@pyric/cli 0.1.0-alpha.30.1 → 0.1.0-alpha.31

package/dist/serve/ai-proxy.js

@@ -1,11 +1,16 @@
-import { redactUrl } from 'pyric/ai/internal';
+import { redactUpstreamText, redactUrl } from 'pyric/ai/internal';
 import { sanitizeForTerminal } from './ai-terminal-text.js';
 import { permitGuardHost } from '../register/net-guard.js';
 import { FIREBASE_AI_LOGIC_HOST } from '../google-endpoints.js';
+import { HOSTED_METHOD_BODY_LIMIT } from './hosted/method-protocol.js';
+import { BODY_TOO_LARGE_CODE, closingHeaders, collectRawBody } from '../bridge/server/peer.js';
 /** Default upstream: local Ollama's OpenAI-compatible endpoint. */
 export const AI_PROXY_DEFAULT_UPSTREAM = 'http://localhost:11434/v1';
 /** The route the dev server mounts for OpenAI-compatible traffic. */
 export const AI_PROXY_ROUTE = '/__pyric/ai-proxy';
+/** Largest request body the proxy forwards: the hosted method route's limit,
+ *  which already carries AI requests with inline images. */
+export const AI_PROXY_BODY_LIMIT_BYTES = HOSTED_METHOD_BODY_LIMIT;
 /**
  * Request headers that must NOT be forwarded upstream: origin-sensitive
  * browser context (`origin`/`referer`/`cookie`, since the upstream is a
@@ -37,13 +42,17 @@ const AI_PROXY_RETRY_AFTER_MAX = 64;
  * nothing worth printing.
  *
  * The header is remote-authored, so it is sanitized and length-capped like
- * every other upstream string that reaches the terminal. Delta-seconds (the
+ * every other upstream string that reaches the terminal. It is masked of the
+ * request's credentials first, with the masking the gemini engine and proxy
+ * use (`redactUpstreamText`), so the cap cannot leave a prefix of a key
+ * behind. Delta-seconds (the
  * common form) get an `s` suffix so the wait reads as a duration; the
  * HTTP-date form is echoed verbatim, since `Wed, 21 Oct 2026 07:28:00 GMTs`
  * would be nonsense.
  */
-function formatRetryAfter(raw) {
-    const clean = sanitizeForTerminal(raw).slice(0, AI_PROXY_RETRY_AFTER_MAX).trim();
+function formatRetryAfter(raw, credentials) {
+    const masked = redactUpstreamText(raw, credentials);
+    const clean = sanitizeForTerminal(masked).slice(0, AI_PROXY_RETRY_AFTER_MAX).trim();
     if (clean === '')
         return null;
     if (/^\d+$/.test(clean))
@@ -112,7 +121,7 @@ export function formatAiProxyWarning(failure, source = 'ai-proxy') {
         lines.push(`      set PYRIC_AI_PROXY_UPSTREAM to an OpenAI-compatible base URL (default ${AI_PROXY_DEFAULT_UPSTREAM})`);
     }
     if (failure.kind === 'status' && failure.retryAfter !== undefined) {
-        const wait = formatRetryAfter(failure.retryAfter);
+        const wait = formatRetryAfter(failure.retryAfter, failure.credentials ?? []);
         if (wait !== null) {
             lines.push(`      Retry-After: ${wait}, no automatic retry; the status went to the caller`);
         }
@@ -176,6 +185,27 @@ export function permitAiUpstreams(ai) {
     for (const destination of destinations)
         permitGuardHost(destination);
 }
+/** The `key` parameter of `target`, or null when it has none or is not a URL. */
+function urlKeyParam(target) {
+    try {
+        return new URL(target).searchParams.get('key');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The credentials an upstream request carries: the `key` URL parameter, the
+ * `x-goog-api-key` header, and the `Authorization` value without its scheme.
+ */
+function requestCredentials(input, init) {
+    const isRequest = input instanceof Request;
+    const headers = new Headers(isRequest ? input.headers : init?.headers);
+    const urlKey = urlKeyParam(isRequest ? input.url : String(input));
+    const authorization = headers.get('authorization')?.replace(/^\S+\s+/, '') ?? null;
+    const found = [urlKey, headers.get('x-goog-api-key'), authorization];
+    return found.filter((value) => value !== null && value !== '');
+}
 /** Shared upstream I/O for the browser proxy and the direct Node engine.
  * Responses remain incremental; cancellation stops reading without a warning.
  */
@@ -197,7 +227,7 @@ export async function fetchAiUpstream(input, init, throttle, logger, source = 'a
     if (failed) {
         const retryAfter = upstream.headers.get('retry-after');
         note({ kind: 'status', target, latencyMs: Date.now() - startedAt, status: upstream.status,
-            ...(retryAfter !== null ? { retryAfter } : {}) });
