn: () => void): () => void;
     snapshot(): HelperSnapshot;
     private emit;

package/dist/serve/entries/auth-helper-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-helper-core.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAEhB,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,IAAI,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACrD;2EACuE;IACvE,GAAG,CAAC,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EACH;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,KAC3D,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;CACvC;AAQD,qBAAa,eAAe;IAQxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;gBAGzB,SAAS,EAAE,uBAAuB,EACnD,IAAI,CAAC,EAAE,oBAAoB;IAM7B,QAAQ,IAAI,gBAAgB;IAW5B,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAKrC,QAAQ,IAAI,cAAc;IAQ1B,OAAO,CAAC,IAAI;IAKZ,OAAO,CAAC,iBAAiB;IAwBzB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAavB,GAAG,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;IAQhC,MAAM,IAAI,IAAI;IAWd,OAAO,CAAC,IAAI;YAOE,WAAW;IA0BzB,OAAO,CAAC,mBAAmB;CAM5B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzB"}
+{"version":3,"file":"auth-helper-core.d.ts","sourceRoot":"","sources":["../../../src/serve/entries/auth-helper-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAEhB,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,IAAI,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACrD;2EACuE;IACvE,GAAG,CAAC,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EACH;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,KAC3D,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;CACvC;AAQD,qBAAa,eAAe;IAQxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;gBAGzB,SAAS,EAAE,uBAAuB,EACnD,IAAI,CAAC,EAAE,oBAAoB;IAM7B,QAAQ,IAAI,gBAAgB;IAW5B,gBAAgB,CAAC,UAAU,SAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAKlE,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAKrC,QAAQ,IAAI,cAAc;IAQ1B,OAAO,CAAC,IAAI;IAKZ,OAAO,CAAC,iBAAiB;IAwBzB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAavB,GAAG,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;IAQhC,MAAM,IAAI,IAAI;IAWd,OAAO,CAAC,IAAI;YAOE,WAAW;IA0BzB,OAAO,CAAC,mBAAmB;CAM5B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzB"}

package/dist/serve/entries/auth-helper-core.js

@@ -20,6 +20,10 @@ export class ServeAuthHelper {
         });
         return { openPopup: open, openRedirect: open };
     }
+    promptCreateUser(providerId = 'password') {
+        const open = this.resolver().openPopup;
+        return open({ providerId, authType: 'signIn' });
+    }
     subscribe(fn) {
         this.listeners.add(fn);
         return () => this.listeners.delete(fn);