@pyric/cli 0.1.0-alpha.30.1 → 0.1.0-alpha.31

package/dist/serve/worker/host/auth-credential-sign-in.d.ts

@@ -0,0 +1,33 @@
+import { type Auth, type MintedSession } from 'pyric/auth';
+import { type OAuthCredentialPayload } from './auth-session-seeder.js';
+import type { ResolvedIdentity } from '../protocol.js';
+/** The tenant and page origin a served sign-in mints its session under. */
+export interface CredentialSignInScope {
+    readonly tenantId: string | null;
+    readonly origin?: string;
+}
+/** Use up the calling port's staged result for a provider, or `null` when none was staged. */
+export type TakeStagedSignInResult = (providerId: string) => ResolvedIdentity | null;
+/** A credential as it arrives on the wire: nested, or flat on a native client's op message. */
+export type CredentialPayload = OAuthCredentialPayload & Record<string, unknown>;
+export interface CredentialSignIn {
+    readonly session: MintedSession;
+    readonly providerId: string | null;
+    readonly isNewUser: boolean;
+}
+/**
+ * Sign a port in with a credential.
+ *
+ * An email credential carries its own secret, so the engine checks it here
+ * exactly as `signInWithEmailAndPassword` and `signInWithEmailLink` do. A
+ * provider id that is not federated (a look-alike of `password`, `emailLink`,
+ * `phone`, or an id pyric doesn't know), or a payload whose `signInMethod`
+ * differs from its provider, is refused with in-page's
+ * `auth/no-mock-configured` before the resolver can find or touch an account
+ * (#1466). A federated credential signs in only as a result the port staged
+ * for its provider, as in-page: the sandbox has no identity provider to
+ * redeem a token against, so nothing the payload asserts (`uid`, `email`)
+ * picks the account. With nothing staged it is refused the same way.
+ */
+export declare function signInWithCredentialPayload(auth: Auth, payload: CredentialPayload, scope: CredentialSignInScope, takeStaged: TakeStagedSignInResult): CredentialSignIn;
+//# sourceMappingURL=auth-credential-sign-in.d.ts.map

package/dist/serve/worker/host/auth-credential-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-credential-sign-in.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/host/auth-credential-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAgD,KAAK,IAAI,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEzG,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACnG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8FAA8F;AAC9F,MAAM,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,CAAC;AAErF,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,GAAG,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,qBAAqB,EAC5B,UAAU,EAAE,sBAAsB,GACjC,gBAAgB,CAalB"}

package/dist/serve/worker/host/auth-credential-sign-in.js

@@ -0,0 +1,70 @@
+import { FirebaseError } from 'pyric/app';
+import { AuthCredential, EmailAuthCredential, sandbox } from 'pyric/auth';
+import { isFederatedProviderId, noMockConfiguredError, resolveEmailLinkIdentity } from 'pyric/auth/internal';
+import { resolveOAuthCredentialUser } from './auth-session-seeder.js';
+const EMAIL_PROVIDER_ID = 'password';
+/**
+ * Sign a port in with a credential.
+ *
+ * An email credential carries its own secret, so the engine checks it here
+ * exactly as `signInWithEmailAndPassword` and `signInWithEmailLink` do. A
+ * provider id that is not federated (a look-alike of `password`, `emailLink`,
+ * `phone`, or an id pyric doesn't know), or a payload whose `signInMethod`
+ * differs from its provider, is refused with in-page's
+ * `auth/no-mock-configured` before the resolver can find or touch an account
+ * (#1466). A federated credential signs in only as a result the port staged
+ * for its provider, as in-page: the sandbox has no identity provider to
+ * redeem a token against, so nothing the payload asserts (`uid`, `email`)
+ * picks the account. With nothing staged it is refused the same way.
+ */
+export function signInWithCredentialPayload(auth, payload, scope, takeStaged) {
+    const isEmailCredential = payload.providerId === EMAIL_PROVIDER_ID;
+    if (isEmailCredential)
+        return signInWithEmailCredential(auth, payload, scope);
+    // In-page checks enablement before anything else, so a disabled provider is operation-not-allowed.
+    sandbox.assertAuthProviderEnabled(auth, payload.providerId);
+    const isFederated = isFederatedProviderId(payload.providerId);
+    const signInMethod = payload.signInMethod;
+    const hasOtherSignInMethod = signInMethod !== undefined && signInMethod !== payload.providerId;
+    if (!isFederated || hasOtherSignInMethod)
+        throw noMockConfiguredError(payload.providerId);
+    const staged = takeStaged(payload.providerId);
+    const hasStagedUser = staged !== null && staged.uid !== '';
+    if (!hasStagedUser)
+        throw noMockConfiguredError(payload.providerId);
+    return signInAsStaged(auth, staged, scope);
+}
+/** Sign in as the staged identity: find or create its uid and link the provider, as `auth.acceptIdentity` does. */
+function signInAsStaged(auth, staged, scope) {
+    const { photoURL, ...identity } = staged;
+    const { uid, isNewUser } = resolveOAuthCredentialUser(auth, { ...identity, photoURL: photoURL ?? undefined });
+    const session = sandbox.mintSession(auth, { kind: 'provider', uid, providerId: staged.providerId, ...scope });
+    return { session, providerId: staged.providerId, isNewUser };
+}
+/** Rebuild the email credential and let the engine verify its password or link. A missing secret fails closed. */
+function signInWithEmailCredential(auth, payload, scope) {
+    const credential = AuthCredential.fromJSON(payload);
+    const isEmail = credential instanceof EmailAuthCredential;
+    if (!isEmail)
+        throw invalidCredential();
+    const usesPassword = credential.password !== null;
+    if (usesPassword) {
+        const session = sandbox.mintSession(auth, {
+            kind: 'password', email: credential.email, password: credential.password, ...scope,
+        });
+        return { session, providerId: null, isNewUser: false };
+    }
+    const link = credential.emailLink;
+    const usesLink = link !== null;
+    if (!usesLink)
+        throw invalidCredential();
+    const { user, isNewUser } = resolveEmailLinkIdentity(auth, credential.email, link);
+    const session = sandbox.mintSession(auth, {
+        kind: 'provider', uid: user.uid, providerId: EMAIL_PROVIDER_ID, ...scope,
+    });
+    return { session, providerId: null, isNewUser };
+}
+function invalidCredential() {
+    return new FirebaseError('auth/invalid-credential', 'signInWithCredential: the email credential is invalid.');
+}
+//# sourceMappingURL=auth-credential-sign-in.js.map