+            ...(retryAfter !== null ? { retryAfter, credentials: requestCredentials(input, init) } : {}) });
     }
     const body = upstream.body;
     const hasNoBody = body === null;
@@ -233,6 +263,22 @@ export async function fetchAiUpstream(input, init, throttle, logger, source = 'a
         status: upstream.status, statusText: upstream.statusText, headers: upstream.headers,
     });
 }
+/**
+ * Read an AI proxy request's body, at most {@link AI_PROXY_BODY_LIMIT_BYTES}.
+ * Past the limit it answers 413, and on a broken upload 400, and returns
+ * null: the caller sends nothing upstream. Both proxy routes read through it.
+ */
+export async function readAiProxyBody(req, res) {
+    try {
+        return await collectRawBody(req, AI_PROXY_BODY_LIMIT_BYTES);
+    }
+    catch (error) {
+        const tooLarge = error.code === BODY_TOO_LARGE_CODE;
+        const status = tooLarge ? 413 : 400;
+        res.writeHead(status, closingHeaders({ 'content-type': 'text/plain' })).end(tooLarge ? 'Payload Too Large' : 'Bad Request');
+        return null;
+    }
+}
 /**
  * Handle `POST /__pyric/ai-proxy/<suffix>`: a same-origin passthrough to the
  * configured OpenAI-compatible upstream, so the browser openai engine
@@ -243,7 +289,11 @@ export async function fetchAiUpstream(input, init, throttle, logger, source = 'a
  *   - POST only (the OpenAI chat-completions surface is POST); 405 otherwise.
  *   - the path suffix + query ride through verbatim
  *     (`/__pyric/ai-proxy/chat/completions` becomes `<upstream>/chat/completions`).
- *   - the request body is forwarded verbatim; headers minus the
+ *   - the caller must pass the namespace's loopback guard (Host, and an
+ *     Origin naming this server when one is sent), which the namespace runs
+ *     before this handler: the upstream may carry the developer's key.
+ *   - the request body is forwarded verbatim, up to
+ *     {@link AI_PROXY_BODY_LIMIT_BYTES} (413 past it); headers minus the
  *     origin-sensitive/hop-by-hop set above (`authorization` DOES forward,
  *     since upstreams may require a key).
  *   - the response body is STREAMED through chunk-by-chunk. SSE passthrough
@@ -264,17 +314,10 @@ export async function handleAiProxy(configuredUpstream, throttle, req, res, url,
     const upstreamBase = resolveAiProxyUpstream(configuredUpstream).target;
     const suffix = url.pathname.slice(AI_PROXY_ROUTE.length);
     const target = `${upstreamBase}${suffix}${url.search}`;
-    // Buffer the REQUEST body (small JSON payloads); the RESPONSE streams.
-    const raw = await new Promise((resolve, reject) => {
-        const chunks = [];
-        req.on('data', (c) => chunks.push(c));
-        req.on('end', () => resolve(Buffer.concat(chunks)));
-        req.on('error', reject);
-    });
-    // Copy into a plain-ArrayBuffer view; fetch's BodyInit typing rejects
-    // Buffer's ArrayBufferLike backing.
-    const body = new Uint8Array(raw.byteLength);
-    body.set(raw);
+    // The request body is a bounded JSON payload, read once; the RESPONSE streams.
+    const body = await readAiProxyBody(req, res);
+    if (body === null)
+        return;
     const headers = {};
     for (const [key, value] of Object.entries(req.headers)) {
         if (value === undefined)
@@ -298,6 +341,15 @@ export async function handleAiProxy(configuredUpstream, throttle, req, res, url,
             `(default ${AI_PROXY_DEFAULT_UPSTREAM}).`);
         return;
     }
+    await relayAiUpstream(upstream, res);
+}
+/**
+ * Send an upstream's answer to the caller: its status and content type, then
+ * the body chunk by chunk. SSE passthrough must never buffer. A dropped
+ * client cancels the upstream read so an abandoned stream doesn't keep the
+ * upstream generating.
+ */
+export async function relayAiUpstream(upstream, res) {
     const responseHeaders = { 'cache-control': 'no-store' };
     const contentType = upstream.headers.get('content-type');
     if (contentType)
@@ -308,8 +360,6 @@ export async function handleAiProxy(configuredUpstream, throttle, req, res, url,
         return;
     }
     res.flushHeaders?.();
-    // Chunk-by-chunk passthrough. A dropped client cancels the upstream read
-    // so an abandoned SSE stream doesn't keep the upstream generating.
     const reader = upstream.body.getReader();
     res.on('close', () => {
         void reader.cancel().catch(() => { });

