@pyric/cli 0.1.0-alpha.30.1 → 0.1.0-alpha.31

package/dist/register/swap-or-stop.js

@@ -0,0 +1,170 @@
+/**
+ * Swap or stop (ADR 0022): under the register, `firebase` and `firebase-admin`
+ * imports resolve to the sandbox. When a resolve lands in the real SDK anyway,
+ * through an absolute path, an npm alias, a link under another name, or a
+ * direct `@firebase/*` import, the import stops before the file loads. The
+ * real SDK never runs, so it never reaches production with this machine's
+ * credentials.
+ *
+ * The package is named by the resolved file's own `package.json`
+ * (`package-identity.ts`), never by its folder. Only files under a
+ * `node_modules` directory are checked: every installed SDK lives under one,
+ * including the pnpm and bun stores, and the check stays off the resolve path
+ * for everything else.
+ *
+ * The real SDK is allowed only where the swap table chooses it
+ * (`choosesRealFirebase` in `mapping.ts`), or when an SDK file this hook
+ * already allowed imports what its entry needs: a firebase-admin file
+ * reaches only the verifier bridge pair's files, and a client SDK file only
+ * the `@firebase/*` packages the production AI entries import. The importer's
+ * URL alone is no proof, since `createRequire` can name any file, so each
+ * hook keeps the URLs it allowed. In sandbox AI mode that set stays empty.
+ * `firebase-admin` is never chosen, with one exception: the App Check verifier
+ * bridge that production AI mode loads on pyric's behalf (#1552), whose
+ * firebase-admin app holds no credentials. An app's own import of the real
+ * package still stops. `PYRIC_GUARD` does not change any of this: the stop
+ * belongs to the swap, not to the network guard.
+ *
+ * Loaded by both resolve hooks, including the loader-thread one, so it imports
+ * node built-ins and side-effect-free modules only.
+ */
+import { fileURLToPath } from 'node:url';
+import { packageNameOf, pathInPackageOf } from './package-identity.js';
+import { choosesRealFirebase } from './mapping.js';
+import { SDK_MODULES, isAdminBridgeFile, isBypassedBridgeImport, isProductionAiSdkPackage, resolveAiMode, } from '../serve/firebase-module-swap.js';
+/** The code on the error a stopped import throws. */
+export const REAL_SDK_STOPPED_CODE = 'PYRIC_REAL_SDK_STOPPED';
+const LOG_PREFIX = '@pyric/cli/register';
+const REPORT_URL = 'https://github.com/davideast/pyric/issues/new';
+/** `firebase-admin` is the admin SDK; `firebase` and every `@firebase/*` package are the client SDK. */
+function sdkFamilyOf(name) {
+    if (name === 'firebase-admin')
+        return 'admin';
+    const isClientPackage = name === 'firebase' || (name?.startsWith('@firebase/') ?? false);
+    return isClientPackage ? 'client' : null;
+}
+function isInstalledFile(url) {
+    return url.startsWith('file:') && url.includes('/node_modules/');
+}
+/**
+ * Whether this load is an SDK file the hook already allowed, importing what
+ * that SDK entry needs: a firebase-admin file reaches only the files of the
+ * verifier bridge's `firebase-admin/app` and `firebase-admin/app-check`, and a
+ * client SDK file only the `@firebase/*` packages that `firebase/ai`,
+ * `firebase/app` and `firebase/app-check` import. So a `createRequire` forge
+ * from an allowed file gets no further than the entry it came from.
+ */
+function isFromAllowedSdkFile(load, packageName, allowedUrls) {
+    const importer = load.importer;
+    const isAllowedImporter = importer !== undefined && allowedUrls.has(importer);
+    if (!isAllowedImporter)
+        return false;
+    const importerFamily = sdkFamilyOf((load.nameOf ?? packageNameOf)(importer));
+    if (importerFamily === 'client')
+        return isProductionAiSdkPackage(packageName);
+    const isAdminTarget = importerFamily === 'admin' && packageName === 'firebase-admin';
+    if (!isAdminTarget)
+        return false;
+    const pathOf = load.pathInPackage ?? pathInPackageOf;
+    return isAdminBridgeFile(pathOf(load.url, packageName));
+}
+/** Whether this load may reach the real SDK. */
+function isAllowedRealLoad(load, packageName, family, allowedUrls) {
+    if (isFromAllowedSdkFile(load, packageName, allowedUrls))
+        return true;
+    const specifier = load.canonical ?? load.specifier;
+    const aiMode = load.aiMode ?? resolveAiMode(undefined, process.env);
+    if (family === 'admin')
+        return isBypassedBridgeImport(specifier, load.importer, aiMode);
+    const pathOf = load.pathInPackage ?? pathInPackageOf;
+    return choosesRealFirebase({
+        specifier,
+        importer: load.importer,
+        packageName,
+        pathInPackage: () => pathOf(load.url, packageName),
+        aiMode,
+    });
+}
+/** The served `firebase/*` import that stands for a `@firebase/*` package, when pyric serves one. */
+function servedImportFor(packageName) {
+    const candidate = `firebase/${packageName.slice('@firebase/'.length)}`;
+    const isServed = SDK_MODULES.includes(candidate);
+    return isServed ? candidate : null;
+}
+/** The import an app writes in place of the one that stopped. */
+function fixFor(family, packageName) {
+    if (family === 'admin') {
+        return "import firebase-admin by its package name (for example 'firebase-admin/app'), so the register routes it to the sandbox";
+    }
+    if (packageName === 'firebase') {
+        return "import firebase by its package name (for example 'firebase/firestore'), so the register routes it to the sandbox";
+    }
+    const served = servedImportFor(packageName);
+    if (served === null) {
+        return `pyric serves no firebase/* import for '${packageName}', so import a served one (for example 'firebase/firestore'), or move this code out of the sandboxed process`;
+    }
+    return `import '${served}' instead of '${packageName}', so the register routes it to the sandbox`;
+}
+function stopMessage(load, family, packageName) {
+    const consequence = family === 'admin'
+        ? "so it would have run with this machine's Google credentials"
+        : "so it would have reached production with the app's API key";
+    return [
+        `${LOG_PREFIX}: stopped loading the real ${packageName}`,
+        `  import '${load.specifier}'`,
+        `  from   ${load.importer ?? 'the entry point'}`,
+        `  found  ${load.url}`,
+        `Under pyric, ${packageName} resolves to the sandbox. This import didn't, ${consequence}.`,
+        `Fix: ${fixFor(family, packageName)}. To run the real SDK, start this process without @pyric/cli/register.`,
+        `If pyric should have routed this import, report it: ${REPORT_URL}`,
+        `code: ${REAL_SDK_STOPPED_CODE}`,
+    ].join('\n');
+}
+/**
+ * Whether this load is Node 22 resolving again a CommonJS file this hook
+ * already allowed. Node 22 resolves a CommonJS file imported from ESM a second
+ * time, by its own path and with no importer; Node 24 does not. That second
+ * pass loads nothing new, so it goes ahead. An app's import of the same file
+ * names its importer, so it still stops.
+ */
+function isCjsReloadOfAllowedFile(load, allowedUrls) {
+    const hasNoImporter = load.importer === undefined;
+    const wasAllowed = allowedUrls.has(load.url);
+    if (!hasNoImporter || !wasAllowed)
+        return false;
+    return load.specifier === fileURLToPath(load.url);
+}
+/**
+ * The error that stops this load, or `null` when the load may go ahead: it is
+ * not the real SDK, or the swap table chose the real SDK here. `allowedUrls`
+ * is the calling hook's record of the real SDK files it allowed; an allowed
+ * load joins it.
+ */
+export function stopFor(load, allowedUrls) {
+    if (!isInstalledFile(load.url))
+        return null;
+    const packageName = (load.nameOf ?? packageNameOf)(load.url);
+    const family = sdkFamilyOf(packageName);
+    if (family === null || packageName === null)
+        return null;
+    if (isCjsReloadOfAllowedFile(load, allowedUrls))
+        return null;
+    if (isAllowedRealLoad(load, packageName, family, allowedUrls)) {
+        allowedUrls.add(load.url);
+        return null;
+    }
+    const error = new Error(stopMessage(load, family, packageName));
+    return Object.assign(error, { code: REAL_SDK_STOPPED_CODE, url: load.url, specifier: load.specifier });
+}
+/** Writes each stop to stderr once per file, so a caught import still shows in the log. */
+export function createStopReporter(write) {
+    const reported = new Set();
+    return (error) => {
+        const url = error.url ?? error.message;
+        if (reported.has(url))
+            return;
+        reported.add(url);
+        write(`${error.message}\n`);
+    };
+}
+//# sourceMappingURL=swap-or-stop.js.map