package/dist/serve/worker/host/auth-credential-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-credential-sign-in.js","sourceRoot":"","sources":["../../../../src/serve/worker/host/auth-credential-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,OAAO,EAAiC,MAAM,YAAY,CAAC;AACzG,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC7G,OAAO,EAAE,0BAA0B,EAA+B,MAAM,0BAA0B,CAAC;AAqBnG,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAU,EACV,OAA0B,EAC1B,KAA4B,EAC5B,UAAkC;IAElC,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,KAAK,iBAAiB,CAAC;IACnE,IAAI,iBAAiB;QAAE,OAAO,yBAAyB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9E,mGAAmG;IACnG,OAAO,CAAC,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,MAAM,oBAAoB,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,OAAO,CAAC,UAAU,CAAC;IAC/F,IAAI,CAAC,WAAW,IAAI,oBAAoB;QAAE,MAAM,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;IAC3D,IAAI,CAAC,aAAa;QAAE,MAAM,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,mHAAmH;AACnH,SAAS,cAAc,CAAC,IAAU,EAAE,MAAwB,EAAE,KAA4B;IACxF,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;IACzC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,0BAA0B,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;IAC9G,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC9G,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED,kHAAkH;AAClH,SAAS,yBAAyB,CAChC,IAAU,EACV,OAA0B,EAC1B,KAA4B;IAE5B,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,UAAU,YAAY,mBAAmB,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,MAAM,iBAAiB,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC;IAClD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE;YACxC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,GAAG,KAAK;SACnF,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/B,IAAI,CAAC,QAAQ;QAAE,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,wBAAwB,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE;QACxC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,KAAK;KACzE,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,aAAa,CAAC,yBAAyB,EAAE,wDAAwD,CAAC,CAAC;AAChH,CAAC"}

package/dist/serve/worker/host/auth-reauthentication.js

@@ -1,6 +1,6 @@
 import { FirebaseError } from 'pyric/app';
 import { AuthCredential, OAuthProvider, reauthenticateWithCredential, reauthenticateWithPopup } from 'pyric/auth';
-import { withoutJwtClaims } from 'pyric/sandbox/internal';
+import { rulesTokenFromIdToken } from 'pyric/sandbox/internal';
 import { requireMatchingPortSession } from './auth-session-seeder.js';
 /** Reuse engine verification without creating a new sign-in or persisted account mutation. */
 export async function reauthenticateSession(current, message) {
@@ -28,8 +28,8 @@ export async function reauthenticateSession(current, message) {
     }
     const user = Object.assign(result.user, { tenantId: original.user.tenantId });
     const token = await user.getIdTokenResult();
-    // Rules read the token claim set without the JWT registered claims, as a fresh session does.
-    const session = { user, state: { ...original.state, token: withoutJwtClaims(token.claims) } };
+    // Rules read the full token claim set, JWT registered claims included, as a fresh session does.
+    const session = { user, state: { ...original.state, token: rulesTokenFromIdToken(token.claims) } };
     return { session, providerId: result.providerId };
 }
 //# sourceMappingURL=auth-reauthentication.js.map

package/dist/serve/worker/host/auth-reauthentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-reauthentication.js","sourceRoot":"","sources":["../../../../src/serve/worker/host/auth-reauthentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,4BAA4B,EAAE,uBAAuB,EAClD,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAMtE,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA6B,EAAE,OAAkC;IAC3G,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,KAAK,mCAAmC,CAAC;IAC5E,IAAI,MAAsB,CAAC;IAC3B,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,CAAC;QACtC,IAAI,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,6CAA6C,CAAC,CAAC;QACjH,MAAM,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,qFAAqF;QACrF,MAAM,OAAO,GAAG,KAAK,IAA6B,EAAE,CAAC,CAAC;YACpD,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;YAC7C,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,aAAa,EAAE,gBAAgB;SAChC,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;YAC5F,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC5C,6FAA6F;IAC7F,MAAM,OAAO,GAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IAC7G,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;AACpD,CAAC"}
+{"version":3,"file":"auth-reauthentication.js","sourceRoot":"","sources":["../../../../src/serve/worker/host/auth-reauthentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,4BAA4B,EAAE,uBAAuB,EAClD,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAMtE,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA6B,EAAE,OAAkC;IAC3G,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,KAAK,mCAAmC,CAAC;IAC5E,IAAI,MAAsB,CAAC;IAC3B,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,CAAC;QACtC,IAAI,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,6CAA6C,CAAC,CAAC;QACjH,MAAM,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,qFAAqF;QACrF,MAAM,OAAO,GAAG,KAAK,IAA6B,EAAE,CAAC,CAAC;YACpD,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;YAC7C,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,aAAa,EAAE,gBAAgB;SAChC,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;YAC5F,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC5C,gGAAgG;IAChG,MAAM,OAAO,GAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IAClH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;AACpD,CAAC"}