package/dist/serve/ai-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-proxy.js","sourceRoot":"","sources":["../../src/serve/ai-proxy.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAUhE,mEAAmE;AACnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAErE,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAeH;2EAC2E;AAC3E,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,GAAG,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAuB;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,mBAAmB,OAAO,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;IACpF,OAAO,YAAY,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CACzB,OAAuB,EACvB,QAA8B,EAC9B,MAAoB,EACpB,MAAM,GAAG,UAAU;IAEnB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO;IAC3E,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAuB,EAAE,MAAM,GAAG,UAAU;IAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,QAAQ,GAAG,yBAAyB,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACxE,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC;QAC3C,QAAQ,GAAG,qBAAqB,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,yCAAyC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,eAAe,MAAM,KAAK,QAAQ,EAAE;QACpC,cAAc,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK;KAChD,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,+EAA+E,yBAAyB,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,qDAAqD,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAA8B;IAE9B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACxD,IAAI,GAAG,GAAG,yBAAyB,CAAC;IACpC,IAAI,MAAM,GAAiC,SAAS,CAAC;IACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,GAAG,UAAU,CAAC;QACjB,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;SAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,GAAG,WAAW,CAAC;QAClB,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAA8B;IACrE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC;IACxD,IAAI,iBAAiB;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAIjC;IACC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,mBAAmB,GAAG,EAAE,CAAC,IAAI,KAAK,YAAY,CAAC;IACrD,IAAI,mBAAmB;QAAE,YAAY,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,aAAa,KAAK,SAAS;QAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,aAAa,GAAI,EAAE,CAAC,UAAgD,EAAE,OAAO,CAAC;IACpF,MAAM,qBAAqB,GAAG,OAAO,aAAa,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvG,IAAI,qBAAqB;QAAE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5D,KAAK,MAAM,WAAW,IAAI,YAAY;QAAE,eAAe,CAAC,WAAW,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAkC,EAClC,IAA6B,EAC7B,QAA8B,EAC9B,MAAoB,EACpB,MAAM,GAAG,UAAU;IAEnB,MAAM,SAAS,GAAG,KAAK,YAAY,OAAO,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,OAAuB,EAAQ,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtG,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACnE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvF,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC;IAChC,IAAI,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,YAAY,GAAG,IAAI,cAAc,CAAa;QAClD,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,SAAS;oBAAE,OAAO;gBACtB,IAAI,IAAI;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;;oBACxB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS;oBAAE,OAAO;gBACtB,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACpE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;KACF,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE;QAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;KACpF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,kBAAsC,EACtC,QAA8B,EAC9B,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,MAAoB;IAEpB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAEvD,uEAAuE;IACvE,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,sEAAsE;IACtE,oCAAoC;IACpC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEd,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,0EAA0E;QAC1E,yEAAyE;QACzE,mDAAmD;QACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CACL,gCAAgC,SAAS,CAAC,MAAM,CAAC,iBAAiB,SAAS,CAAC,KAAK,CAAC,IAAI;YACpF,+DAA+D;YAC/D,YAAY,yBAAyB,IAAI,CAC5C,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,eAAe,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;IAC/D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACA,GAAsD,CAAC,YAAY,EAAE,EAAE,CAAC;IAEzE,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;IACpF,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"ai-proxy.js","sourceRoot":"","sources":["../../src/serve/ai-proxy.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAS/F,mEAAmE;AACnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAErE,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD;4DAC4D;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,wBAAwB,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAiBH;2EAC2E;AAC3E,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,WAA8B;IACnE,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,GAAG,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAuB;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,mBAAmB,OAAO,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;IACpF,OAAO,YAAY,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CACzB,OAAuB,EACvB,QAA8B,EAC9B,MAAoB,EACpB,MAAM,GAAG,UAAU;IAEnB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO;IAC3E,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAuB,EAAE,MAAM,GAAG,UAAU;IAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,QAAQ,GAAG,yBAAyB,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACxE,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC;QAC3C,QAAQ,GAAG,qBAAqB,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,yCAAyC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,eAAe,MAAM,KAAK,QAAQ,EAAE;QACpC,cAAc,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK;KAChD,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,+EAA+E,yBAAyB,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC7E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,qDAAqD,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAA8B;IAE9B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACxD,IAAI,GAAG,GAAG,yBAAyB,CAAC;IACpC,IAAI,MAAM,GAAiC,SAAS,CAAC;IACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,GAAG,UAAU,CAAC;QACjB,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;SAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,GAAG,WAAW,CAAC;QAClB,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAA8B;IACrE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC;IACxD,IAAI,iBAAiB;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAIjC;IACC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,mBAAmB,GAAG,EAAE,CAAC,IAAI,KAAK,YAAY,CAAC;IACrD,IAAI,mBAAmB;QAAE,YAAY,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,aAAa,KAAK,SAAS;QAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,aAAa,GAAI,EAAE,CAAC,UAAgD,EAAE,OAAO,CAAC;IACpF,MAAM,qBAAqB,GAAG,OAAO,aAAa,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvG,IAAI,qBAAqB;QAAE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5D,KAAK,MAAM,WAAW,IAAI,YAAY;QAAE,eAAe,CAAC,WAAW,CAAC,CAAC;AACvE,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAkC,EAAE,IAA6B;IAC3F,MAAM,SAAS,GAAG,KAAK,YAAY,OAAO,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IACnF,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAkC,EAClC,IAA6B,EAC7B,QAA8B,EAC9B,MAAoB,EACpB,MAAM,GAAG,UAAU;IAEnB,MAAM,SAAS,GAAG,KAAK,YAAY,OAAO,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,OAAuB,EAAQ,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtG,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACnE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvF,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC;IAChC,IAAI,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,YAAY,GAAG,IAAI,cAAc,CAAa;QAClD,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,SAAS;oBAAE,OAAO;gBACtB,IAAI,IAAI;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;;oBACxB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS;oBAAE,OAAO;gBACtB,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACpE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;KACF,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE;QAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;KACpF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,GAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAI,KAA4B,CAAC,IAAI,KAAK,mBAAmB,CAAC;QAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC5H,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,kBAAsC,EACtC,QAA8B,EAC9B,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,MAAoB;IAEpB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAEvD,+EAA+E;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO;IAE1B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,0EAA0E;QAC1E,yEAAyE;QACzE,mDAAmD;QACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CACL,gCAAgC,SAAS,CAAC,MAAM,CAAC,iBAAiB,SAAS,CAAC,KAAK,CAAC,IAAI;YACpF,+DAA+D;YAC/D,YAAY,yBAAyB,IAAI,CAC5C,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,GAAmB;IAC3E,MAAM,eAAe,GAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,eAAe,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;IAC/D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACA,GAAsD,CAAC,YAAY,EAAE,EAAE,CAAC;IAEzE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;IACpF,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC"}