package/dist/register/swap-or-stop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"swap-or-stop.js","sourceRoot":"","sources":["../../src/register/swap-or-stop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,aAAa,GAEd,MAAM,kCAAkC,CAAC;AAE1C,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,MAAM,UAAU,GAAG,+CAA+C,CAAC;AAmBnE,wGAAwG;AACxG,SAAS,WAAW,CAAC,IAAmB;IACtC,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,OAAO,CAAC;IAC9C,MAAM,eAAe,GAAG,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,CAAC;IACzF,OAAO,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,IAAkB,EAAE,WAAmB,EAAE,WAAgC;IACrG,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,iBAAiB,GAAG,QAAQ,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,IAAI,cAAc,KAAK,QAAQ;QAAE,OAAO,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,cAAc,KAAK,OAAO,IAAI,WAAW,KAAK,gBAAgB,CAAC;IACrF,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC;IACrD,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,gDAAgD;AAChD,SAAS,iBAAiB,CAAC,IAAkB,EAAE,WAAmB,EAAE,MAAiB,EAAE,WAAgC;IACrH,IAAI,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC;IACrD,OAAO,mBAAmB,CAAC;QACzB,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW;QACX,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;QAClD,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,SAAS,GAAG,YAAY,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAI,WAAiC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,iEAAiE;AACjE,SAAS,MAAM,CAAC,MAAiB,EAAE,WAAmB;IACpD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,wHAAwH,CAAC;IAClI,CAAC;IACD,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,kHAAkH,CAAC;IAC5H,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,0CAA0C,WAAW,8GAA8G,CAAC;IAC7K,CAAC;IACD,OAAO,WAAW,MAAM,iBAAiB,WAAW,6CAA6C,CAAC;AACpG,CAAC;AAED,SAAS,WAAW,CAAC,IAAkB,EAAE,MAAiB,EAAE,WAAmB;IAC7E,MAAM,WAAW,GAAG,MAAM,KAAK,OAAO;QACpC,CAAC,CAAC,6DAA6D;QAC/D,CAAC,CAAC,4DAA4D,CAAC;IACjE,OAAO;QACL,GAAG,UAAU,8BAA8B,WAAW,EAAE;QACxD,aAAa,IAAI,CAAC,SAAS,GAAG;QAC9B,YAAY,IAAI,CAAC,QAAQ,IAAI,iBAAiB,EAAE;QAChD,YAAY,IAAI,CAAC,GAAG,EAAE;QACtB,gBAAgB,WAAW,iDAAiD,WAAW,GAAG;QAC1F,QAAQ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,wEAAwE;QAC3G,uDAAuD,UAAU,EAAE;QACnE,SAAS,qBAAqB,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,IAAkB,EAAE,WAAgC;IACpF,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;IAClD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAkB,EAAE,WAAwB;IAClE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,wBAAwB,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9D,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;AACzG,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,KAA6B;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,GAAG,GAAI,KAA0B,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC;QAC7D,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC"}