package/dist/serve/worker/host/rules.d.ts

@@ -72,7 +72,21 @@ export declare function firestoreRuleMessages(result: {
     line?: number;
     column?: number;
 }[];
-/** Deploy Firestore rules to the sandbox and update `ctx.activeRules.firestore`, refusing non-`cloud.firestore` services. */
+/**
+ * The status of `source`, the Firestore rules the sandbox now enforces, for a
+ * path that installed them without {@link deployFirestoreRulesToHost} (a
+ * tool's seed, a promoted branch, a restored checkpoint). A source production
+ * would not load is `error` with production's reason, never `active`: the
+ * sandbox evaluates no request against it. `previous` is the status it
+ * replaces, whose rules stay the last known good ones.
+ */
+export declare function enforcedFirestoreRulesState(source: string, previous: ActiveRulesState | undefined, activeMessages?: ActiveRulesState['messages']): ActiveRulesState;
+/**
+ * Deploy Firestore rules to the sandbox and update `ctx.activeRules.firestore`.
+ * A source production's load check refuses (it does not parse, names a
+ * service other than `cloud.firestore`, or is past a compile limit) is not
+ * installed, and is reported with the reason every plane gives.
+ */
 export declare function deployFirestoreRulesToHost(ctx: HostCtx, source: string): {
     ok: boolean;
     warnings: ReturnType<typeof lintFirestoreRules>['warnings'];

package/dist/serve/worker/host/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/host/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGxD,OAAO,EACL,kBAAkB,EAInB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,yBAAyB,EAAwB,MAAM,uCAAuC,CAAC;AAC7G,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAA6B,MAAM,oBAAoB,CAAC;AAGnH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,IAAI,CASjG;AAED,oFAAoF;AACpF,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;CACxC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,OAAO,GACd,yBAAyB,CAgB3B;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAOhE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,yBAAyB,CAK/G;AAcD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,CAUjF;AAqBD,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE;cACvE,MAAM,GAAG,MAAM,GAAG,OAAO;UAAQ,MAAM;WAAS,MAAM;aAAW,MAAM;IAQ1G;AAYD,6HAA6H;AAC7H,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG;IACxE,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC5D,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACvC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,CA0CA;AAED,mGAAmG;AACnG,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAuCjG;AAED,oIAAoI;AACpI,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAenE;AAED,kEAAkE;AAClE,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAU5G;AAWD,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,OAAO,CAE9D;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,SAAS,EACd,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,IAAI,CAAC,CAiCf"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/host/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGxD,OAAO,EACL,kBAAkB,EAInB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,yBAAyB,EAAwB,MAAM,uCAAuC,CAAC;AAC7G,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAA6B,MAAM,oBAAoB,CAAC;AAGnH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,IAAI,CASjG;AAED,oFAAoF;AACpF,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;CACxC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,OAAO,GACd,yBAAyB,CAgB3B;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAOhE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,yBAAyB,CAK/G;AAcD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,CAUjF;AAqBD,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE;cACvE,MAAM,GAAG,MAAM,GAAG,OAAO;UAAQ,MAAM;WAAS,MAAM;aAAW,MAAM;IAQ1G;AAmBD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,cAAc,GAAE,gBAAgB,CAAC,UAAU,CAAM,GAChD,gBAAgB,CAalB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG;IACxE,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC5D,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACvC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,CAwBA;AAED,mGAAmG;AACnG,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAqCjG;AAED,oIAAoI;AACpI,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAenE;AAED,kEAAkE;AAClE,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAU5G;AAWD,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,OAAO,CAE9D;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,SAAS,EACd,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,IAAI,CAAC,CAiCf"}