package/dist/serve/ai-terminal-blocks.d.ts

@@ -12,6 +12,8 @@ export interface AiRejectionPayload {
     code?: unknown;
     /** The rejection reason: production's own message for shape errors. */
     message?: unknown;
+    /** Pyric's guidance beside production's message, such as the App Check gate's. */
+    hint?: unknown;
 }
 /** Loosely-typed mirror of the AI blocked-response payload. Unlike a
  *  rejection this carries no `message`: a filter block has no error envelope
@@ -51,10 +53,10 @@ export type AiDiagnosticPayload = AiRejectionPayload & AiBlockedPayload & AiMode
 /**
  * Format a relayed AI broker rejection into the compact terminal block, the
  * same `  [pyric] ...` idiom the denial relay and the ai-proxy warning print.
- * Three lines at most: the reason production itself gives, then the model
- * (with the resolved engine, since a rejection reads very differently for
- * `scripted` than for a real upstream), then the wire status. Exported for
- * unit tests.
+ * The reason production itself gives, then the model (with the resolved
+ * engine, since a rejection reads very differently for `scripted` than for a
+ * real upstream), then the wire status, then pyric's guidance when the broker
+ * gave one (the App Check gate does). Exported for unit tests.
  */
 export declare function formatAiRejectionBlock(payload: AiRejectionPayload): string;
 /**

package/dist/serve/ai-terminal-blocks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-terminal-blocks.d.ts","sourceRoot":"","sources":["../../src/serve/ai-terminal-blocks.ts"],"names":[],"mappings":"AAkBA;8DAC8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;mCAGmC;AACnC,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8CAA8C;IAC9C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wDAAwD;IACxD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;yDAEyD;AACzD,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uCAAuC;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,2EAA2E;AAC3E,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,0BAA0B,CAAC;AA4BrG;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAc1E;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAgBtE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,CAS1F;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAAC;IAC7C,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACrD,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACrD;;8DAE0D;IAC1D,UAAU,EAAE,OAAO,CAAC;CACrB;AAwBD;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CAIxE"}
+{"version":3,"file":"ai-terminal-blocks.d.ts","sourceRoot":"","sources":["../../src/serve/ai-terminal-blocks.ts"],"names":[],"mappings":"AAkBA;8DAC8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kFAAkF;IAClF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;mCAGmC;AACnC,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8CAA8C;IAC9C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wDAAwD;IACxD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;yDAEyD;AACzD,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uCAAuC;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,2EAA2E;AAC3E,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,0BAA0B,CAAC;AA4BrG;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAgB1E;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAgBtE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,CAS1F;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAAC;IAC7C,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACrD,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACrD;;8DAE0D;IAC1D,UAAU,EAAE,OAAO,CAAC;CACrB;AAwBD;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CAIxE"}

package/dist/serve/ai-terminal-blocks.js

@@ -31,10 +31,10 @@ function formatModelLine(model, engine) {
 /**
  * Format a relayed AI broker rejection into the compact terminal block, the
  * same `  [pyric] ...` idiom the denial relay and the ai-proxy warning print.
- * Three lines at most: the reason production itself gives, then the model
- * (with the resolved engine, since a rejection reads very differently for
- * `scripted` than for a real upstream), then the wire status. Exported for
- * unit tests.
+ * The reason production itself gives, then the model (with the resolved
+ * engine, since a rejection reads very differently for `scripted` than for a
+ * real upstream), then the wire status, then pyric's guidance when the broker
+ * gave one (the App Check gate does). Exported for unit tests.
  */
 export function formatAiRejectionBlock(payload) {
     const message = readText(payload.message) ?? 'request rejected';
@@ -51,6 +51,9 @@ export function formatAiRejectionBlock(payload) {
             suffix = ` (${code})`;
         lines.push(`      ${label}${suffix}`);
     }
+    const hint = readText(payload.hint);
+    if (hint !== null)
+        lines.push(`      ${hint}`);
     return lines.join('\n');
 }
 /**

package/dist/serve/ai-terminal-blocks.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-terminal-blocks.js","sourceRoot":"","sources":["../../src/serve/ai-terminal-blocks.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAwD5D,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,KAAc,EAAE,QAAgB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAc,EAAE,MAAe;IACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,SAAS,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,iBAAiB,UAAU,EAAE,CAAC;IAC7D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,gBAAgB,SAAS,EAAE,CAAC;IAC5D,OAAO,gBAAgB,SAAS,aAAa,UAAU,GAAG,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA2B;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;QAChC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAyB;IAC5D,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,IAAI,WAAW,IAAI,SAAS,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IACvC,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAmC;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACrE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,GAAG,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACpE,OAAO,qCAAqC,SAAS,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;AAClF,CAAC;AAwBD,MAAM,kBAAkB,GAAiD;IACvE,cAAc,EAAE;QACd,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,sBAAsB;QAC9B,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE;QAC7E,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC;KAC9E;IACD,YAAY,EAAE;QACZ,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,oBAAoB;QAC5B,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE;QAC3E,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAC1B,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;KACjF;IACD,sBAAsB,EAAE;QACtB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,8BAA8B;QACtC,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE;QAClF,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;KAC5E;CACF,CAAC;AAEF;+DAC+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,kBAAkB,CAAC,IAAwB,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"ai-terminal-blocks.js","sourceRoot":"","sources":["../../src/serve/ai-terminal-blocks.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AA0D5D,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,KAAc,EAAE,QAAgB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAc,EAAE,MAAe;IACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,SAAS,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,iBAAiB,UAAU,EAAE,CAAC;IAC7D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,gBAAgB,SAAS,EAAE,CAAC;IAC5D,OAAO,gBAAgB,SAAS,aAAa,UAAU,GAAG,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA2B;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;QAChC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAyB;IAC5D,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,IAAI,WAAW,IAAI,SAAS,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IACvC,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAmC;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACrE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,GAAG,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACpE,OAAO,qCAAqC,SAAS,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;AAClF,CAAC;AAwBD,MAAM,kBAAkB,GAAiD;IACvE,cAAc,EAAE;QACd,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,sBAAsB;QAC9B,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE;QAC7E,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC;KAC9E;IACD,YAAY,EAAE;QACZ,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,oBAAoB;QAC5B,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE;QAC3E,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAC1B,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;KACjF;IACD,sBAAsB,EAAE;QACtB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,8BAA8B;QACtC,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE;QAClF,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;KAC5E;CACF,CAAC;AAEF;+DAC+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,kBAAkB,CAAC,IAAwB,CAAC,CAAC;AACtD,CAAC"}