package/dist/register/worker-guard.d.ts

@@ -0,0 +1,20 @@
+/** The `Worker` options this module reads. */
+interface WorkerOptionsLike {
+    eval?: unknown;
+    execArgv?: unknown;
+}
+/**
+ * The arguments to build the worker with, so that it loads the register at
+ * `registerUrl`. Returns new values and never changes the caller's.
+ */
+export declare function guardWorkerArguments(source: unknown, options: WorkerOptionsLike | undefined, registerUrl: string): [unknown, WorkerOptionsLike | undefined];
+/**
+ * Replace `workerThreads.Worker` with a subclass that builds every worker with
+ * {@link guardWorkerArguments}. A subclass keeps `instanceof Worker` true.
+ * `workerThreads` defaults to `node:worker_threads`; tests pass a stand-in.
+ */
+export declare function installWorkerGuard(registerUrl: string, workerThreads?: {
+    Worker: unknown;
+}): void;
+export {};
+//# sourceMappingURL=worker-guard.d.ts.map

package/dist/register/worker-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-guard.d.ts","sourceRoot":"","sources":["../../src/register/worker-guard.ts"],"names":[],"mappings":"AAsBA,8CAA8C;AAC9C,UAAU,iBAAiB;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAUD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,iBAAiB,GAAG,SAAS,EACtC,WAAW,EAAE,MAAM,GAClB,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,CAAC,CAU1C;AAeD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAejG"}