package/dist/serve/worker/host/rules.js

@@ -12,7 +12,7 @@
  */
 import { LOCKED_DATABASE_RULES, withDatabaseRulesPreservedOnReset } from 'pyric/sandbox/internal';
 import { setRules } from 'pyric/sandbox/firestore';
-import { lintFirestoreRules, parseToASTOrError, rulesSourceRejection, } from 'pyric/rules/internal';
+import { lintFirestoreRules, rulesSourceRejection, } from 'pyric/rules/internal';
 import { rtdbRulesSourceRejection } from 'pyric/rules/internal/rtdb';
 import { sandbox as rtdbSandbox } from 'pyric/database';
 import { parseRtdbRulesText } from '../../../rtdb/rules-json.js';
@@ -157,30 +157,49 @@ function compileLimitMessages(violations) {
         ...(violation.column === undefined ? {} : { column: violation.column }),
     }));
 }
-/** Deploy Firestore rules to the sandbox and update `ctx.activeRules.firestore`, refusing non-`cloud.firestore` services. */
+/** Production's refusal of a Firestore source, as error messages at the line and column it reports. */
+function rejectionMessages(rejection) {
+    return rejection.kind === 'parse'
+        ? [{ severity: 'error', text: `Firestore ${rejection.message}`, line: rejection.line, column: rejection.column }]
+        : compileLimitMessages(rejection.violations);
+}
+/**
+ * The status of `source`, the Firestore rules the sandbox now enforces, for a
+ * path that installed them without {@link deployFirestoreRulesToHost} (a
+ * tool's seed, a promoted branch, a restored checkpoint). A source production
+ * would not load is `error` with production's reason, never `active`: the
+ * sandbox evaluates no request against it. `previous` is the status it
+ * replaces, whose rules stay the last known good ones.
+ */
+export function enforcedFirestoreRulesState(source, previous, activeMessages = []) {
+    const rejection = rulesSourceRejection(source);
+    if (rejection === null) {
+        return { status: 'active', source, lastKnownGood: source, updatedAt: Date.now(), messages: activeMessages };
+    }
+    const lastKnownGood = previous?.status === 'active' ? previous.source : previous?.lastKnownGood;
+    return {
+        status: 'error',
+        source,
+        updatedAt: Date.now(),
+        messages: rejectionMessages(rejection),
+        ...(lastKnownGood === undefined ? {} : { lastKnownGood }),
+    };
+}
+/**
+ * Deploy Firestore rules to the sandbox and update `ctx.activeRules.firestore`.
+ * A source production's load check refuses (it does not parse, names a
+ * service other than `cloud.firestore`, or is past a compile limit) is not
+ * installed, and is reported with the reason every plane gives.
+ */
 export function deployFirestoreRulesToHost(ctx, source) {
     const rejection = rulesSourceRejection(source);
-    const parsed = rejection === null ? parseToASTOrError(source) : null;
-    const wrongService = parsed !== null && parsed.ok && parsed.ast.service && parsed.ast.service.name !== 'cloud.firestore'
-        ? parsed.ast.service
-        : null;
-    const refused = rejection !== null || wrongService !== null;
+    const refused = rejection !== null;
     const result = refused ? lintFirestoreRules(source) : setRules(ctx.sandbox, source);
-    const wrongServiceText = wrongService !== null
-        ? `Expected 'service cloud.firestore', got 'service ${wrongService.name}'.`
-        : null;
-    const messages = wrongService !== null
-        ? [{
-                severity: 'error',
-                text: wrongServiceText,
-                ...(wrongService.loc ? { line: wrongService.loc.line } : {}),
-            }]
-        : rejection === null
-            ? firestoreRuleMessages(result)
-            : rejection.kind === 'parse'
-                ? [{ severity: 'error', text: `Firestore ${rejection.message}`, line: rejection.line, column: rejection.column }]
-                : compileLimitMessages(rejection.violations);
-    const okDeploy = !messages.some((m) => m.severity === 'error');
+    const messages = rejection === null ? firestoreRuleMessages(result) : rejectionMessages(rejection);
+    // `ok` reports whether the rules took effect. An installed ruleset with an
+    // error-severity lint finding (an always-true `match /{document=**}`) is
+    // in force, as production deploys it; its findings stay in `messages`.
+    const okDeploy = !refused;
     ctx.activeRules ??= {};
     const previous = ctx.activeRules.firestore?.status === 'active'
         ? ctx.activeRules.firestore.source
@@ -194,24 +213,14 @@ export function deployFirestoreRulesToHost(ctx, source) {
         messages,
         ...(previous ? { lastKnownGood: previous } : {}),
     };
-    const rejectionMessage = wrongServiceText !== null
-        ? `Firestore rules did not compile: ${wrongServiceText}`
-        : rejection !== null
-            ? `Firestore ${rejection.message}`
-            : null;
+    const rejectionMessage = rejection !== null ? `Firestore ${rejection.message}` : null;
     return { ok: okDeploy, warnings: result.warnings, messages, rejectionMessage };
 }
 /** Synchronize `ctx.activeRules` and RTDB instance rules after a full-state checkpoint restore. */
 export function syncHostRulesAfterCheckpointRestore(ctx, rules) {
     if (rules.firestore.length > 0) {
         ctx.activeRules ??= {};
-        ctx.activeRules.firestore = {
-            source: rules.firestore,
-            lastKnownGood: rules.firestore,
-            updatedAt: Date.now(),
-            status: 'active',
-            messages: firestoreRuleMessages(lintFirestoreRules(rules.firestore)),
-        };
+        ctx.activeRules.firestore = enforcedFirestoreRulesState(rules.firestore, ctx.activeRules.firestore, firestoreRuleMessages(lintFirestoreRules(rules.firestore)));
     }
     else if (ctx.activeRules) {
         delete ctx.activeRules.firestore;