package/dist/serve/ai-terminal-text.d.ts

@@ -23,6 +23,14 @@
 export declare const AI_TERMINAL_TEXT_MAX = 512;
 /** Cut text to {@link AI_TERMINAL_TEXT_MAX}, marking the cut. */
 export declare function capTerminalText(text: string): string;
+/**
+ * Replace control, bidi-override and line-separator characters with spaces,
+ * and change nothing else: no flattening, no whitespace collapsing, no cut.
+ * For one line of text a reader copies out of the terminal, such as a
+ * pasteable command or JSON fixture, where the exact spacing and the whole
+ * length matter. The caller splits lines first and bounds the total.
+ */
+export declare function stripTerminalControls(text: string): string;
 /**
  * Flatten an upstream-authored string into ONE terminal-safe line.
  *

package/dist/serve/ai-terminal-text.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-terminal-text.d.ts","sourceRoot":"","sources":["../../src/serve/ai-terminal-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAKxC,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGpD;AAOD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGxD"}
+{"version":3,"file":"ai-terminal-text.d.ts","sourceRoot":"","sources":["../../src/serve/ai-terminal-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAKxC,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGpD;AAOD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGxD"}

package/dist/serve/ai-terminal-text.js

@@ -32,6 +32,16 @@ export function capTerminalText(text) {
 /** Control, bidi-override, and line-separator characters. A remote string
  *  carrying these can forge a terminal line or reverse the text around it. */
 const TERMINAL_UNSAFE_CHARS = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g;
+/**
+ * Replace control, bidi-override and line-separator characters with spaces,
+ * and change nothing else: no flattening, no whitespace collapsing, no cut.
+ * For one line of text a reader copies out of the terminal, such as a
+ * pasteable command or JSON fixture, where the exact spacing and the whole
+ * length matter. The caller splits lines first and bounds the total.
+ */
+export function stripTerminalControls(text) {
+    return text.replace(TERMINAL_UNSAFE_CHARS, ' ');
+}
 /**
  * Flatten an upstream-authored string into ONE terminal-safe line.
  *

package/dist/serve/ai-terminal-text.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-terminal-text.js","sourceRoot":"","sources":["../../src/serve/ai-terminal-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,GAAG,iBAAiB,EAAE,CAAC;AACtE,CAAC;AAED;8EAC8E;AAC9E,MAAM,qBAAqB,GACzB,iFAAiF,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACvF,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"ai-terminal-text.js","sourceRoot":"","sources":["../../src/serve/ai-terminal-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,GAAG,iBAAiB,EAAE,CAAC;AACtE,CAAC;AAED;8EAC8E;AAC9E,MAAM,qBAAqB,GACzB,iFAAiF,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACvF,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC"}

package/dist/serve/app-ports.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The ports a page of this app may name in its `Origin` when it opens the
+ * bridge socket or calls a control route.
+ *
+ * A page this server serves names the server's own port. Under a dev server
+ * that proxies `/__pyric/*` to this one, such as `withPyric`'s rewrite under
+ * `pyric sandbox -- next dev`, the page loads from the dev server, so its
+ * Origin names the dev server's port instead. The proxy says which port that
+ * is: it forwards each request with `x-forwarded-host` set to the host the
+ * browser asked it for. A socket the proxy forwards (the Node host's page)
+ * carries that header itself. A socket that comes straight to this server
+ * (the SharedWorker sandbox) does not, but the page's `/__pyric/init.json`
+ * went through the proxy before the page learned the bridge URL, so the
+ * port was learned from that request.
+ *
+ * Only a same-origin request teaches a port: one whose `sec-fetch-site` is
+ * `same-origin`, which the browser sets and a page cannot change. The page
+ * Next serves fetches `/__pyric/*` from Next's own origin, and the proxy
+ * passes the header through. A page on another port that sends the request
+ * itself, even with an `x-forwarded-host` it chose, is `same-site` at most,
+ * so it teaches nothing. A proxy names its own host, never the page's, so a
+ * page on another port that goes through the proxy is still refused. Only
+ * loopback names and the bound host are learned; a name allowed through
+ * `--allowed-host` (a tunnel) is never port-checked in the first place.
+ *
+ * Only the standalone server learns (`learnsProxyPorts`). A mount inside a
+ * dev server, such as the Vite plugin's, serves the page on the connection's
+ * own port, and that dev server may answer cross-origin preflights for
+ * `/__pyric/*` paths it does not handle.
+ */
+import type { IncomingMessage } from 'node:http';
+export interface AppPorts {
+    /** Records the proxy port a same-origin forwarded request names. */
+    learn(req: IncomingMessage): void;
+    /** The ports a page's Origin may name on this request's connection. */
+    forRequest(req: IncomingMessage): number[];
+    /**
+     * The same, plus the proxy's port when a proxy forwarded this WebSocket
+     * upgrade from the page it serves: the Origin names the host the proxy
+     * names in `x-forwarded-host`. A browser cannot put a header on a
+     * WebSocket handshake, so only a proxy can name that host, and it names
+     * its own. The page may open its socket before any same-origin request
+     * has gone through the proxy, as the Node host's page under Next does.
+     */
+    forUpgrade(req: IncomingMessage): number[];
+}
+export declare function createAppPorts(boundHost: string): AppPorts;
+//# sourceMappingURL=app-ports.d.ts.map