package/dist/register/worker-guard.js

@@ -0,0 +1,77 @@
+/**
+ * The register in worker threads.
+ *
+ * Built-in modules and resolve hooks are per thread, so the swap, the stop
+ * and the network guard have to be installed inside each worker as well. The
+ * register installs this wrapper whatever `PYRIC_GUARD` says. Node runs `--import` preloads (from the command
+ * line or `NODE_OPTIONS`) in a worker built from a file, a `data:` URL or ESM
+ * source, and the register then activates there as it does on the main
+ * thread. Two kinds of worker skip it:
+ *
+ *  - a worker built from CommonJS source with `eval: true`, which never runs
+ *    preloads;
+ *  - a worker given its own `execArgv`, when the register came from the
+ *    command line rather than `NODE_OPTIONS`.
+ *
+ * Wrapping `worker_threads.Worker` closes both. The worker still activates
+ * the register only under its own `PYRIC_SANDBOX`, exactly as the main thread
+ * does, so a worker the caller started outside the sandbox stays outside it.
+ */
+import Module, { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+/** Marks a `Worker` this module already wrapped. */
+const GUARDED_WORKER = Symbol.for('pyric.guardedWorker');
+/** A `'use strict'` directive, which must stay the first statement. */
+const USE_STRICT = /^(\s*(['"])use strict\2;?[ \t]*\n?)/;
+/**
+ * The arguments to build the worker with, so that it loads the register at
+ * `registerUrl`. Returns new values and never changes the caller's.
+ */
+export function guardWorkerArguments(source, options, registerUrl) {
+    let guardedSource = source;
+    let guardedOptions = options;
+    if (options?.eval === true && typeof source === 'string') {
+        guardedSource = withRegisterPrefix(source, registerUrl);
+    }
+    if (Array.isArray(options?.execArgv) && !options.execArgv.includes(registerUrl)) {
+        guardedOptions = { ...options, execArgv: [...options.execArgv, '--import', registerUrl] };
+    }
+    return [guardedSource, guardedOptions];
+}
+/**
+ * Eval source that first loads the register. `require` exists only when Node
+ * runs the source as CommonJS; ESM source already ran the preload, and the
+ * prefix does nothing there.
+ */
+function withRegisterPrefix(source, registerUrl) {
+    const prefix = `typeof require === 'function' && require(${JSON.stringify(fileURLToPath(registerUrl))});\n`;
+    const directive = USE_STRICT.exec(source)?.[1];
+    if (directive === undefined)
+        return `${prefix}${source}`;
+    const separator = directive.endsWith('\n') ? '' : '\n';
+    return `${directive}${separator}${prefix}${source.slice(directive.length)}`;
+}
+/**
+ * Replace `workerThreads.Worker` with a subclass that builds every worker with
+ * {@link guardWorkerArguments}. A subclass keeps `instanceof Worker` true.
+ * `workerThreads` defaults to `node:worker_threads`; tests pass a stand-in.
+ */
+export function installWorkerGuard(registerUrl, workerThreads) {
+    const target = workerThreads ?? createRequire(import.meta.url)('node:worker_threads');
+    const Original = target.Worker;
+    if (typeof Original !== 'function' || Original[GUARDED_WORKER] === true)
+        return;
+    class GuardedWorker extends Original {
+        static [GUARDED_WORKER] = true;
+        constructor(source, options) {
+            super(...guardWorkerArguments(source, options, registerUrl));
+        }
+    }
+    Object.defineProperty(GuardedWorker, 'name', { value: Original.name });
+    target.Worker = GuardedWorker;
+    // ESM `import { Worker } from 'node:worker_threads'` reads the export as
+    // synced, so publish the replacement there too.
+    if (workerThreads === undefined)
+        Module.syncBuiltinESMExports();
+}
+//# sourceMappingURL=worker-guard.js.map

package/dist/register/worker-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-guard.js","sourceRoot":"","sources":["../../src/register/worker-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,MAAM,EAAE,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAUzC,oDAAoD;AACpD,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AAEzD,uEAAuE;AACvE,MAAM,UAAU,GAAG,qCAAqC,CAAC;AAEzD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAe,EACf,OAAsC,EACtC,WAAmB;IAEnB,IAAI,aAAa,GAAG,MAAM,CAAC;IAC3B,IAAI,cAAc,GAAG,OAAO,CAAC;IAC7B,IAAI,OAAO,EAAE,IAAI,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzD,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAChF,cAAc,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,WAAmB;IAC7D,MAAM,MAAM,GAAG,4CAA4C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IAC5G,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,aAAmC;IACzF,MAAM,MAAM,GAAG,aAAa,IAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAyB,CAAC;IAC/G,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAuE,CAAC;IAChG,IAAI,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,IAAI;QAAE,OAAO;IAChF,MAAM,aAAc,SAAQ,QAAQ;QAClC,MAAM,CAAU,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;QACxC,YAAY,MAAe,EAAE,OAA2B;YACtD,KAAK,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/D,CAAC;;IAEH,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,MAAM,GAAG,aAAa,CAAC;IAC9B,yEAAyE;IACzE,gDAAgD;IAChD,IAAI,aAAa,KAAK,SAAS;QAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;AAClE,CAAC"}