package/dist/serve/worker/host/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../../src/serve/worker/host/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,qBAAqB,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE,OAAO,EAAsD,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnF,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,kBAAkB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,MAA4C,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC;AAQD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAY,EACZ,QAA4B,EAC5B,MAAe;IAEf,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC;IACpG,MAAM,aAAa,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;IAChF,0EAA0E;IAC1E,yDAAyD;IACzD,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAC;QAC3H,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IACD,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC;IACzG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAAY;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC3C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC7F,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IAChE,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,MAAc,EAAE,MAAe;IAClF,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IACzG,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,OAAwC;IAChF,MAAM,QAAQ,GAA0C,EAAE,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACnC,GAAG,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,sBAAsB,QAAQ,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,WAAW,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,OAAO;QACL,gBAAgB,CAAC,KAAK;YACpB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,gBAAgB,CAAC,QAAQ,EAAE,KAAK;YAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7F,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,GAAY,EACZ,OAA6C,EAC7C,QAA4B;IAE5B,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,GAAG,CAAC,WAAW,EAAE,SAAS,IAAI,IAAI,CAAC;IACvE,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC;IACpF,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,aAAa,IAAI,IAAI,CAAC;IACzD,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,qBAAqB,CAAC,MAAqE;IACzG,MAAM,QAAQ,GAAiG,EAAE,CAAC;IAClH,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACnG,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0GAA0G;AAC1G,SAAS,oBAAoB,CAAC,UAA4C;IACxE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACpC,QAAQ,EAAE,OAAgB;QAC1B,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QACjE,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACxE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,0BAA0B,CAAC,GAAY,EAAE,MAAc;IAMrE,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,iBAAiB;QACtH,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO;QACpB,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,SAAS,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpF,MAAM,gBAAgB,GAAG,YAAY,KAAK,IAAI;QAC5C,CAAC,CAAC,oDAAoD,YAAY,CAAC,IAAI,IAAI;QAC3E,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,QAAQ,GAAG,YAAY,KAAK,IAAI;QACpC,CAAC,CAAC,CAAC;gBACC,QAAQ,EAAE,OAAgB;gBAC1B,IAAI,EAAE,gBAAiB;gBACvB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC;QACJ,CAAC,CAAC,SAAS,KAAK,IAAI;YAClB,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO;gBAC1B,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAgB,EAAE,IAAI,EAAE,aAAa,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;gBAC1H,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC/D,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,KAAK,QAAQ;QAC7D,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM;QAClC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC;IAC7C,GAAG,CAAC,WAAW,CAAC,SAAS,GAAG;QAC1B,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,IAAI,MAAM;QACvE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;QACrC,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;IACF,MAAM,gBAAgB,GAAG,gBAAgB,KAAK,IAAI;QAChD,CAAC,CAAC,oCAAoC,gBAAgB,EAAE;QACxD,CAAC,CAAC,SAAS,KAAK,IAAI;YAClB,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,EAAE;YAClC,CAAC,CAAC,IAAI,CAAC;IACX,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;AACjF,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mCAAmC,CAAC,GAAY,EAAE,KAAyB;IACzF,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC;QACvB,GAAG,CAAC,WAAW,CAAC,SAAS,GAAG;YAC1B,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,aAAa,EAAE,KAAK,CAAC,SAAS;YAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;SACrE,CAAC;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3B,OAAO,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;IACnC,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5B,WAAW,CAAC,KAAK,GAAG;YAClB,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvC,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC9C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,WAAW,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,KAAK,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS;YAAE,SAAS;QAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;QACrC,MAAM,cAAc,GAAG,aAAa,EAAE,MAAM,CAAC;QAC7C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC;YAC/C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpD,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;AACH,CAAC;AAED,oIAAoI;AACpI,MAAM,UAAU,gCAAgC,CAAC,GAAY;IAC3D,MAAM,cAAc,GAAG,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC;IAClD,MAAM,MAAM,GAAG,cAAc,EAAE,MAAM,CAAC;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9D,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;QACrC,MAAM,cAAc,GAAG,aAAa,EAAE,MAAM,CAAC;QAC7C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC;YAC/C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpD,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAI,GAAY,EAAE,KAAa,EAAE,OAAyB;IAC9F,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,gCAAgC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;SAAM,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC;QAClD,MAAM,MAAM,GAAG,cAAc,EAAE,MAAM,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS;IACpC,UAAU;IACV,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,SAAS,CAAC,MAA2B;IACnD,OAAO,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAY,EACZ,IAAc,EACd,GAAc,EACd,EAAa;IAEb,KAAK,EAAE,CAAC;IACR,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,UAAU,CAAC;QAChB,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC7D,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/D,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,gBAAgB,CAAC;QACtB,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAE,GAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../../src/serve/worker/host/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,qBAAqB,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE,OAAO,EAAsD,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnF,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,kBAAkB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,MAA4C,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC;AAQD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAY,EACZ,QAA4B,EAC5B,MAAe;IAEf,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC;IACpG,MAAM,aAAa,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;IAChF,0EAA0E;IAC1E,yDAAyD;IACzD,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAC;QAC3H,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IACD,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC;IACzG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAAY;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC3C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC7F,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IAChE,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,MAAc,EAAE,MAAe;IAClF,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IACzG,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,OAAwC;IAChF,MAAM,QAAQ,GAA0C,EAAE,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACnC,GAAG,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,sBAAsB,QAAQ,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,WAAW,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,OAAO;QACL,gBAAgB,CAAC,KAAK;YACpB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,gBAAgB,CAAC,QAAQ,EAAE,KAAK;YAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7F,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,GAAY,EACZ,OAA6C,EAC7C,QAA4B;IAE5B,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,GAAG,CAAC,WAAW,EAAE,SAAS,IAAI,IAAI,CAAC;IACvE,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC;IACpF,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,aAAa,IAAI,IAAI,CAAC;IACzD,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,qBAAqB,CAAC,MAAqE;IACzG,MAAM,QAAQ,GAAiG,EAAE,CAAC;IAClH,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACnG,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0GAA0G;AAC1G,SAAS,oBAAoB,CAAC,UAA4C;IACxE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACpC,QAAQ,EAAE,OAAgB;QAC1B,IAAI,EAAE,SAAS,CAAC,OAAO;QACvB,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QACjE,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACxE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uGAAuG;AACvG,SAAS,iBAAiB,CAAC,SAA+B;IACxD,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO;QAC/B,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACjH,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAc,EACd,QAAsC,EACtC,iBAA+C,EAAE;IAEjD,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9G,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC;IAChG,OAAO;QACL,MAAM,EAAE,OAAO;QACf,MAAM;QACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC;QACtC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAY,EAAE,MAAc;IAMrE,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,SAAS,KAAK,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACnG,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC;IAC1B,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,KAAK,QAAQ;QAC7D,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM;QAClC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC;IAC7C,GAAG,CAAC,WAAW,CAAC,SAAS,GAAG;QAC1B,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,IAAI,MAAM;QACvE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;QACrC,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;IACF,MAAM,gBAAgB,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;AACjF,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mCAAmC,CAAC,GAAY,EAAE,KAAyB;IACzF,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC;QACvB,GAAG,CAAC,WAAW,CAAC,SAAS,GAAG,2BAA2B,CACrD,KAAK,CAAC,SAAS,EACf,GAAG,CAAC,WAAW,CAAC,SAAS,EACzB,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAC3D,CAAC;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3B,OAAO,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;IACnC,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5B,WAAW,CAAC,KAAK,GAAG;YAClB,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvC,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC9C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,WAAW,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,KAAK,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS;YAAE,SAAS;QAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;QACrC,MAAM,cAAc,GAAG,aAAa,EAAE,MAAM,CAAC;QAC7C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC;YAC/C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpD,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;AACH,CAAC;AAED,oIAAoI;AACpI,MAAM,UAAU,gCAAgC,CAAC,GAAY;IAC3D,MAAM,cAAc,GAAG,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC;IAClD,MAAM,MAAM,GAAG,cAAc,EAAE,MAAM,CAAC;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9D,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;QACrC,MAAM,cAAc,GAAG,aAAa,EAAE,MAAM,CAAC;QAC7C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC;YAC/C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpD,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAI,GAAY,EAAE,KAAa,EAAE,OAAyB;IAC9F,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,gCAAgC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;SAAM,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC;QAClD,MAAM,MAAM,GAAG,cAAc,EAAE,MAAM,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS;IACpC,UAAU;IACV,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,SAAS,CAAC,MAA2B;IACnD,OAAO,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAY,EACZ,IAAc,EACd,GAAc,EACd,EAAa;IAEb,KAAK,EAAE,CAAC;IACR,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,UAAU,CAAC;QAChB,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC7D,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/D,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,gBAAgB,CAAC;QACtB,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAE,GAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/serve/worker/host/staged-sign-in-results.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Sign-in results a served test staged with `sandbox.mockSignInResult`
+ * (`auth.mockSignInResult`), kept per port (#1466).
+ *
+ * Each port has one slot per provider id: the last result staged wins, and a
+ * sign-in uses it up. That is in-page's rule (`AuthFlowRegistry.setMockResult`
+ * and `consumeMockResult`). Keying by port means one tab, or one register
+ * process, can't stage a sign-in for another, as in-page where each tab has
+ * its own Auth. The host clears a port's slots when it tears the port down,
+ * since a torn-down port can be reused (a Node host session resume, an
+ * app-config eviction). They are never persisted.
+ */
+import type { PortLike } from '../host-context.js';
+import type { ResolvedIdentity } from '../protocol.js';
+export interface StagedSignInResults {
+    /** Stage `identity` for the port's next sign-in with `identity.providerId`. */
+    stage(port: PortLike, identity: ResolvedIdentity): void;
+    /** Use up the port's staged result for `providerId`, or `null` when none. */
+    take(port: PortLike, providerId: string): ResolvedIdentity | null;
+    /** Drop everything the port staged, when the host tears the port down. */
+    clear(port: PortLike): void;
+}
+export declare function createStagedSignInResults(): StagedSignInResults;
+//# sourceMappingURL=staged-sign-in-results.d.ts.map