package/dist/serve/app-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-ports.d.ts","sourceRoot":"","sources":["../../src/serve/app-ports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMjD,MAAM,WAAW,QAAQ;IACvB,oEAAoE;IACpE,KAAK,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,uEAAuE;IACvE,UAAU,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,EAAE,CAAC;IAC3C;;;;;;;OAOG;IACH,UAAU,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,EAAE,CAAC;CAC5C;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CA8B1D"}

package/dist/serve/app-ports.js

@@ -0,0 +1,82 @@
+import { getHeader, isAllowedHost } from './server.js';
+/** A dev server proxies from one port; a handful covers restarts on new ports. */
+const MAX_LEARNED_PORTS = 8;
+export function createAppPorts(boundHost) {
+    const learned = new Set();
+    const forRequest = (req) => {
+        const ports = [...learned];
+        const localPort = req.socket?.localPort;
+        const hasLocalPort = typeof localPort === 'number';
+        if (hasLocalPort)
+            ports.unshift(localPort);
+        return ports;
+    };
+    return {
+        learn(req) {
+            const isSameOrigin = getHeader(req, 'sec-fetch-site') === 'same-origin';
+            if (!isSameOrigin)
+                return;
+            const port = forwardedLoopbackPort(getHeader(req, 'x-forwarded-host'), boundHost);
+            const namesNoPort = port === undefined;
+            if (namesNoPort)
+                return;
+            learned.delete(port);
+            learned.add(port);
+            const isOverCapacity = learned.size > MAX_LEARNED_PORTS;
+            if (isOverCapacity)
+                learned.delete(learned.values().next().value);
+        },
+        forRequest,
+        forUpgrade(req) {
+            const ports = forRequest(req);
+            const proxyPort = proxiedPagePort(req, boundHost);
+            const isProxiedFromItsPage = proxyPort !== undefined;
+            if (isProxiedFromItsPage)
+                ports.push(proxyPort);
+            return ports;
+        },
+    };
+}
+/** The proxy's port when the Origin names the host `x-forwarded-host` names, else `undefined`. */
+function proxiedPagePort(req, boundHost) {
+    const forwardedHost = getHeader(req, 'x-forwarded-host');
+    const originHeader = getHeader(req, 'origin');
+    const lacksEither = forwardedHost === undefined || originHeader === undefined;
+    if (lacksEither)
+        return undefined;
+    let origin;
+    try {
+        origin = new URL(originHeader);
+    }
+    catch {
+        return undefined;
+    }
+    const namesTheProxy = origin.host.toLowerCase() === forwardedHost.trim().toLowerCase();
+    if (!namesTheProxy)
+        return undefined;
+    return forwardedLoopbackPort(forwardedHost, boundHost);
+}
+/** The port in a single loopback `x-forwarded-host`, else `undefined`. */
+function forwardedLoopbackPort(forwardedHost, boundHost) {
+    const hasNoForwardedHost = forwardedHost === undefined || forwardedHost.trim() === '';
+    if (hasNoForwardedHost)
+        return undefined;
+    const namesSeveralHosts = forwardedHost.includes(',');
+    if (namesSeveralHosts)
+        return undefined;
+    let forwarded;
+    try {
+        forwarded = new URL(`http://${forwardedHost.trim()}`);
+    }
+    catch {
+        return undefined;
+    }
+    const isLoopback = isAllowedHost(forwarded.hostname, boundHost);
+    if (!isLoopback)
+        return undefined;
+    const namesNoPort = forwarded.port === '';
+    if (namesNoPort)
+        return 80;
+    return Number(forwarded.port);
+}
+//# sourceMappingURL=app-ports.js.map

package/dist/serve/app-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-ports.js","sourceRoot":"","sources":["../../src/serve/app-ports.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEvD,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAkB5B,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAY,EAAE;QACpD,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QAC3B,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC;QACxC,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC;QACnD,IAAI,YAAY;YAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG;YACP,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,KAAK,aAAa,CAAC;YACxE,IAAI,CAAC,YAAY;gBAAE,OAAO;YAC1B,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,SAAS,CAAC,CAAC;YAClF,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,CAAC;YACvC,IAAI,WAAW;gBAAE,OAAO;YACxB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,GAAG,iBAAiB,CAAC;YACxD,IAAI,cAAc;gBAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;QAC9E,CAAC;QACD,UAAU;QACV,UAAU,CAAC,GAAG;YACZ,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAClD,MAAM,oBAAoB,GAAG,SAAS,KAAK,SAAS,CAAC;YACrD,IAAI,oBAAoB;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,eAAe,CAAC,GAAoB,EAAE,SAAiB;IAC9D,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,aAAa,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,CAAC;IAC9E,IAAI,WAAW;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvF,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACrC,OAAO,qBAAqB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC;AAED,0EAA0E;AAC1E,SAAS,qBAAqB,CAAC,aAAiC,EAAE,SAAiB;IACjF,MAAM,kBAAkB,GAAG,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACtF,IAAI,kBAAkB;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,iBAAiB,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,iBAAiB;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,KAAK,EAAE,CAAC;IAC1C,IAAI,WAAW;QAAE,OAAO,EAAE,CAAC;IAC3B,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC"}