package/dist/remote/resolve-host.d.ts

@@ -6,6 +6,13 @@
  * Shared by the Node remote client (`connectRemoteSandbox`, which
  * `pyric-admin` uses) and the client SDK bootstrap that `@pyric/cli/register`
  * installs (#1082), so both pick the same host for the same process.
+ *
+ * Discovery reads the project's `.pyric/serve.json` and probes the port it
+ * names, without the port scan `discoverServe` falls back to: a host found
+ * only by the scan is never attached to (`selectProjectHost`), and on a
+ * machine where closed ports never answer the scan takes seconds. A process
+ * resolves again at each reconnect, so a scan there would spend the window
+ * its held calls wait in (#1219).
  */
 import { type AnsweringHost, type Discovered } from '../serve/discovery.js';
 export interface ResolveRemoteHostOptions {
@@ -28,5 +35,7 @@ export interface ResolvedRemoteHost {
     /** The loopback base the health probe reached; sockets dial it. */
     wsBase: string;
 }
+/** The project's host as its `.pyric/serve.json` names it; no port scan. */
+export declare function discoverProjectPointer(cwd: string): Promise<Discovered | null>;
 export declare function resolveRemoteHost(options: ResolveRemoteHostOptions): Promise<ResolvedRemoteHost>;
 //# sourceMappingURL=resolve-host.d.ts.map

package/dist/remote/resolve-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-host.d.ts","sourceRoot":"","sources":["../../src/remote/resolve-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,UAAU,EAChB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvD,kEAAkE;IAClE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmDD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAWtG"}
+{"version":3,"file":"resolve-host.d.ts","sourceRoot":"","sources":["../../src/remote/resolve-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,UAAU,EAChB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvD,kEAAkE;IAClE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,4EAA4E;AAC5E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAE9E;AAkCD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAWtG"}

package/dist/remote/resolve-host.js

@@ -6,6 +6,13 @@
  * Shared by the Node remote client (`connectRemoteSandbox`, which
  * `pyric-admin` uses) and the client SDK bootstrap that `@pyric/cli/register`
  * installs (#1082), so both pick the same host for the same process.
+ *
+ * Discovery reads the project's `.pyric/serve.json` and probes the port it
+ * names, without the port scan `discoverServe` falls back to: a host found
+ * only by the scan is never attached to (`selectProjectHost`), and on a
+ * machine where closed ports never answer the scan takes seconds. A process
+ * resolves again at each reconnect, so a scan there would spend the window
+ * its held calls wait in (#1219).
  */
 import { discoverServe, selectExplicitHost, selectProjectHost, } from '../serve/discovery.js';
 function hostError(code, message) {
@@ -25,12 +32,16 @@ function warnOncePerUrl(url, message, warn) {
     else
         process.stderr.write(`${message}\n`);
 }
+/** The project's host as its `.pyric/serve.json` names it; no port scan. */
+export function discoverProjectPointer(cwd) {
+    return discoverServe(cwd, () => { }, []);
+}
 async function resolveConfiguredHost(configuredUrl, options) {
     const choice = await selectExplicitHost({
         url: configuredUrl,
         cwd: options.cwd,
         launcherInstanceId: options.instanceId,
-        discover: options.discover,
+        discover: options.discover ?? discoverProjectPointer,
         probe: options.probe,
     });
     if (choice.kind === 'stale')
@@ -45,7 +56,7 @@ async function resolveConfiguredHost(configuredUrl, options) {
 }
 async function discoverProjectHost(options) {
     const refused = [];
-    const found = selectProjectHost(await (options.discover ?? discoverServe)(options.cwd), (m) => refused.push(m));
+    const found = selectProjectHost(await (options.discover ?? discoverProjectPointer)(options.cwd), (m) => refused.push(m));
     const hasNoDiscovery = found === null;
     if (hasNoDiscovery) {
         throw hostError('not-found', 'no running `pyric sandbox --bridge` found (looked for .pyric/serve.json in ' +