package/dist/serve/worker/host/staged-sign-in-results.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staged-sign-in-results.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/host/staged-sign-in-results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxD,6EAA6E;IAC7E,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAClE,0EAA0E;IAC1E,KAAK,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAgB,yBAAyB,IAAI,mBAAmB,CA2B/D"}

package/dist/serve/worker/host/staged-sign-in-results.js

@@ -0,0 +1,40 @@
+/**
+ * Sign-in results a served test staged with `sandbox.mockSignInResult`
+ * (`auth.mockSignInResult`), kept per port (#1466).
+ *
+ * Each port has one slot per provider id: the last result staged wins, and a
+ * sign-in uses it up. That is in-page's rule (`AuthFlowRegistry.setMockResult`
+ * and `consumeMockResult`). Keying by port means one tab, or one register
+ * process, can't stage a sign-in for another, as in-page where each tab has
+ * its own Auth. The host clears a port's slots when it tears the port down,
+ * since a torn-down port can be reused (a Node host session resume, an
+ * app-config eviction). They are never persisted.
+ */
+export function createStagedSignInResults() {
+    const slotsByPort = new WeakMap();
+    function slotsFor(port) {
+        let slots = slotsByPort.get(port);
+        if (slots === undefined) {
+            slots = new Map();
+            slotsByPort.set(port, slots);
+        }
+        return slots;
+    }
+    return {
+        stage(port, identity) {
+            slotsFor(port).set(identity.providerId, identity);
+        },
+        take(port, providerId) {
+            const slots = slotsByPort.get(port);
+            const staged = slots?.get(providerId);
+            if (staged === undefined)
+                return null;
+            slots?.delete(providerId);
+            return staged;
+        },
+        clear(port) {
+            slotsByPort.delete(port);
+        },
+    };
+}
+//# sourceMappingURL=staged-sign-in-results.js.map