package/dist/serve/bridge-mount.d.ts

@@ -1,6 +1,10 @@
 import type { IncomingMessage, Server, ServerResponse } from 'node:http';
+import { type AppPorts } from './app-ports.js';
 import type { DatabaseRulesDestination, InitPayload } from './init-payload.js';
 import type { HostedRuntimeOptions } from './hosted/runtime.js';
+export declare const HEALTH_PATH = "/__pyric/health";
+/** The 503 a closed mount answers its routes with, so a client knows the host is going away. */
+export declare function answerMountClosed(res: ServerResponse): void;
 export interface BridgeMountOptions {
     hosted?: boolean;
     project?: string;
@@ -15,6 +19,15 @@ export interface BridgeMountOptions {
         boundHost: string;
         allowedHosts?: string[] | true;
     };
+    /** Accept a page on the port of a dev server that proxies `/__pyric/*` to
+     *  this one (`pyric sandbox -- next dev`). Only the standalone server sets
+     *  it. A mount inside a dev server, such as the Vite plugin's, serves the
+     *  page on its own port, which the connection's port already covers. */
+    learnsProxyPorts?: boolean;
+    /** The app's ports, shared with the namespace's guarded routes. The caller
+     *  that passes them teaches them from each request, so the mount does not.
+     *  Absent, the mount keeps its own and learns when `learnsProxyPorts`. */
+    appPorts?: AppPorts;
 }
 export interface BridgeMount {
     /** A null database or Storage source clears the rules, so the default policy applies. */

package/dist/serve/bridge-mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge-mount.d.ts","sourceRoot":"","sources":["../../src/serve/bridge-mount.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAezE,OAAO,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,KAAK,EAAuB,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAuBrF,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;gDAI4C;IAC5C,YAAY,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;KAAE,CAAC;CACtE;AAED,MAAM,WAAW,WAAW;IAC1B,yFAAyF;IACzF;oEACgE;IAChE,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5I,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrH;;6DAEyD;IACzD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,8EAA8E;IAC9E,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,oBAAoB,CAAC;IAC7D,iEAAiE;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB;;;6EAGyE;IACzE,gBAAgB,IAAI,OAAO,CAAC;IAC5B,sBAAsB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACzD,kEAAkE;IAClE,KAAK,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACtD,uCAAuC;IACvC,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;CACxD;AAED,0FAA0F;AAC1F,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG5C;AAED,MAAM,WAAW,iBAAiB;IAChC,gFAAgF;IAChF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,MAAM,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChD;gFAC4E;IAC5E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAC;QAC/D,wCAAwC;QACxC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,kBAAuB,GAAG,WAAW,CA0jB5E"}
+{"version":3,"file":"bridge-mount.d.ts","sourceRoot":"","sources":["../../src/serve/bridge-mount.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAczE,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG/D,OAAO,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,KAAK,EAAuB,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAMrF,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAG7C,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAG3D;AAgBD,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;gDAI4C;IAC5C,YAAY,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;KAAE,CAAC;IACrE;;;4EAGwE;IACxE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;8EAE0E;IAC1E,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,yFAAyF;IACzF;oEACgE;IAChE,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5I,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrH;;6DAEyD;IACzD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,8EAA8E;IAC9E,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,oBAAoB,CAAC;IAC7D,iEAAiE;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB;;;6EAGyE;IACzE,gBAAgB,IAAI,OAAO,CAAC;IAC5B,sBAAsB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACzD,kEAAkE;IAClE,KAAK,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACtD,uCAAuC;IACvC,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;CACxD;AAED,0FAA0F;AAC1F,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG5C;AAED,MAAM,WAAW,iBAAiB;IAChC,gFAAgF;IAChF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,MAAM,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChD;gFAC4E;IAC5E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAC;QAC/D,wCAAwC;QACxC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,kBAAuB,GAAG,WAAW,CAqkB5E"}