package/dist/remote/resolve-host.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-host.js","sourceRoot":"","sources":["../../src/remote/resolve-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,uBAAuB,CAAC;AAwB/B,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAA6B,CAAC;IAC7D,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE5C,SAAS,cAAc,CAAC,GAAW,EAAE,OAAe,EAAE,IAAgC;IACpF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IACvC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI;QAAE,IAAI,CAAC,OAAO,CAAC,CAAC;;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,aAAqB,EAAE,OAAiC;IAC3F,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,kBAAkB,EAAE,OAAO,CAAC,UAAU;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,cAAc,CAAC,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAiC;IAClE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChH,MAAM,cAAc,GAAG,KAAK,KAAK,IAAI,CAAC;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,SAAS,CACb,WAAW,EACX,6EAA6E;YAC3E,GAAG,OAAO,CAAC,GAAG,8DAA8D;YAC5E,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiC;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC;IACjC,MAAM,cAAc,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACjF,IAAI,gBAAgB;QAAE,OAAO,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"resolve-host.js","sourceRoot":"","sources":["../../src/remote/resolve-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,uBAAuB,CAAC;AAwB/B,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAA6B,CAAC;IAC7D,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE5C,SAAS,cAAc,CAAC,GAAW,EAAE,OAAe,EAAE,IAAgC;IACpF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IACvC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI;QAAE,IAAI,CAAC,OAAO,CAAC,CAAC;;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,aAAqB,EAAE,OAAiC;IAC3F,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,kBAAkB,EAAE,OAAO,CAAC,UAAU;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,sBAAsB;QACpD,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,cAAc,CAAC,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAiC;IAClE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzH,MAAM,cAAc,GAAG,KAAK,KAAK,IAAI,CAAC;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,SAAS,CACb,WAAW,EACX,6EAA6E;YAC3E,GAAG,OAAO,CAAC,GAAG,8DAA8D;YAC5E,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiC;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC;IACjC,MAAM,cAAc,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACjF,IAAI,gBAAgB;QAAE,OAAO,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC"}

package/dist/serve/ai-diagnostics-relay.d.ts

@@ -9,7 +9,8 @@ import type { SandboxEvent } from 'pyric/sandbox';
  * agent driving `pyric dev` in process therefore saw NOTHING.
  *
  *   - `request_rejected`: a bad role, empty `contents`, a missing thought
- *     signature, or an engine that answered an error envelope.
+ *     signature, a request without a valid App Check token, or an engine
+ *     that answered an error envelope.
  *   - `response_blocked`: the SILENT refusal. A safety / recitation /
  *     blocklist filter answers HTTP 200 with an empty candidate, so nothing
  *     throws anywhere and the app simply renders nothing.
@@ -65,6 +66,8 @@ interface AiRejectionRelayPayload {
     code?: number;
     /** The rejection reason: production's own message for shape errors. */
     message: string;
+    /** Pyric's guidance beside production's message, such as the App Check gate's. */
+    hint?: string;
 }
 /** Shape POSTed for a `response_blocked` event. Carries the wire's own
  *  vocabulary, `finishReason` (a candidate was withheld) or `blockReason`

package/dist/serve/ai-diagnostics-relay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-diagnostics-relay.d.ts","sourceRoot":"","sources":["../../src/serve/ai-diagnostics-relay.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH;;;oDAGoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC;CAC7D;AAED;6DAC6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,YAAY,GAAG,sBAAsB,CAAC;AAKtF;;4EAE4E;AAC5E,UAAU,uBAAuB;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;kEAC8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;iBAIiB;AACjB,UAAU,qBAAqB;IAC7B,IAAI,EAAE,YAAY,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;qEACqE;AACrE,UAAU,+BAA+B;IACvC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,4DAA4D;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,cAAc,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,wBAAwB,GAChC,uBAAuB,GACvB,qBAAqB,GACrB,+BAA+B,CAAC;AAoGpC;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,YAAY,GAAG,wBAAwB,GAAG,IAAI,CAM3F;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,CAgB5F"}
+{"version":3,"file":"ai-diagnostics-relay.d.ts","sourceRoot":"","sources":["../../src/serve/ai-diagnostics-relay.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH;;;oDAGoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC;CAC7D;AAED;6DAC6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,YAAY,GAAG,sBAAsB,CAAC;AAKtF;;4EAE4E;AAC5E,UAAU,uBAAuB;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;kEAC8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;iBAIiB;AACjB,UAAU,qBAAqB;IAC7B,IAAI,EAAE,YAAY,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;qEACqE;AACrE,UAAU,+BAA+B;IACvC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,4DAA4D;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,cAAc,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,wBAAwB,GAChC,uBAAuB,GACvB,qBAAqB,GACrB,+BAA+B,CAAC;AAsGpC;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,YAAY,GAAG,wBAAwB,GAAG,IAAI,CAM3F;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,CAgB5F"}

package/dist/serve/ai-diagnostics-relay.js

@@ -34,6 +34,9 @@ function toRejectionPayload(event) {
     payload.status = detailText(detail, 'status');
     if (typeof detail.code === 'number')
         payload.code = detail.code;
+    const hint = detailText(detail, 'hint');
+    if (hint !== undefined)
+        payload.hint = hint;
     return payload;
 }
 /** Narrow a `response_blocked` event to its relay payload. */