package/dist/serve/worker/host/staged-sign-in-results.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"staged-sign-in-results.js","sourceRoot":"","sources":["../../../../src/serve/worker/host/staged-sign-in-results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,MAAM,UAAU,yBAAyB;IACvC,MAAM,WAAW,GAAG,IAAI,OAAO,EAA2C,CAAC;IAE3E,SAAS,QAAQ,CAAC,IAAc;QAC9B,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,EAAE,QAAQ;YAClB,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,UAAU;YACnB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/serve/worker/host/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/host/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EASL,KAAK,YAAY,EAElB,MAAM,eAAe,CAAC;AAuBvB,OAAO,KAAK,EAAE,SAAS,EAAqB,MAAM,gBAAgB,CAAC;AAgBnE,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAA6B,MAAM,oBAAoB,CAAC;AAoC5F,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEhF;AAOD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAM5E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAEpE;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAUlF;AAqED,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQlI;AAQD,mGAAmG;AACnG,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CActG;AAED,6EAA6E;AAC7E,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBhG;AA4LD,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,OAAO,CAEhE;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,IAAI,CAAC,CAicf"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../../src/serve/worker/host/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EASL,KAAK,YAAY,EAElB,MAAM,eAAe,CAAC;AAwBvB,OAAO,KAAK,EAAE,SAAS,EAAqB,MAAM,gBAAgB,CAAC;AAgBnE,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAA6B,MAAM,oBAAoB,CAAC;AAoC5F,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEhF;AAOD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAM5E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAEpE;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAUlF;AAqED,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQlI;AAQD,mGAAmG;AACnG,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CActG;AAED,6EAA6E;AAC7E,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBhG;AA0MD,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,OAAO,CAEhE;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,IAAI,CAAC,CAicf"}