package/dist/serve/bridge-mount.js

@@ -27,16 +27,23 @@ import { getBridgeToolSurface } from '../bridge/server/mcp-contract.js';
 import { createAuditWriter } from '../bridge/server/audit.js';
 import { attachPeer, collectBody, BODY_TOO_LARGE_CODE } from '../bridge/server/peer.js';
 import { pointerHeldByAnotherHost } from './discovery.js';
+import { boundedFetch } from '../bounded-request.js';
 import { pyricVersion } from './standalone-assets.js';
 import { getHeader, isAllowedHost, isAllowedLoopbackRequest, isAllowedOrigin, isAllowedUpgrade } from './server.js';
+import { createAppPorts } from './app-ports.js';
 import { MAX_BRIDGE_FRAME_BYTES, MAX_MOUNTED_MCP_SESSIONS, STORAGE_BYTE_ROUTE_CAPABILITY, WORKER_PORT_CAPABILITY, WORKER_RELAY_CAPABILITY } from '../bridge/protocol.js';
 import { STORAGE_ROUTE_PREFIX } from './worker/protocol/storage.js';
 import { HOSTED_METHOD_PATH, HOSTED_METHOD_BODY_LIMIT, HOSTED_REPRO_PATH, hostedMethodRequest, hostedReproRequest } from './hosted/method-protocol.js';
 import { MCP_PROJECT_HEADER, MCP_INSTANCE_HEADER, mcpProjectError } from './mcp-project.js';
 const WS_PATH = '/__pyric/sandbox';
 const MCP_PATH = '/__pyric/mcp';
-const HEALTH_PATH = '/__pyric/health';
+export const HEALTH_PATH = '/__pyric/health';
 const BRIDGE_VERSION = pyricVersion();
+/** The 503 a closed mount answers its routes with, so a client knows the host is going away. */
+export function answerMountClosed(res) {
+    res.writeHead(503, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ error: 'pyric bridge: mount is closed' }));
+}
 /**
  * Test-only: `PYRIC_TEST_PEER_LIVENESS_MS` shortens the host's peer liveness
  * window so app scenarios (`test/apps/host-closes-silent-page`) need not wait
@@ -58,6 +65,10 @@ export function urlHost(host) {
 }
 export function createBridgeMount(opts = {}) {
     const peerOptions = { livenessTimeoutMs: testPeerLivenessMs() };
+    // The ports a page of this app may name in its Origin (see app-ports.ts).
+    const sharesPorts = opts.appPorts !== undefined;
+    const appPorts = opts.appPorts ?? createAppPorts(opts.upgradeGuard?.boundHost ?? 'localhost');
+    const learnsHere = opts.learnsProxyPorts === true && !sharesPorts;
     let hostedRuntime;
     let hostedStartup;
     let disconnectHosted;
@@ -235,6 +246,8 @@ export function createBridgeMount(opts = {}) {
         project,
         instanceId: bridge.instanceId,
         async handler(req, res, url) {
+            if (learnsHere)
+                appPorts.learn(req);
             const isHealthRequest = url.pathname === HEALTH_PATH;
             const isMcpRequest = url.pathname === MCP_PATH;
             const isHostedRepro = url.pathname === HOSTED_REPRO_PATH;
@@ -243,8 +256,7 @@ export function createBridgeMount(opts = {}) {
             const isStorageBytes = url.pathname.startsWith(STORAGE_ROUTE_PREFIX);
             const rejectsClosedRequest = closed && (isHealthRequest || isMcpRequest || isHostedMethod || isStorageBytes);
             if (rejectsClosedRequest) {
-                res.writeHead(503, { 'content-type': 'application/json' });
-                res.end(JSON.stringify({ error: 'pyric bridge: mount is closed' }));
+                answerMountClosed(res);
                 return true;
             }
             if (isHealthRequest) {
@@ -260,7 +272,7 @@ export function createBridgeMount(opts = {}) {
                     const allowedHosts = guard?.allowedHosts;
                     const hasNamedHosts = Array.isArray(allowedHosts);
                     const extra = hasNamedHosts ? allowedHosts : [];
-                    const isForbidden = !isAllowedLoopbackRequest(req, boundHost, extra);
+                    const isForbidden = !isAllowedLoopbackRequest(req, boundHost, extra, appPorts.forRequest(req));
                     if (isForbidden) {
                         res.writeHead(403, { 'content-type': 'application/json' });
                         res.end(JSON.stringify({ error: 'Forbidden: invalid host or origin' }));
@@ -455,7 +467,9 @@ export function createBridgeMount(opts = {}) {
                     const allowedHosts = guard.allowedHosts;
                     const hasNamedHosts = Array.isArray(allowedHosts);
                     const extra = hasNamedHosts ? allowedHosts : [];
-                    const isForbidden = !isAllowedUpgrade(req.headers, boundHost, extra);
+                    const acceptsProxiedPage = opts.learnsProxyPorts === true;
+                    const ports = acceptsProxiedPage ? appPorts.forUpgrade(req) : appPorts.forRequest(req);
+                    const isForbidden = !isAllowedUpgrade(req.headers, boundHost, extra, ports);
                     if (isForbidden) {
                         socket.destroy();
                         return;
@@ -504,11 +518,17 @@ export function createBridgeMount(opts = {}) {
                 const cannotProbe = !currentOrigin?.port || attachmentClosed;
                 if (cannotProbe)
                     return;
+                // By default a bounded request, connect included, so a family whose
+                // connect never completes leaves no socket pending past 1 s (#1167).
+                const probeHealth = (url) => {
+                    const injected = collision.fetchImpl;
+                    if (injected)
+                        return injected(url, { signal: AbortSignal.any([collisionAbort.signal, AbortSignal.timeout(1000)]) });
+                    return boundedFetch(url, { deadlineMs: 1000, signal: collisionAbort.signal });
+                };
                 for (const probe of [`http://127.0.0.1:${currentOrigin.port}`, `http://[::1]:${currentOrigin.port}`]) {
                     try {
-                        const response = await (collision.fetchImpl ?? fetch)(`${probe}${HEALTH_PATH}`, {
-                            signal: AbortSignal.any([collisionAbort.signal, AbortSignal.timeout(1000)]),
-                        });
+                        const response = await probeHealth(`${probe}${HEALTH_PATH}`);
                         if (attachmentClosed)
                             return;
                         const isUnavailable = response.status !== 200;