package/dist/serve/ai-diagnostics-relay.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-diagnostics-relay.js","sourceRoot":"","sources":["../../src/serve/ai-diagnostics-relay.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAkHxD;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,MAA+B,EAAE,KAAa;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,gEAAgE;AAChE,SAAS,UAAU,CAAC,KAAsB;IACxC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1E,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAsB;IACtC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;AACzD,CAAC;AAED,8DAA8D;AAC9D,SAAS,kBAAkB,CAAC,KAAsB;IAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,OAAO,GAA4B;QACvC,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,kBAAkB;KAC7D,CAAC;IACF,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAChE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8DAA8D;AAC9D,SAAS,gBAAgB,CAAC,KAAsB;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,OAAO,GAA0B,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9D,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1D,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5D,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0BAA0B,CACjC,KAAsB;IAEtB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACvF,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,cAAc,KAAK,EAAE,IAAI,cAAc,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,aAAa,GAAG,cAAc,CAAC;IACnC,IAAI,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjG,IAAI,cAAc,KAAK,aAAa,IAAI,cAAc,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IACvF,MAAM,OAAO,GAAoC;QAC/C,IAAI,EAAE,sBAAsB;QAC5B,cAAc;QACd,cAAc;KACf,CAAC;IACF,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,MAAM,oBAAoB,GAAmD;IAC3E,cAAc,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,kBAAkB,EAAE;IACzE,YAAY,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,gBAAgB,EAAE;IACrE,sBAAsB,EAAE,EAAE,EAAE,EAAE,mBAAmB,EAAE,SAAS,EAAE,0BAA0B,EAAE;CAC3F,CAAC;AAEF,+EAA+E;AAC/E,SAAS,UAAU,CAAC,EAAU;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAmB;IACxD,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAuB,EAAE,OAAqB;IACpF,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO;QAC7B,IAAI,CAAC;YACH,KAAK,OAAO,CAAC,kBAAkB,EAAE;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,qEAAqE;YACvE,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"ai-diagnostics-relay.js","sourceRoot":"","sources":["../../src/serve/ai-diagnostics-relay.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAqHxD;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,MAA+B,EAAE,KAAa;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,gEAAgE;AAChE,SAAS,UAAU,CAAC,KAAsB;IACxC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1E,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAsB;IACtC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;AACzD,CAAC;AAED,8DAA8D;AAC9D,SAAS,kBAAkB,CAAC,KAAsB;IAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,OAAO,GAA4B;QACvC,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,kBAAkB;KAC7D,CAAC;IACF,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8DAA8D;AAC9D,SAAS,gBAAgB,CAAC,KAAsB;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,OAAO,GAA0B,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9D,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1D,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5D,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0BAA0B,CACjC,KAAsB;IAEtB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACvF,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,cAAc,KAAK,EAAE,IAAI,cAAc,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,aAAa,GAAG,cAAc,CAAC;IACnC,IAAI,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjG,IAAI,cAAc,KAAK,aAAa,IAAI,cAAc,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IACvF,MAAM,OAAO,GAAoC;QAC/C,IAAI,EAAE,sBAAsB;QAC5B,cAAc;QACd,cAAc;KACf,CAAC;IACF,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,MAAM,oBAAoB,GAAmD;IAC3E,cAAc,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,kBAAkB,EAAE;IACzE,YAAY,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,gBAAgB,EAAE;IACrE,sBAAsB,EAAE,EAAE,EAAE,EAAE,mBAAmB,EAAE,SAAS,EAAE,0BAA0B,EAAE;CAC3F,CAAC;AAEF,+EAA+E;AAC/E,SAAS,UAAU,CAAC,EAAU;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAmB;IACxD,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAuB,EAAE,OAAqB;IACpF,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO;QAC7B,IAAI,CAAC;YACH,KAAK,OAAO,CAAC,kBAAkB,EAAE;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,qEAAqE;YACvE,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/serve/ai-proxy.d.ts