package/dist/serve/worker/host/storage.js

@@ -17,7 +17,7 @@
 import { getStorageSandbox, ref as storageRef, listAll as storageListAll, getMetadata as storageGetMetadata, getBlob as storageGetBlob, getBytes as storageGetBytes, deleteObject as storageDeleteObject, } from 'pyric/storage';
 // Host-only rules-bypass admin plane — the storage mirror of
 // `getAdminFirestore`/`getAdminDatabase`, resolved for `actAs: { mode: 'admin' }`.
-import { DEFAULT_BUCKET, bindStorageOperationContext, copyObject, getAdminStorageSandbox, getStorageService, patchObjectMetadata, storageAuth, storageOperationProvenance, targetOf, enforceRules, requestResourceFor, resourceFromStored, uploadObject, uploadObjectReplacing, } from 'pyric/storage/internal';
+import { DEFAULT_BUCKET, bindStorageOperationContext, copyObject, getAdminStorageSandbox, getStorageService, nameStorageBucket, patchObjectMetadata, storageAuth, storageOperationProvenance, targetOf, enforceRules, requestResourceFor, resourceFromStored, uploadObject, uploadObjectReplacing, } from 'pyric/storage/internal';
 import { FirebaseError } from 'pyric/app';
 import { bindOperationContext, getClock } from 'pyric/sandbox/internal';
 import { bytesToBase64, base64ToBytes, storagePayloadTooLarge, storagePartTooLarge, storageQuotaExceeded, MAX_STORAGE_OP_BYTES, MAX_STORAGE_OP_B64_LENGTH, MAX_STORAGE_PART_BYTES, MAX_STORAGE_PART_B64_LENGTH, MAX_STORAGE_OBJECT_BYTES, mintCapabilityToken, storageObjectPath, storageUploadPath, } from '../protocol.js';
@@ -245,6 +245,14 @@ function lensStorage(ctx, actAs, port, bucket = DEFAULT_BUCKET) {
     }
     return handle;
 }
+/**
+ * The handle one op runs on: its lens, on the bucket it stores in, under the
+ * name the caller knows that bucket by. Rules see that name (ST-H2-4); the
+ * store keeps its own key.
+ */
+function opStorage(ctx, msg, port, bucket = bucketOfOp(ctx, msg)) {
+    return nameStorageBucket(lensStorage(ctx, msg.actAs, port, bucket), bucketNameOf(ctx, msg, bucket));
+}
 /**
  * {@link lensStorage} for a bucket other than the default one: the same
  * lenses, on a handle scoped to `bucket`. Each bucket's objects are its own;
@@ -376,7 +384,7 @@ export async function handleStorageOp(ctx, port, msg) {
             // Object browse. `listAll` enforces `read` rules on the scanned prefix
             // under the op's lens (admin lens bypasses — see lensStorage).
             try {
-                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, bucketOfOp(ctx, msg)), opProvenance(msg));
+                const storage = bindStorageOperationContext(opStorage(ctx, msg, port), opProvenance(msg));
                 const result = await storageListAll(storageRef(storage, msg.path));
                 ok(port, msg.id, {
                     items: result.items.map((r) => ({ fullPath: r.fullPath, name: r.name })),
@@ -390,7 +398,7 @@ export async function handleStorageOp(ctx, port, msg) {
         }
         case 'storage.getMetadata': {
             try {
-                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, bucketOfOp(ctx, msg)), opProvenance(msg));
+                const storage = bindStorageOperationContext(opStorage(ctx, msg, port), opProvenance(msg));
                 // FullMetadata is plain JSON (bucket/fullPath/name/size/contentType/...).
                 ok(port, msg.id, namedMetadata(ctx, msg, await storageGetMetadata(storageRef(storage, msg.path))));
             }
@@ -403,7 +411,7 @@ export async function handleStorageOp(ctx, port, msg) {
             // Read rules decide, as for getMetadata. The token persists in the
             // object's metadata, as production keeps it, and is minted on first use.
             try {
-                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, bucketOfOp(ctx, msg)), opProvenance(msg));
+                const storage = bindStorageOperationContext(opStorage(ctx, msg, port), opProvenance(msg));
                 const r = storageRef(storage, msg.path);
                 await storageGetMetadata(r);
                 const target = targetOf(r.storage);
@@ -438,7 +446,7 @@ export async function handleStorageOp(ctx, port, msg) {
                 if (!adminPlane) {
                     throw new FirebaseError('storage/unauthorized', 'storage.setMetadata is the admin plane (firebase-admin File.setMetadata) and runs only on the admin lens.');
                 }
-                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, bucketOfOp(ctx, msg)), opProvenance(msg));
+                const storage = bindStorageOperationContext(opStorage(ctx, msg, port), opProvenance(msg));
                 const result = await patchObjectMetadata(storageRef(storage, msg.path), msg.patch);
                 await bestEffortFlush(ctx, msg.method);
                 ok(port, msg.id, namedMetadata(ctx, msg, result));
@@ -454,7 +462,7 @@ export async function handleStorageOp(ctx, port, msg) {
             // bridge client rejects relaying it (binary-payload guard). Remote
             // callers use `storage.getBytes` (base64) instead.
             try {
-                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, bucketOfOp(ctx, msg)), opProvenance(msg));
+                const storage = bindStorageOperationContext(opStorage(ctx, msg, port), opProvenance(msg));
                 ok(port, msg.id, await storageGetBlob(storageRef(storage, msg.path)));
             }
             catch (e) {
@@ -481,7 +489,7 @@ export async function handleStorageOp(ctx, port, msg) {
                     throw storagePayloadTooLarge(bytes.byteLength, `storage.putBytes payload for '${msg.path}'`);
                 }
                 const bucket = bucketOfOp(ctx, msg);
-                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, bucket), opProvenance(msg));
+                const storage = bindStorageOperationContext(opStorage(ctx, msg, port, bucket), opProvenance(msg));
                 const target = storageRef(storage, msg.path);
                 const { result, replaced: earlier } = await uploadObjectReplacing(target, bytes, toSettableMetadata(msg), { downloadTokens: uploadDownloadTokens(msg) });
                 const replaced = await replacedForRollback(target, msg.rollback, earlier);
@@ -507,7 +515,7 @@ export async function handleStorageOp(ctx, port, msg) {
                     throw storageQuotaExceeded(msg.size, `storage.beginUpload for '${msg.path}'`);
                 }
                 const downloadTokens = uploadDownloadTokens(msg);
-                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, bucketOfOp(ctx, msg)), opProvenance(msg));
+                const storage = bindStorageOperationContext(opStorage(ctx, msg, port), opProvenance(msg));
                 const r = storageRef(storage, msg.path);
                 const target = targetOf(r.storage);
                 const service = await getStorageService(r.storage);
@@ -583,7 +591,7 @@ export async function handleStorageOp(ctx, port, msg) {
                 if (unknownUpload) {
                     throw new FirebaseError('storage/object-not-found', `Upload '${msg.uploadId}' not found or already completed.`);
                 }
-                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, pending.bucket), opProvenance(msg));
+                const storage = bindStorageOperationContext(nameStorageBucket(lensStorage(ctx, msg.actAs, port, pending.bucket), pending.bucketName), opProvenance(msg));
                 const service = await getStorageService(storage);
                 if (!service.backend.readUpload) {
                     throw new FirebaseError('storage/unsupported', 'Current storage backend does not support chunked uploads.');
@@ -630,7 +638,7 @@ export async function handleStorageOp(ctx, port, msg) {
             // run under the same lens; rule-eval order keeps `unauthorized`
             // superseding `not-found`, matching pyric/storage).
             try {
-                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, bucketOfOp(ctx, msg)), opProvenance(msg));
+                const storage = bindStorageOperationContext(opStorage(ctx, msg, port), opProvenance(msg));
                 const r = storageRef(storage, msg.path);
                 const meta = await storageGetMetadata(r);
                 const isRange = msg.offset !== undefined || msg.length !== undefined;
@@ -694,7 +702,7 @@ export async function handleStorageOp(ctx, port, msg) {
             // Async dispatch escapes the ambient window — thread provenance
             // explicitly (issue #84 item 3).
             try {
-                const storage = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, bucketOfOp(ctx, msg)), opProvenance(msg));
+                const storage = bindStorageOperationContext(opStorage(ctx, msg, port), opProvenance(msg));
                 await storageDeleteObject(storageRef(storage, msg.path));
                 await bestEffortFlush(ctx, msg.method);
                 ok(port, msg.id, null);
@@ -733,7 +741,7 @@ export async function handleStorageOp(ctx, port, msg) {
                     throw new FirebaseError('storage/unauthorized', 'storage.copyObject is the admin plane (firebase-admin File.copy) and runs only on the admin lens.');
                 }
                 const provenance = opProvenance(msg);
-                const source = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, bucketOfOp(ctx, msg)), provenance);
+                const source = bindStorageOperationContext(opStorage(ctx, msg, port), provenance);
                 const destinationBucket = storeBucketOf(ctx, msg.destinationBucket);
                 const destination = bindStorageOperationContext(lensStorage(ctx, msg.actAs, port, destinationBucket), provenance);
                 const result = await copyObject(storageRef(source, msg.path), storageRef(destination, msg.destinationPath), msg.patch ?? {}, provenance);