@@ -22,6 +22,9 @@ export interface AiDiagnosticThrottle {
 export declare const AI_PROXY_DEFAULT_UPSTREAM = "http://localhost:11434/v1";
 /** The route the dev server mounts for OpenAI-compatible traffic. */
 export declare const AI_PROXY_ROUTE = "/__pyric/ai-proxy";
+/** Largest request body the proxy forwards: the hosted method route's limit,
+ *  which already carries AI requests with inline images. */
+export declare const AI_PROXY_BODY_LIMIT_BYTES: number;
 /** The upstream-failure shapes the proxy surfaces to the terminal. */
 type AiProxyFailure = {
     kind: 'unreachable';
@@ -35,6 +38,8 @@ type AiProxyFailure = {
     status: number;
     /** The upstream's raw `Retry-After` header, when it sent one. */
     retryAfter?: string;
+    /** The credentials the request carried, masked from `retryAfter`. */
+    credentials?: readonly string[];
 } | {
     kind: 'stream-abort';
     target: string;
@@ -91,6 +96,12 @@ export declare function permitAiUpstreams(ai: {
  * Responses remain incremental; cancellation stops reading without a warning.
  */
 export declare function fetchAiUpstream(input: Parameters<typeof fetch>[0], init: RequestInit | undefined, throttle: AiDiagnosticThrottle, logger?: ServeLogger, source?: string): Promise<Response>;
+/**
+ * Read an AI proxy request's body, at most {@link AI_PROXY_BODY_LIMIT_BYTES}.
+ * Past the limit it answers 413, and on a broken upload 400, and returns
+ * null: the caller sends nothing upstream. Both proxy routes read through it.
+ */
+export declare function readAiProxyBody(req: IncomingMessage, res: ServerResponse): Promise<Uint8Array<ArrayBuffer> | null>;
 /**
  * Handle `POST /__pyric/ai-proxy/<suffix>`: a same-origin passthrough to the
  * configured OpenAI-compatible upstream, so the browser openai engine
@@ -101,7 +112,11 @@ export declare function fetchAiUpstream(input: Parameters<typeof fetch>[0], init
  *   - POST only (the OpenAI chat-completions surface is POST); 405 otherwise.
  *   - the path suffix + query ride through verbatim
  *     (`/__pyric/ai-proxy/chat/completions` becomes `<upstream>/chat/completions`).
- *   - the request body is forwarded verbatim; headers minus the
+ *   - the caller must pass the namespace's loopback guard (Host, and an
+ *     Origin naming this server when one is sent), which the namespace runs
+ *     before this handler: the upstream may carry the developer's key.
+ *   - the request body is forwarded verbatim, up to
+ *     {@link AI_PROXY_BODY_LIMIT_BYTES} (413 past it); headers minus the
  *     origin-sensitive/hop-by-hop set above (`authorization` DOES forward,
  *     since upstreams may require a key).
  *   - the response body is STREAMED through chunk-by-chunk. SSE passthrough
@@ -115,5 +130,12 @@ export declare function fetchAiUpstream(input: Parameters<typeof fetch>[0], init
  *     means dropped silently (same opt-out contract as the denial relay).
  */
 export declare function handleAiProxy(configuredUpstream: string | undefined, throttle: AiDiagnosticThrottle, req: IncomingMessage, res: ServerResponse, url: URL, logger?: ServeLogger): Promise<void>;
+/**
+ * Send an upstream's answer to the caller: its status and content type, then
+ * the body chunk by chunk. SSE passthrough must never buffer. A dropped
+ * client cancels the upstream read so an abandoned stream doesn't keep the
+ * upstream generating.
+ */
+export declare function relayAiUpstream(upstream: Response, res: ServerResponse): Promise<void>;
 export {};
 //# sourceMappingURL=ai-proxy.d.ts.map

package/dist/serve/ai-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-proxy.d.ts","sourceRoot":"","sources":["../../src/serve/ai-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAExD;;mDAEmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChD;AAED,mEAAmE;AACnE,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,qEAAqE;AACrE,eAAO,MAAM,cAAc,sBAAsB,CAAC;AA0BlD,sEAAsE;AACtE,KAAK,cAAc,GACf;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzE;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAwD/E;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,SAAa,GAAG,MAAM,CA2BzF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAA;CAAE,CAY1D;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAKjF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE;IACpC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC7C,GAAG,IAAI,CASP;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAClC,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,SAAa,GAClB,OAAO,CAAC,QAAQ,CAAC,CA8CnB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,aAAa,CACjC,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAuEf"}
+{"version":3,"file":"ai-proxy.d.ts","sourceRoot":"","sources":["../../src/serve/ai-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAIxD;;mDAEmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChD;AAED,mEAAmE;AACnE,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,qEAAqE;AACrE,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD;4DAC4D;AAC5D,eAAO,MAAM,yBAAyB,QAA2B,CAAC;AA0BlE,sEAAsE;AACtE,KAAK,cAAc,GACf;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzE;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AA4D/E;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,SAAa,GAAG,MAAM,CA2BzF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAA;CAAE,CAY1D;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAKjF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE;IACpC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC7C,GAAG,IAAI,CASP;AAwBD;;GAEG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAClC,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,SAAa,GAClB,OAAO,CAAC,QAAQ,CAAC,CA8CnB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CASzC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,aAAa,CACjC,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB5F"}